Common Weakness Enumeration
CWE-704
Allowed-with-ReviewIncorrect Type Conversion or Cast
Abstraction: Class · Status: Incomplete
The product does not correctly convert an object, resource, or structure from one type to a different type.
352 vulnerabilities reference this CWE, most recent first.
GHSA-Q7F3-6HM8-23CP
Vulnerability from github – Published: 2022-05-24 17:15 – Updated: 2022-05-24 17:15
VLAI
Details
A type confusion vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitary code read/write on the system running it.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2020-7081"
],
"database_specific": {
"cwe_ids": [
"CWE-704",
"CWE-843"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-17T18:15:00Z",
"severity": "HIGH"
},
"details": "A type confusion vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitary code read/write on the system running it.",
"id": "GHSA-q7f3-6hm8-23cp",
"modified": "2022-05-24T17:15:45Z",
"published": "2022-05-24T17:15:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7081"
},
{
"type": "WEB",
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q948-X8RF-888M
Vulnerability from github – Published: 2021-08-25 20:47 – Updated: 2023-06-13 20:12
VLAI
Summary
os_str_bytes relies on undefined behavior of `char::from_u32_unchecked`
Details
The Windows implementation of this crate relied on the behavior of std::char::from_u32_unchecked when its safety clause is violated. Even though this worked with Rust versions up to 1.42 (at least), that behavior could change with any new Rust version, possibly leading a security issue.
The flaw was corrected in version 2.0.0.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "os_str_bytes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-35865"
],
"database_specific": {
"cwe_ids": [
"CWE-704"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-19T21:08:17Z",
"nvd_published_at": "2020-12-31T10:15:00Z",
"severity": "HIGH"
},
"details": "The Windows implementation of this crate relied on the behavior of std::char::from_u32_unchecked when its safety clause is violated. Even though this worked with Rust versions up to 1.42 (at least), that behavior could change with any new Rust version, possibly leading a security issue.\n\nThe flaw was corrected in version 2.0.0.",
"id": "GHSA-q948-x8rf-888m",
"modified": "2023-06-13T20:12:22Z",
"published": "2021-08-25T20:47:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35865"
},
{
"type": "WEB",
"url": "https://github.com/dylni/os_str_bytes/pull/1"
},
{
"type": "PACKAGE",
"url": "https://github.com/dylni/os_str_bytes"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2020-0012.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "os_str_bytes relies on undefined behavior of `char::from_u32_unchecked`"
}
GHSA-QJ3R-X7HH-XQ49
Vulnerability from github – Published: 2022-05-14 01:45 – Updated: 2022-05-14 01:45
VLAI
Details
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, existing checks in place on partition size are incomplete and can lead to heap overwrite vulnerabilities while loading a secure application from the boot loader.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2018-5861"
],
"database_specific": {
"cwe_ids": [
"CWE-704"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-27T16:29:00Z",
"severity": "HIGH"
},
"details": "In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, existing checks in place on partition size are incomplete and can lead to heap overwrite vulnerabilities while loading a secure application from the boot loader.",
"id": "GHSA-qj3r-x7hh-xq49",
"modified": "2022-05-14T01:45:55Z",
"published": "2022-05-14T01:45:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5861"
},
{
"type": "WEB",
"url": "https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=114a392e29bc900c0fe15cc1f3e9ba369cd03244"
},
{
"type": "WEB",
"url": "https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QJ93-37F5-MR29
Vulnerability from github – Published: 2022-05-17 00:00 – Updated: 2022-05-26 21:21
VLAI
Summary
Improper Input Validation in IpMatcher
Details
An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below (IpMatcher) and 4.1.3 and below (WatsonWebserver) due to insufficient validation of input IP addresses and netmasks against the internal Matcher list of IP addresses and subnets.
Severity
9.8 (Critical)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.0.4.1"
},
"package": {
"ecosystem": "NuGet",
"name": "IpMatcher"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-33318"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-704"
],
"github_reviewed": true,
"github_reviewed_at": "2022-05-25T19:26:55Z",
"nvd_published_at": "2022-05-16T16:15:00Z",
"severity": "CRITICAL"
},
"details": "An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below (IpMatcher) and 4.1.3 and below (WatsonWebserver) due to insufficient validation of input IP addresses and netmasks against the internal Matcher list of IP addresses and subnets.",
"id": "GHSA-qj93-37f5-mr29",
"modified": "2022-05-26T21:21:26Z",
"published": "2022-05-17T00:00:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33318"
},
{
"type": "WEB",
"url": "https://github.com/jchristn/IpMatcher/commit/81d77c2f33aa912dbd032b34b9e184fc6e041d89"
},
{
"type": "PACKAGE",
"url": "https://github.com/jchristn/IpMatcher"
},
{
"type": "WEB",
"url": "https://github.com/jchristn/WatsonWebserver"
},
{
"type": "WEB",
"url": "https://github.com/kaoudis/advisories/blob/main/0-2021.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Input Validation in IpMatcher"
}
GHSA-QMP6-R3J7-5R4X
Vulnerability from github – Published: 2022-05-13 01:37 – Updated: 2022-05-13 01:37
VLAI
Details
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the formNodes method of XFA Node objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5018.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2017-14826"
],
"database_specific": {
"cwe_ids": [
"CWE-704",
"CWE-843"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-12-20T14:29:00Z",
"severity": "HIGH"
},
"details": "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the formNodes method of XFA Node objects. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5018.",
"id": "GHSA-qmp6-r3j7-5r4x",
"modified": "2022-05-13T01:37:36Z",
"published": "2022-05-13T01:37:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14826"
},
{
"type": "WEB",
"url": "https://www.foxitsoftware.com/support/security-bulletins.php"
},
{
"type": "WEB",
"url": "https://zerodayinitiative.com/advisories/ZDI-17-870"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QRPM-P2H7-HRV2
Vulnerability from github – Published: 2022-01-21 23:57 – Updated: 2025-11-04 16:35
VLAI
Summary
Exposure of Sensitive Information to an Unauthorized Actor in nanoid
Details
The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
Severity
5.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "nanoid"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.31"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23566"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-704"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-18T21:54:04Z",
"nvd_published_at": "2022-01-14T20:15:00Z",
"severity": "MODERATE"
},
"details": "The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.",
"id": "GHSA-qrpm-p2h7-hrv2",
"modified": "2025-11-04T16:35:00Z",
"published": "2022-01-21T23:57:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23566"
},
{
"type": "WEB",
"url": "https://github.com/ai/nanoid/pull/328"
},
{
"type": "WEB",
"url": "https://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575"
},
{
"type": "WEB",
"url": "https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444"
},
{
"type": "PACKAGE",
"url": "https://github.com/ai/nanoid"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-NANOID-2332193"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Exposure of Sensitive Information to an Unauthorized Actor in nanoid"
}
GHSA-QRV3-R8FP-HQXQ
Vulnerability from github – Published: 2025-08-21 21:32 – Updated: 2025-08-21 21:32
VLAI
Details
Arcane Software’s Vermillion FTP Daemon (vftpd) versions up to and including 1.31 contains a memory corruption vulnerability triggered by a malformed FTP PORT command. The flaw arises from an out-of-bounds array access during input parsing, allowing an attacker to manipulate stack memory and potentially execute arbitrary code. Exploitation requires direct access to the FTP service and is constrained by a single execution attempt if the daemon is installed as a Windows service.
Severity
{
"affected": [],
"aliases": [
"CVE-2010-20115"
],
"database_specific": {
"cwe_ids": [
"CWE-704"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-21T21:15:34Z",
"severity": "CRITICAL"
},
"details": "Arcane Software\u2019s Vermillion FTP Daemon (vftpd) versions up to and including 1.31 contains a memory corruption vulnerability triggered by a malformed FTP PORT command. The flaw arises from an out-of-bounds array access during input parsing, allowing an attacker to manipulate stack memory and potentially execute arbitrary code. Exploitation requires direct access to the FTP service and is constrained by a single execution attempt if the daemon is installed as a Windows service.",
"id": "GHSA-qrv3-r8fp-hqxq",
"modified": "2025-08-21T21:32:08Z",
"published": "2025-08-21T21:32:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-20115"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/vermillion_ftpd_port.rb"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20100213162028/http://www.softsea.com/review/Vermillion-FTP-Daemon.html"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20100416140657/http://www.global-evolution.info/news/files/vftpd/vftpd.txt"
},
{
"type": "WEB",
"url": "https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=23681"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/11293"
},
{
"type": "WEB",
"url": "https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.FTP:EXPLOIT:VERMILLION-PORT-OF.html"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/vermillion-ftp-daemon-port-command-memory-corruption"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-R564-Q8CJ-XG77
Vulnerability from github – Published: 2022-05-14 02:59 – Updated: 2022-05-14 02:59
VLAI
Details
Adobe Flash Player 30.0.0.113 and earlier versions have a Type Confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2018-5007"
],
"database_specific": {
"cwe_ids": [
"CWE-704"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-20T19:29:00Z",
"severity": "HIGH"
},
"details": "Adobe Flash Player 30.0.0.113 and earlier versions have a Type Confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.",
"id": "GHSA-r564-q8cj-xg77",
"modified": "2022-05-14T02:59:16Z",
"published": "2022-05-14T02:59:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5007"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2175"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/flash-player/apsb18-24.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104698"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1041248"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R67M-M8C7-JP83
Vulnerability from github – Published: 2021-08-30 16:11 – Updated: 2022-08-16 18:40
VLAI
Summary
Cachet vulnerable to forced reinstall
Details
Impact
Authenticated users, regardless of their privileges (User or Admin), can trick Cachet and install the instance again, leading to arbitrary code execution on the server.
Patches
This issue was addressed by improving the middleware ReadyForUse, which now performs a stricter validation of the instance name.
Workarounds
Only allow trusted source IP addresses to access to the administration dashboard.
References
- https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection
For more information
If you have any questions or comments about this advisory, you can contact: - The original reporters, by sending an email to vulnerability.research [at] sonarsource.com; - The maintainers, by opening an issue on this repository.
Severity
8.8 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "cachethq/cachet"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-39173"
],
"database_specific": {
"cwe_ids": [
"CWE-704"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-27T23:34:37Z",
"nvd_published_at": "2021-08-27T23:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nAuthenticated users, regardless of their privileges (_User_ or _Admin_), can trick Cachet and install the instance again, leading to arbitrary code execution on the server.\n\n### Patches\n\nThis issue was addressed by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. \n\n### Workarounds\n\nOnly allow trusted source IP addresses to access to the administration dashboard.\n\n### References\n\n- https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection\n\n### For more information\n\nIf you have any questions or comments about this advisory, you can contact:\n- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;\n- The maintainers, by opening an issue on this repository.\n",
"id": "GHSA-r67m-m8c7-jp83",
"modified": "2022-08-16T18:40:56Z",
"published": "2021-08-30T16:11:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/fiveai/Cachet/security/advisories/GHSA-r67m-m8c7-jp83"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39173"
},
{
"type": "WEB",
"url": "https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection"
},
{
"type": "PACKAGE",
"url": "https://github.com/fiveai/Cachet"
},
{
"type": "WEB",
"url": "https://github.com/fiveai/Cachet/releases/tag/v2.5.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Cachet vulnerable to forced reinstall"
}
GHSA-R77J-73RG-4F8H
Vulnerability from github – Published: 2022-05-14 01:41 – Updated: 2022-05-14 01:41
VLAI
Details
In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2018-19134"
],
"database_specific": {
"cwe_ids": [
"CWE-704"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-20T23:29:00Z",
"severity": "HIGH"
},
"details": "In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.",
"id": "GHSA-r77j-73rg-4f8h",
"modified": "2022-05-14T01:41:36Z",
"published": "2022-05-14T01:41:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19134"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3834"
},
{
"type": "WEB",
"url": "https://bugs.ghostscript.com/show_bug.cgi?id=700141"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00019.html"
},
{
"type": "WEB",
"url": "https://semmle.com/news/semmle-discovers-severe-vulnerability-ghostscript-postscript-pdf"
},
{
"type": "WEB",
"url": "https://www.ghostscript.com/doc/9.26/News.htm"
},
{
"type": "WEB",
"url": "http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=693baf02152119af6e6afd30bb8ec76d14f84bbf"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106278"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.