CWE-704 不正确的类型转换 类弱点 66 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-704指不正确的类型转换或强制转换漏洞，属于逻辑错误类缺陷。当程序未能正确将对象或数据结构从一种类型转换为另一种类型时，可能导致数据损坏或意外行为。攻击者通常利用此漏洞通过构造特定输入，触发错误的类型处理逻辑，从而引发崩溃、数据泄露或执行恶意代码。开发者应避免使用不安全的强制转换，确保类型转换前后数据完整性，并实施严格的输入验证与类型检查机制，以消除潜在风险。
unsigned int readdata () { int amount = 0; ... amount = accessmainframe(); ... return amount; }#define NAME_TYPE 1 #define ID_TYPE 2 struct MessageBuffer { int msgType; union { char *name; int nameID; }; }; int main (int argc, char **argv) { struct MessageBuffer buf; char *defaultMessage = "Hello World"; buf.msgType = NAME_TYPE; buf.name = defaultMessage; printf("Pointer of buf.name is %p\n", buf.name); /* This particular value for nameID is used to make the code architecture-independent. If coming from untrusted input, it could be any value. */ buf.nameID = (int)(defaultMessage + 1); printf("Pointer of buf.name is now %p\n", buf.name); if (buf.msgType == NAME_TYPE) { printf("Message: %| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-20072 | Mattermost Mobile Apps 安全漏洞 — Mattermost | 6.5 | Medium | 2025-01-16 |
| CVE-2025-21088 | Mattermost 代码问题漏洞 — Mattermost | 6.5 | Medium | 2025-01-15 |
| CVE-2024-47181 | Contiki-NG 代码问题漏洞 — contiki-ng | 7.5 | High | 2024-11-27 |
| CVE-2024-39590 | OpenPLC 代码问题漏洞 — OpenPLC_v3 | 7.5 | High | 2024-09-18 |
| CVE-2024-39589 | OpenPLC 代码问题漏洞 — OpenPLC_v3 | 7.5 | High | 2024-09-18 |
| CVE-2024-35303 | Siemens Tecnomatix Plant Simulation 代码问题漏洞 — Tecnomatix Plant Simulation V2302 | 7.8 | High | 2024-06-11 |
| CVE-2024-21478 | Qualcomm 芯片 安全漏洞 — Snapdragon | 6.2 | Medium | 2024-06-03 |
| CVE-2024-5436 | Snapchat 安全漏洞 — Snapchat Lenscore | 8.8 | - | 2024-05-31 |
| CVE-2024-28130 | OFFIS DCMTK 代码问题漏洞 — DCMTK | 7.5 | High | 2024-04-23 |
| CVE-2023-33101 | Qualcomm Chipsets 安全漏洞 — Snapdragon | 7.5 | High | 2024-04-01 |
| CVE-2023-6249 | zephyr 安全漏洞 — Zephyr | 8.0 | High | 2024-02-18 |
| CVE-2023-45204 | Siemens Tecnomatix Plant Simulation 代码问题漏洞 — Tecnomatix Plant Simulation V2201 | 7.8 | High | 2023-10-10 |
| CVE-2023-21651 | Qualcomm 芯片 代码问题漏洞 — Snapdragon | 9.3 | Critical | 2023-08-08 |
| CVE-2023-21638 | Qualcomm Chipsets 代码问题漏洞 — Snapdragon | 6.7 | Medium | 2023-07-04 |
| CVE-2022-33240 | Qualcomm Chipsets 代码问题漏洞 — Snapdragon | 6.7 | Medium | 2023-06-06 |
| CVE-2023-21665 | Qualcomm 芯片代码问题漏洞 — Snapdragon | 8.4 | High | 2023-05-02 |
| CVE-2022-33301 | Qualcomm Chipsets 代码问题漏洞 — Snapdragon | 6.7 | Medium | 2023-04-04 |
| CVE-2022-40531 | Google Android 代码问题漏洞 — Snapdragon | 8.4 | High | 2023-03-07 |
| CVE-2022-41911 | Google TensorFlow 代码问题漏洞 — tensorflow | 4.8 | Medium | 2022-11-18 |
| CVE-2022-41890 | Google TensorFlow 代码问题漏洞 — tensorflow | 4.8 | Medium | 2022-11-18 |
| CVE-2022-3979 | NagVis 代码问题漏洞 — NagVis | 5.6 | Medium | 2022-11-13 |
| CVE-2022-41668 | Schneider Electric EcoStruxure Operator Terminal Expert 代码问题漏洞 — EcoStruxure Operator Terminal Expert | 7.0 | High | 2022-11-04 |
| CVE-2021-3578 | Sourceforge mbsync 代码问题漏洞 — isync | 7.8 | - | 2022-02-16 |
| CVE-2021-39173 | Cachet 代码问题漏洞 — Cachet | 8.8 | High | 2021-08-27 |
| CVE-2020-16103 | Gallagher Group Command Centre 代码问题漏洞 — Command Centre | 8.8 | High | 2020-12-14 |
| CVE-2020-6151 | Accusoft ImageGear 代码问题漏洞 — Accusoft | 8.8 | - | 2020-09-01 |
| CVE-2019-12693 | Cisco Adaptive Security Appliance Software 代码问题漏洞 — Cisco Adaptive Security Appliance (ASA) Software | 4.9 | - | 2019-10-02 |
| CVE-2018-17913 | Omron CX-Supervisor 安全漏洞 — CX-Supervisor | 7.3 | - | 2018-11-05 |
| CVE-2018-9943 | Foxit Reader 安全漏洞 — Foxit Reader | 8.8 | - | 2018-05-17 |
| CVE-2018-9942 | Foxit Reader 安全漏洞 — Foxit Reader | 8.8 | - | 2018-05-17 |
CWE-704（不正确的类型转换） 是常见的弱点类别，本平台收录该类弱点关联的 66 条 CVE 漏洞。