VYPR

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

BaseIncomplete

Description

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Hierarchy (View 1000)

Parents

Children

none

CVEs mapped to this weakness (927)

page 41 of 47
  • CVE-2022-3903MedNov 14, 2022
    Linux
    Kernel
    risk 0.30cvss 4.6epss 0.00

    An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the resources, causing denial of service or potentially crashing the…

  • CVE-2021-23820MedNov 3, 2021
    Manuelstofer
    JSON Pointer
    risk 0.30cvss 5.6epss 0.02

    This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays.

  • CVE-2021-23807MedNov 3, 2021
    Janl
    Jsonpointer
    risk 0.30cvss 5.6epss 0.03

    This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.

  • CVE-2021-23624MedNov 3, 2021
    Dotty Project
    Dotty
    risk 0.30cvss 5.6epss 0.01

    This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.

  • CVE-2021-23509MedNov 3, 2021
    JSON Ptr Project
    JSON Ptr
    risk 0.30cvss 5.6epss 0.02

    This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.

  • CVE-2021-23444MedSep 21, 2021
    Jointjs
    Jointjs
    risk 0.30cvss 5.6epss 0.02

    This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.

  • CVE-2021-23438MedSep 1, 2021
    Mpath Project
    Mpath
    risk 0.30cvss 5.6epss 0.02

    This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if…

  • CVE-2021-23436MedSep 1, 2021
    Immer Project
    Immer
    risk 0.30cvss 5.6epss 0.02

    This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p ===…

  • CVE-2021-23434MedAug 27, 2021
    Object Path Project
    Object Path
    risk 0.30cvss 5.6epss 0.02

    This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is…

  • CVE-2026-79769MedAug 25, 2026
    Sparklemotion
    Nokogiri
    risk 0.29cvss 5.5epss 0.00

    Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls…

  • CVE-2026-45702MedJun 3, 2026
    Op Tee
    OP-TEE
    risk 0.29cvss 4.4epss 0.00

    OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 4.3.0 and prior to version 4.11.0, a type confusion vulnerability exists in OP-TEE OS when…

  • CVE-2025-54649MedAug 6, 2025
    Huawei
    Location Service
    risk 0.29cvss 4.5epss 0.00

    Vulnerability of using incompatible types to access resources in the location service. Impact: Successful exploitation of this vulnerability may cause some location information attributes to be incorrect.

  • CVE-2023-20747MedJun 6, 2023
    Mediatek
    vcu
    risk 0.29cvss 4.4epss 0.00

    In vcu, there is a possible memory corruption due to type confusion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519103; Issue ID: ALPS07519121.

  • CVE-2022-29209MedMay 21, 2022
    Google
    Tensorflow
    risk 0.29cvss 5.5epss 0.00

    TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions (e.g., `CHECK_LT`, `CHECK_GT`, etc.) have an incorrect logic when comparing `size_t` and `int` values. Due to type…

  • CVE-2021-0352MedFeb 3, 2021
    Google
    Android
    risk 0.29cvss 4.4epss 0.00

    In RT regmap driver, there is a possible memory corruption due to type confusion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID:…

  • CVE-2026-87564MedSep 9, 2026
    Google
    Chrome
    risk 0.28cvss 4.3epss 0.00

    Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  • CVE-2026-11785MedJun 9, 2026
    Red Hat
    Directory Server
    risk 0.28cvss 4.3epss 0.00

    A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.

  • CVE-2026-10702MedJun 2, 2026
    Mozilla Corporation
    Firefox
    risk 0.28cvss 4.3epss 0.01

    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.

  • CVE-2025-31206MedMay 12, 2025
    Apple Inc.
    macOS
    risk 0.28cvss 4.3epss 0.01

    A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari…

  • CVE-2025-2197MedApr 17, 2025
    Honojs
    Browser
    risk 0.28cvss 4.3epss 0.00

    Browser is affected by type confusion vulnerability, successful exploitation of this vulnerability may affect service availability.