CWE-704: Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
A kind of CWE-1474 Non-Equivalent Data Transformation.
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connect Multiple Vulnerabilities in IBM API Connect 4.3 Medium
- kyverno Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic 8.7 High
- spatie url-signer spatie url-signer URL Validation AbstractUrlSigner.php validate type conversion 6.9 Medium
- phpmyadmin sql-parser phpMyAdmin SQL-Parser ExplainStatement.php parse type conversion 6.9 Medium
- xen arbitrary read/write via grant copy 4.4 Medium
- ljharb qs qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string 6.3 Medium
- scriptkittyos beam mcp beam_mcp: JSON boolean and null tool arguments reach dispatch as strings 2.3 Low
- vllm vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features 6.5 Medium
- zcashfoundation zebra Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks 6.9 Medium
- cisco secure firewall adaptive security appliance (asa) software, secure firewall threat defense (ftd) software +1 more Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Certificate Authentication Denial of Service Vulnerability 8.6 High
- mattermost, mattermost server +1 more MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process 4.3 Medium
- google chrome Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010... 4.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 more Microsoft Windows Search Component Elevation of Privilege Vulnerability 7.8 High
- google android In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper... 9.8 Critical
- google android In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting... 8.8 High
- internationalcolorconsortium iccdev iccDEV: CIccEmbedIO::Read8() size_t underflow 6.5 Medium
- mattermost, mattermost server +1 more Boards plugin panics on WebSocket command with non-string field types 6.5 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editor User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter 9.8 Critical
- rsyncproject rsync rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping 6.9 Medium
- kong inc. mesh Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid 5.3 Medium
- trusted computing group tpm2.0 An information leakage vulnerability in the TCG TPM 2.0 reference code. 7.9 High
- eugeny russh Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS) 5.3 Medium
- No product listed An issue was discovered in RISC-V PicoRV32 commit 87c89a. A mismatch in the PCPI INSN and memory... 7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +18 more +20 more Windows Notification Elevation of Privilege Vulnerability 7.8 High
- isaacs node-tar, tar +1 more node-tar: Process crash via PAX numeric path type confusion 5.3 Medium
- coder Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking 7.4 High
- ni grpc-device, instrumentstudio, grpc device server +2 more Unchecked enum cast vulnerability in NI grpc-device in BeginSidebandStream 7.1 High
- spearman unbounded-spsc unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race 5.8 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh +1 more Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh 7.5 High
- ledger live, ledgerhq/hw-app-eth +1 more Ledger Live hw-app-eth EIP-712 Message Parsing Integer Truncation 6.9 Medium
- opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 more OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages 7.5 High
- free5gc free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request) 6.5 Medium
- vllm vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters 6.5 Medium
- chainguard-dev apko apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery 6.5 Medium
- coturn Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64) 7.5 High
- academysoftwarefoundation openexr, red hat enterprise linux 10, enterprise linux 6 +3 more +5 more OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression) 7.1 High
- mrsam net::cidr, net\ +1 more Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact 6.5 Medium
- psd-tools psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps 6.8 Medium
- solarwinds serv-u SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Remote Code Execution Vulnerability 9.1 Critical
- solarwinds serv-u SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability 9.1 Critical
- solarwinds serv-u SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability 9.1 Critical
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more An unsafe cast in the MongoDB query planner can result in a segmentation fault. 7.1 High
- color iccdev iccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate() 7.1 High
- cert-manager cert-manager-controller DoS via Specially Crafted DNS Response 5.9 Medium
- color iccdev iccDEV has UB runtime error in <icTagTypeSignature> 7.8 High
- oneflow A floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows... 6.5 Medium
- python, python software foundation cpython +1 more base64.b64decode() always accepts "+/" characters, despite setting altchars 6.3 Medium
- color iccdev iccDEV has Type Confusion in ToXmlCurve() at IccXML/IccLibXML/IccMpeXml.cpp 8.8 High
- armurox logging redactor, loggingredactor +1 more loggingredactor converts non-string types to string types in logs 2.0 Low
- color iccdev iccDEV has Integer Overflow/Underflow in CIccXmlArrayType::ParseTextCountNum() 7.8 High
- Show olderLoading…