Weaknesses of type CWE-704

81 results

Tipo, versão ou conversão de tipo incorretos

Ocorre quando o código assume ou força uma conversão de tipo sem validar se o objeto é realmente do tipo esperado, ou quando trata uma versão de estrutura de dados como se fosse outra. Isso pode causar acesso a memória inválida, execução de código não autorizado ou corrupção de dados.

Example

Um serializador desserializa um objeto e o interpreta diretamente como uma classe específica sem verificar seu tipo real; se um atacante enviar um objeto de tipo diferente, o código acessa campos inexistentes ou executa métodos não previstos, causando crash ou fuga de dados.

How to mitigate

Sempre valide o tipo do objeto antes de conversão (use instanceof, type checks ou esquemas de validação). Implemente versionamento explícito de estruturas de dados e recuse desserializações de tipos inesperados. Em linguagens com segurança de tipo, prefira parsing explícito e tratamento de erros sobre conversões diretas.

CVE-2025-41646CRITICALRevPi Webstatus application is vulnerable to an authentication bypassEPSS 44.0%CVE-2018-9940—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9938—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9937—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9942—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9941—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9939—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9943—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 3.2%CVE-2018-9936—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiEPSS 2.7%CVE-2021-35942CRITICALThe wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) whEPSS 2.7%CVE-2021-39173HIGHForced reinstallEPSS 2.4%CVE-2020-16103HIGHType confusion in Gallagher Command Centre Server allows a remote attacker to crash the server or possibly cause remote code execution. ThisEPSS 2.2%CVE-2024-28130HIGHAn incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A speciaEPSS 1.7%CVE-2018-17913—A type confusion vulnerability exists when processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, which may allow an atEPSS 1.6%CVE-2020-6151HIGHA memory corruption vulnerability exists in the TIFF handle_COMPRESSION_PACKBITS functionality of Accusoft ImageGear 19.7. A specially craftEPSS 1.6%CVE-2022-41828HIGHIn Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check thEPSS 1.5%CVE-2019-12693MEDIUMCisco Adaptive Security Appliance Software Secure Copy Denial of Service VulnerabilityEPSS 1.5%CVE-2026-40613HIGHCoturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)EPSS 1.1%CVE-2021-3578—A flaw was found in mbsync before v1.3.6 and v1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arEPSS 1.0%CVE-2024-39590HIGHMultiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3 16bf8bac1a3EPSS 1.0%