Weaknesses of type CWE-843

606 results

Confusão de Tipos

Ocorre quando o programa trata uma variável ou objeto como se fosse de um tipo diferente do seu tipo real, levando a comportamentos impredizíveis. O atacante explora essa interpretação errada para contornar validações, corromper memória ou executar código arbitrário.

Example

Um aplicativo recebe um valor que valida como inteiro, mas a função que o processa o interpreta como um ponteiro de memória. O código tenta acessar e modificar dados no endereço apontado, causando corrupção ou exposição de informações sensíveis.

How to mitigate

Implemente validação rigorosa e conversão explícita de tipos antes de usar qualquer dado externo. Use linguagens com verificação forte de tipos em tempo de compilação e, quando necessário, valide tanto o tipo quanto o intervalo de valores esperados. Testes de fuzzing e análise estática ajudam a detectar confusões de tipo.

CVE-2012-0507CRITICALUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier,EPSS 98.1%KEVCVE-2017-8291HIGHArtifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile EPSS 96.1%KEVCVE-2011-0611HIGHAdobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.EPSS 94.2%KEVCVE-2019-0752HIGHA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripEPSS 81.6%KEVCVE-2017-0037HIGHMicrosoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakEPSS 80.4%KEVCVE-2016-7201HIGHThe Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memEPSS 79.7%KEVCVE-2020-6418HIGHType confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 78.8%KEVCVE-2018-8298HIGHA remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginEPSS 75.3%KEVCVE-2024-6119HIGHPossible denial of service in X.509 name checksEPSS 66.6%CVE-2021-30551HIGHType confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 64.7%KEVCVE-2023-34967MEDIUMSamba: type confusion in mdssvc rpc service for spotlightEPSS 60.9%CVE-2023-0286HIGHX.400 address type confusion in X.509 GeneralNameEPSS 59.5%CVE-2021-21224HIGHType confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftEPSS 56.2%KEVCVE-2023-3420HIGHType Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 56.2%CVE-2020-16009HIGHInappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption EPSS 48.6%KEVCVE-2019-17026HIGHIncorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted atEPSS 43.7%KEVCVE-2023-6702HIGHType confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 43.5%CVE-2024-38178HIGHScripting Engine Memory Corruption VulnerabilityEPSS 41.4%KEVCVE-2023-2033HIGHType confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 40.8%KEVCVE-2023-4762HIGHType Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (EPSS 38.0%KEV