Weakness (CWE)
CWE-704: Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
Source: MITRE CWE-704
47 results · Clear filters · Feed
-
High 7.5
Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic
Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of int…
-
High 8.6
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Certificate Authentication Denial of Service Vulnerability
A vulnerability in the certification authentication feature of Internet Key Exchange version 2 (IKEv2) for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthentic…
-
High 8.8CVE-2026-28609 Public exploit
In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to r…
-
High 7.8
Microsoft Windows Search Component Elevation of Privilege Vulnerability
Incorrect type conversion or cast in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
-
High 7.9
An information leakage vulnerability in the TCG TPM 2.0 reference code.
An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS aut…
-
High 7.5
An issue was discovered in RISC-V PicoRV32 commit 87c89a. A mismatch in the PCPI INSN and memory address can lead to un…
-
High 7.8
Windows Notification Elevation of Privilege Vulnerability
Incorrect type conversion or cast in Windows Notification allows an authorized attacker to elevate privileges locally.
-
High 7.4
Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked `email_verified` with a direct Go `bool` type assertion. When an IdP returned the claim …
-
High 7.5
OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.1.0 to before version 0.9.0, malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthen…
-
High 7.5
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
-
High 7.5
Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t * to uint16_t * without alignment checks. When processing a crafted STUN messag…
-
High 7.1
OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a misaligned memory write vulnerability exists in LossyDctDecoder_ex…
-
High 7.1
iccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, type confusion allowed malformed ICC profiles to trigger undefined behavior when loading inv…
-
High 7.8
iccDEV has UB runtime error in <icTagTypeSignature>
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Versions prior to 2.3.1.2 have an undefined behavior issue when floating-point NaN values are converted to unsigned sh…
-
High 8.8
iccDEV has Type Confusion in ToXmlCurve() at IccXML/IccLibXML/IccMpeXml.cpp
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `ToXmlCurve()` at `I…
-
High 7.8
iccDEV has Integer Overflow/Underflow in CIccXmlArrayType::ParseTextCountNum()
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have overflows and underflows in CIccXmlArrayType::ParseTextCountNum(). This vulnerability affects users of the iccDEV library who process IC…
-
High 8.8
Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer p…
-
High 7.1
Type confusion in string addition in QuickJS
A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. * The code first checks if the left-hand operand is a string. * It then attempts to convert the right-hand operand to a primitive value using…
-
High 7.8
Incorrect Type Conversion or Cast in Multimedia Frameworks
Memory corruption while processing IOCTL calls.
-
High 7.5
Unaligned memory access in RPL option processing in Contiki-NG
Contiki-NG is an open-source, cross-platform operating system for IoT devices. An unaligned memory access can be triggered in the two RPL implementations of the Contiki-NG operating system. The problem can occur when either one of these RPL implementations is…
-
High 7.8
In writeTypedArrayList and readTypedArrayList of Parcel.java, there is a possible escalation of privilege due to type c…
-
High 7.5
Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of O…
-
High 7.5
Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of O…
-
High 7.8
A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0012), Tecnomatix Plant …
-
High 7.3
Type Confusion in Snapchat Lenscore
Type confusion in Snapchat LensCore could lead to denial of service or arbitrary code execution prior to version 12.88. We recommend upgrading to version 12.88 or above.
-
High 7.5
An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS …
-
High 7.5
Incorrect Type Conversion or Cast in Multi-Mode Call Processor
Transient DOS while processing DL NAS TRANSPORT message with payload length 0.
-
High 8.0
ipm: signed to unsigned conversion problem in esp32_ipm_send
Signed to unsigned conversion esp32_ipm_send
-
High 7.8
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant …
-
High 7.5
Weaviate denial of service vulnerability
An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.
-
High 8.8
An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This…
-
High 8.4
Incorrect Type Conversion or Cast in Graphics
Memory corruption in Graphics while importing a file.
-
High 8.4
Incorrect type conversion in WLAN
Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.
-
High 7.0
A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load…
-
High 8.8CVE-2022-41828 Public exploit
com.amazon.redshift:redshift-jdbc42 vulnerable to remote command execution
In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name.
-
High 7.5
Denial of Service (DoS)
All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. **Note:** pg-native is a mer…
-
High 7.5
Swift-corelibs-foundation denial of service in JSON decoding with JSONDecoder
A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mech…
-
High 7.5
The HwNearbyMain module has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability.Successful explo…
-
High 8.8
Forced reinstall
Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was address…
-
High 7.5
Dangling reference in flatbuffers
An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.