CWE-704.

Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic

• kyverno
• CWE-704

arbitrary read/write via grant copy

• Xen
• CWE-704

spatie url-signer URL Validation AbstractUrlSigner.php validate type conversion

• spatie url-signer
• CWE-704

phpMyAdmin SQL-Parser ExplainStatement.php parse type conversion

• phpMyAdmin SQL-Parser
• CWE-704

qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

• CWE-248
• CWE-704

>=6.7.0, <6.16.1 · fixed in 6.16.1

beam_mcp: JSON boolean and null tool arguments reach dispatch as strings

• CWE-704

>=0.1.0, <0.10.1 · fixed in 0.10.1

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

• Denial of service
• Broken access control

<0.30.0 · fixed in 0.30.0

Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks

• ZcashFoundation zebra
• CWE-704

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Certificate Authentication Denial of Service Vulnerability

• Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
• Cisco Secure Firewall Threat Defense (FTD) Software
• CWE-704

MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process

• Mattermost
• CWE-704

Incorrect type conversion in Google Chrome

• Google Chrome
• CWE-704

Incorrect type conversion in Google Android

• Google Android
• CWE-704

Incorrect type conversion in Google Android

• Google Android
• CWE-704

Microsoft Windows Search Component Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-704

iccDEV: CIccEmbedIO::Read8() size_t underflow

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-704

Boards plugin panics on WebSocket command with non-string field types

• Mattermost
• CWE-704

User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter

• cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
• CWE-704

rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping

• rsync
• CWE-704

Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid

• Kong Inc. Kong Mesh
• CWE-248
• CWE-704

An information leakage vulnerability in the TCG TPM 2.0 reference code.

• Trusted Computing Group TPM2.0
• CWE-704

Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

• CWE-704
• CWE-754

<0.62.4 · fixed in 0.62.4

node-tar: Process crash via PAX numeric path type confusion

• CWE-704

<7.5.18 · fixed in 7.5.18

An issue was discovered in RISC-V PicoRV32 commit 87c89a.

• Memory corruption
• CWE-704

Windows Notification Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-704

Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

• Authentication bypass
• CWE-704

<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2 · fixed in 2.29.17, 2.32.7, 2.33.8, 2.34.2

Unchecked enum cast vulnerability in NI grpc-device in BeginSidebandStream

• NI grpc-device
• NI InstrumentStudio
• CWE-704

unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race

• Memory corruption
• CWE-704

<=0.2.0 · no fixed version yet

Ledger Live hw-app-eth EIP-712 Message Parsing Integer Truncation

• ledgerhq/hw-app-eth
• Ledger Live
• CWE-704

OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

• CWE-20
• CWE-248

<0.9.0 · fixed in 0.9.0

free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)

• CWE-704
• CWE-754

<1.4.3 · fixed in 1.4.3

vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters

• Memory corruption
• CWE-704

>=0.18.0, <0.20.0 · fixed in 0.20.0

apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

• CWE-704

<1.2.7 · fixed in 1.2.7

Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)

• coturn
• CWE-704

OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)

• AcademySoftwareFoundation openexr
• Memory corruption
• CWE-475

Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact

• MRSAM Net::CIDR
• CWE-704

psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps

• Memory corruption
• Denial of service

<1.12.2 · fixed in 1.12.2

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Remote Code Execution Vulnerability

• SolarWinds Serv-U
• CWE-704

SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability

• SolarWinds Serv-U
• CWE-704

SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability

• SolarWinds Serv-U
• CWE-704

An unsafe cast in the MongoDB query planner can result in a segmentation fault.

• MongoDB Inc MongoDB Server
• CWE-704

iccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-704

cert-manager-controller DoS via Specially Crafted DNS Response

• CWE-129
• CWE-704

>=1.18.0, <1.18.5 || >=1.19.0, <1.19.3 · fixed in 1.18.5, 1.19.3

iccDEV has UB runtime error in <icTagTypeSignature>

• InternationalColorConsortium iccDEV
• CWE-20
• CWE-681

A floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

• Denial of service
• CWE-681

base64.b64decode() always accepts "+/" characters, despite setting altchars

• Python Software Foundation CPython
• CWE-704

iccDEV has Type Confusion in ToXmlCurve() at IccXML/IccLibXML/IccMpeXml.cpp

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-20

loggingredactor converts non-string types to string types in logs

• CWE-704

<0.0.6 · fixed in 0.0.6

iccDEV has Integer Overflow/Underflow in CIccXmlArrayType::ParseTextCountNum()

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-681

Incorrect type conversion in Google Chrome

• Google Chrome
• CWE-704

Type confusion in string addition in QuickJS

• QuickJS
• CWE-704

Vermillion FTP <= 1.31 Daemon PORT Command Memory Corruption

• Arcane Software Vermillion FTP Daemon
• Memory corruption
• CWE-704

Polkadot Frontier's constructing smart contract can bypass precompile address bounding

• polkadot-evm frontier
• CWE-704

Pilz: Authentication Bypass in IndustrialPI Webstatus

• Pilz IndustrialPI 4 with IndustrialPI webstatus
• CWE-704

RevPi Webstatus application is vulnerable to an authentication bypass

• Kunbus Revolution Pi webstatus
• CWE-704

bpf: Fix wrong reg type conversion in release_reference()

• Linux kernel
• CWE-704

Incorrect Type Conversion or Cast in Multimedia Frameworks

• Qualcomm, Inc. Snapdragon
• CWE-704

Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0

• CWE-704
• CWE-1287

>=7.12.0, <7.12.1 · fixed in 7.12.1

Mobile crash via improper validation of proto style in attachments

• Mattermost
• CWE-704

Mattermost Incorrect Type Conversion or Cast

• CWE-704

<8.0.0-20241127161322-25ff7a3779a5 || >=9.11.0, <9.11.6 || >=10.0.0, <10.0.4 || >=10.1.0, <10.1.4 || >=10.2.0, <10.2.1 · fixed in 8.0.0-20241127161322-25ff7a3779a5, 9.11.6, 10.0.4, 10.1.4, 10.2.1

Unaligned memory access in RPL option processing in Contiki-NG

• contiki-ng
• CWE-704