cve.bz

CWE-843: Access of Resource Using Incompatible Type (Type Confusion), page 13

Filter

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

What the weakness is: CWE-843 at MITRE

Ask an AI about CWE-843

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-843: Access of Resource Using Incompatible Type and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/843.html and https://cve.bz/cve/cwe/843?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2023-32664EPSS 1.0%

    A type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332. Specially crafted Javascript code inside a malicious PDF document can cause memory corruption and lead to remote code …

  2. 7.8CVE-2023-36887EPSS 1.4%

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

  3. 9.8CVE-2023-38199EPSS 0.7%

    coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka "Content-Type confusion" betwee…

  4. 7.8CVE-2023-35356EPSS 1.2%

    Windows Kernel Elevation of Privilege Vulnerability

  5. 8.1CVE-2023-35297EPSS 1.1%

    Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

  6. 7.8CVE-2023-37376EPSS 0.2%

    A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0002). The affected application contains a type confusion vulnerability while par…

  7. 8.8CVE-2023-2234EPSS 0.5%

    Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.

  8. 9.8CVE-2022-48511EPSS 0.5%

    Use After Free (UAF) vulnerability in the audio PCM driver module under special conditions. Successful exploitation of this vulnerability may cause audio features to perform abnormally.

  9. 6.7CVE-2023-20768EPSS 0.1%

    In ion, there is a possible out of bounds read due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07560720; Issue …

  10. 8.8CVE-2023-3420EPSS 56%

    Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  11. 8.8CVE-2023-32439KEVEPSS 24%

    A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbit…

  12. 7.8CVE-2023-27930EPSS 0.5%

    A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to execute arbitrary code with kernel privileges.

  13. 5.5CVE-2023-3022EPSS 0.2%

    A flaw was found in the IPv6 module of the Linux kernel. The arg.result was not used consistently in fib6_rule_lookup, sometimes holding rt6_info and other times fib6_info. This was not accounted for in other parts of the code where rt6_in…

  14. 8.8CVE-2023-3216EPSS 0.9%

    Type confusion in V8 in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  15. 4.4CVE-2023-20747EPSS 0.09%

    In vcu, there is a possible memory corruption due to type confusion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519103; Issue ID: ALP…

  16. 8.8CVE-2023-3079KEVEPSS 38%

    Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  17. 8.8CVE-2023-28162EPSS 0.7%

    While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird …

  18. 8.8CVE-2023-2936EPSS 23%

    Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  19. 8.8CVE-2023-2935EPSS 24%

    Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  20. 4.3CVE-2023-24599EPSS 0.5%

    OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, aka "ID confusion."

  21. 9.8CVE-2023-25933EPSS 0.9%

    A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to execute arbitrary code via untrusted JavaScript. Note that this is only exploitable in cases where …

  22. 9.8CVE-2023-23557EPSS 0.9%

    An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion. Note that this is only exploitable in…

  23. 8.8CVE-2023-2724EPSS 29%

    Type confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  24. 6.7CVE-2023-20673EPSS 0.10%

    In vcu, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519103; Issue I…

  25. 6.5CVE-2023-24944EPSS 0.7%

    Windows Bluetooth Driver Information Disclosure Vulnerability

  26. 9.8CVE-2023-24823EPSS 1.0%

    RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a type co…

  27. 10.0CVE-2021-33970EPSS 3.1%

    Buffer Overflow vulnerability in Qihoo 360 Chrome v13.0.2170.0 allows attacker to escalate priveleges.

  28. 8.8CVE-2023-2033KEVEPSS 41%

    Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  29. 8.8CVE-2023-28243EPSS 1.6%

    Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability

  30. 8.8CVE-2023-24929EPSS 1.6%

    Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability

  31. 8.8CVE-2023-24927EPSS 1.6%

    Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability

  32. 8.8CVE-2023-24885EPSS 1.6%

    Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability

  33. 7.8CVE-2021-46878EPSS 0.4%

    An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flb_pack_msgpack_to_json_format leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays, leading to use-after-free. Thi…

  34. 9.8CVE-2023-26063EPSS 0.7%

    Certain Lexmark devices through 2023-02-19 access a Resource By Using an Incompatible Type.

  35. 7.8CVE-2022-37377EPSS 1.0%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor 11.1.1.53537;. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or …

  36. 7.8CVE-2023-1078EPSS 0.2%

    A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type con…

  37. 7.0CVE-2023-1077EPSS 0.3%

    In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the…

  38. 5.5CVE-2023-1076EPSS 0.3%

    A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not al…

  39. 3.3CVE-2023-1075EPSS 0.2%

    A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field that overlaps with rec->tx_ready.

  40. 6.7CVE-2023-21056EPSS 0.10%

    In lwis_slc_buffer_free of lwis_device_slc.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploit…

  41. 5.5CVE-2023-0083EPSS 0.2%

    The ArKUI framework subsystem within OpenHarmony-v3.1.5 and prior versions, OpenHarmony-v3.0.7 and prior versions has an Improper Input Validation vulnerability which local attackers can exploit this vulnerability to send malicious data…

  42. 6.3CVE-2023-1235EPSS 0.4%

    Type confusion in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted UI interaction. (Chromium security severity: Low)

  43. 8.8CVE-2023-1215EPSS 0.5%

    Type confusion in CSS in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  44. 8.8CVE-2023-1214EPSS 0.7%

    Type confusion in V8 in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  45. 8.8CVE-2023-23529KEVEPSS 9.4%

    A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitra…

  46. 8.8CVE-2023-22579EPSS 0.8%

    Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.

  47. 7.4CVE-2023-0286EPSS 69%

    There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of …

  48. 8.8CVE-2023-0703EPSS 0.7%

    Type confusion in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via UI interactions. (Chromium security severity…

  49. 8.8CVE-2023-0702EPSS 0.7%

    Type confusion in Data Transfer in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security…

  50. 8.8CVE-2023-0696EPSS 0.6%

    Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)