Weaknesses of type CWE-1021

216 results

Implementação inadequada de mecanismo de segurança

Ocorre quando um desenvolvedor implementa um controle de segurança (autenticação, criptografia, validação, etc.) de forma incorreta ou incompleta, deixando brechas no mecanismo pretendido. A lógica pode estar presente, mas falha na prática porque não cobre todos os casos, usa configurações fracas ou não segue padrões estabelecidos.

Example

Uma aplicação implementa autenticação de dois fatores, mas aceita qualquer código OTP com mais de 4 dígitos sem validar se é realmente o esperado; ou usa MD5 para hash de senhas porque 'é rápido'. O mecanismo existe, mas não funciona corretamente.

How to mitigate

Use bibliotecas e frameworks de segurança consolidados em vez de reinventar a roda; revise implementações críticas (auth, crypto, validação) contra padrões da indústria (OWASP, NIST); execute testes de segurança específicos e code review com foco em lógica de controles, não apenas sintaxe.

CVE-2026-75548MEDIUMEbyte NA111-M Improper Restriction of Rendered UI Layers or FramesEPSS 0.2%CVE-2026-12323MEDIUMSpoofing issue in the DOM: Core & HTML componentEPSS 0.2%CVE-2026-74951MEDIUMClickjacking issue in Firefox for AndroidEPSS 0.2%CVE-2026-20645MEDIUMAn inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS EPSS 0.2%CVE-2026-43688HIGHA memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. PEPSS 0.2%CVE-2025-65922MEDIUMPLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While EPSS 0.2%CVE-2026-3254LOWImproper Restriction of Rendered UI Layers or Frames in GitLabEPSS 0.2%CVE-2026-8022LOWInappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in spEPSS 0.2%CVE-2026-21785MEDIUMHCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security PolicyEPSS 0.1%CVE-2022-33727MEDIUMA vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwaEPSS 0.1%CVE-2022-33723MEDIUMA vulnerable code in onCreate of BluetoothScanDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwantEPSS 0.1%CVE-2026-44762LOWSecurity Misconfiguration in SAP Data Services Management ConsoleEPSS 0.1%CVE-2022-20501HIGHIn onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account dueEPSS 0.1%CVE-2026-86911MEDIUMThis issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. A malicious app may be able to bypass EPSS 0.1%CVE-2022-20553MEDIUMIn onCreate of LogAccessDialogActivity.java, there is a possible way to bypass a permission check due to a tapjacking/overlay attack. This cEPSS 0.1%CVE-2022-20213MEDIUMIn ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local EPSS 0.1%CVE-2022-20215MEDIUMIn onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. This could lead to locEPSS 0.1%CVE-2023-20913HIGHIn onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious phEPSS 0.1%CVE-2026-87486MEDIUMClickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar viaEPSS 0.1%CVE-2026-0007HIGHIn writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. EPSS 0.1%