Fallos del tipo CWE-1021
234 resultadosImplementação inadequada de requisito de segurança
É quando um desenvolvedor implementa um controle de segurança ou funcionalidade crítica de forma incompleta, incorreta ou desalinhada com a intenção original. O código executa, mas não protege contra a ameaça que deveria, deixando brechas exploráveis.
Ejemplo
Um sistema implementa validação de entrada verificando apenas letras, mas esquece de validar tamanho máximo de string. Um atacante envia um payload gigante que causa buffer overflow apesar da validação existir.
Cómo mitigar
Revise a especificação de segurança contra a implementação real (code review com foco em completude). Use testes de segurança específicos (fuzzing, testes de limite) antes de deploy, não confie que 'parece estar protegido'.
CVE-2026-12322MEDIUMClickjacking issue in the Widget: Gtk componentEPSS 0.2%CVE-2026-18159MEDIUMA vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking.
This issue affects OpenText DirectEPSS 0.2%CVE-2026-108901MEDIUMShenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layerEPSS 0.2%CVE-2026-2378HIGHAddress bar spoofing risk in ArcSearch on AndroidEPSS 0.2%CVE-2025-58405MEDIUMLack of protection mechanisms against Clickjacking attacksEPSS 0.2%CVE-2024-56435MEDIUMCross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service EPSS 0.2%CVE-2025-52658LOWHCL MyXalytics is affected by the use of vulnerable/outdated versionsEPSS 0.2%CVE-2024-54112MEDIUMCross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service EPSS 0.2%CVE-2025-30191MEDIUMMalicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensEPSS 0.2%CVE-2025-59849MEDIUMHCL BigFix Remote Control is vulnerable to an insecure CSP configurationEPSS 0.2%CVE-2026-106311MEDIUMClickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UEPSS 0.2%CVE-2025-59479MEDIUMCHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper restriction of rendered UI layers or frames. If a user clicks on content EPSS 0.2%CVE-2025-36149MEDIUMIBM Concert Software clickjackingEPSS 0.2%CVE-2026-44762LOWSecurity Misconfiguration in SAP Data Services Management ConsoleEPSS 0.2%CVE-2024-56436MEDIUMCross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service EPSS 0.2%CVE-2026-106400MEDIUMClickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spEPSS 0.2%CVE-2026-70600LOWElectron: Cross-origin iframe can position native autofill popupEPSS 0.2%CVE-2024-13066MEDIUMiFrame Injection in Akinsoft's LimonDeskEPSS 0.2%CVE-2026-20645MEDIUMAn inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS EPSS 0.2%CVE-2026-12323MEDIUMSpoofing issue in the DOM: Core & HTML componentEPSS 0.2%