Falhas do tipo CWE-843

606 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2012-0507CRITICALUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier,EPSS 98.1%KEVCVE-2017-8291HIGHArtifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile EPSS 96.1%KEVCVE-2011-0611HIGHAdobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.EPSS 94.2%KEVCVE-2019-0752HIGHA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripEPSS 81.6%KEVCVE-2017-0037HIGHMicrosoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakEPSS 80.4%KEVCVE-2016-7201HIGHThe Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memEPSS 79.7%KEVCVE-2020-6418HIGHType confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 78.8%KEVCVE-2018-8298HIGHA remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginEPSS 75.3%KEVCVE-2024-6119HIGHPossible denial of service in X.509 name checksEPSS 66.6%CVE-2021-30551HIGHType confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 64.7%KEVCVE-2023-34967MEDIUMSamba: type confusion in mdssvc rpc service for spotlightEPSS 60.9%CVE-2023-0286HIGHX.400 address type confusion in X.509 GeneralNameEPSS 59.5%CVE-2021-21224HIGHType confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftEPSS 56.2%KEVCVE-2023-3420HIGHType Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 56.2%CVE-2020-16009HIGHInappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption EPSS 48.6%KEVCVE-2019-17026HIGHIncorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted atEPSS 43.7%KEVCVE-2023-6702HIGHType confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 43.5%CVE-2024-38178HIGHScripting Engine Memory Corruption VulnerabilityEPSS 41.4%KEVCVE-2023-2033HIGHType confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 40.8%KEVCVE-2023-4762HIGHType Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (EPSS 38.0%KEV