Weaknesses of type CWE-1021

236 results

Implementação inadequada de mecanismo de segurança

Ocorre quando um desenvolvedor implementa um controle de segurança (autenticação, criptografia, validação, etc.) de forma incorreta ou incompleta, deixando brechas no mecanismo pretendido. A lógica pode estar presente, mas falha na prática porque não cobre todos os casos, usa configurações fracas ou não segue padrões estabelecidos.

Example

Uma aplicação implementa autenticação de dois fatores, mas aceita qualquer código OTP com mais de 4 dígitos sem validar se é realmente o esperado; ou usa MD5 para hash de senhas porque 'é rápido'. O mecanismo existe, mas não funciona corretamente.

How to mitigate

Use bibliotecas e frameworks de segurança consolidados em vez de reinventar a roda; revise implementações críticas (auth, crypto, validação) contra padrões da indústria (OWASP, NIST); execute testes de segurança específicos e code review com foco em lógica de controles, não apenas sintaxe.

CVE-2026-12348HIGHAddress Bar Spoofing in Arc Search for Android (window.open race condition)EPSS 0.3%CVE-2026-113063HIGHClickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elemeEPSS 0.3%CVE-2025-32385MEDIUMEspoCRM allows unrestricted Embedding in Iframe dashletEPSS 0.3%CVE-2026-109290HIGHOpen WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX PreviewEPSS 0.3%CVE-2024-55888HIGHContent Security Policy appears to be missing in software and production setupEPSS 0.3%CVE-2026-26000MEDIUMXWiki Platform affected by click-jacking through CSS injection in commentsEPSS 0.3%CVE-2025-0362MEDIUMImproper Restriction of Rendered UI Layers or Frames in GitLabEPSS 0.3%CVE-2026-23731MEDIUMWeGIA Clickjacking VulnerabilityEPSS 0.3%CVE-2024-6466MEDIUMNEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FEPSS 0.3%CVE-2026-16397MEDIUMClickjacking issue in the WebExtensions component in Firefox for AndroidEPSS 0.3%CVE-2025-15032HIGHCVE-2025-15032: Increased Spoofing risk; custom new window missing about:blankEPSS 0.3%CVE-2026-28971MEDIUMThe issue was addressed with improved UI handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS EPSS 0.3%CVE-2025-7903MEDIUMyangzongzhuan RuoYi Image Source ui layerEPSS 0.3%CVE-2024-0669MEDIUMCross-Frame Scripting (XFS) on Plone CMSEPSS 0.3%CVE-2026-75548MEDIUMEbyte NA111-M Improper Restriction of Rendered UI Layers or FramesEPSS 0.3%CVE-2025-1494MEDIUMIBM Cognos Command Center clickjackingEPSS 0.3%CVE-2023-47774MEDIUMWordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerabilityEPSS 0.3%CVE-2025-59950MEDIUMFreshRSS: Double clickjacking can lead to privilege escalationEPSS 0.3%CVE-2025-62328LOWHCL Nomad server on Domino is affected by a missing default frame-ancestors directiveEPSS 0.3%CVE-2025-6434MEDIUMHTTPS-Only exception screen lacked anti-clickjacking delayEPSS 0.3%