Fallos del tipo CWE-1021
215 resultadosImplementação inadequada de requisito de segurança
É quando um desenvolvedor implementa um controle de segurança ou funcionalidade crítica de forma incompleta, incorreta ou desalinhada com a intenção original. O código executa, mas não protege contra a ameaça que deveria, deixando brechas exploráveis.
Ejemplo
Um sistema implementa validação de entrada verificando apenas letras, mas esquece de validar tamanho máximo de string. Um atacante envia um payload gigante que causa buffer overflow apesar da validação existir.
Cómo mitigar
Revise a especificação de segurança contra a implementação real (code review com foco em completude). Use testes de segurança específicos (fuzzing, testes de limite) antes de deploy, não confie que 'parece estar protegido'.
CVE-2026-75548MEDIUMEbyte NA111-M Improper Restriction of Rendered UI Layers or FramesEPSS 0.2%CVE-2026-12323MEDIUMSpoofing issue in the DOM: Core & HTML componentEPSS 0.2%CVE-2026-74951MEDIUMClickjacking issue in Firefox for AndroidEPSS 0.2%CVE-2026-20645MEDIUMAn inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS EPSS 0.2%CVE-2026-43688HIGHA memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. PEPSS 0.2%CVE-2025-65922MEDIUMPLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While EPSS 0.2%CVE-2026-8022LOWInappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in spEPSS 0.2%CVE-2026-3254LOWImproper Restriction of Rendered UI Layers or Frames in GitLabEPSS 0.2%CVE-2022-33723MEDIUMA vulnerable code in onCreate of BluetoothScanDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwantEPSS 0.1%CVE-2022-33727MEDIUMA vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwaEPSS 0.1%CVE-2026-21785MEDIUMHCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security PolicyEPSS 0.1%CVE-2026-44762LOWSecurity Misconfiguration in SAP Data Services Management ConsoleEPSS 0.1%CVE-2022-20501HIGHIn onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account dueEPSS 0.1%CVE-2026-86911MEDIUMThis issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. A malicious app may be able to bypass EPSS 0.1%CVE-2022-20553MEDIUMIn onCreate of LogAccessDialogActivity.java, there is a possible way to bypass a permission check due to a tapjacking/overlay attack. This cEPSS 0.1%CVE-2022-20213MEDIUMIn ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local EPSS 0.1%CVE-2022-20215MEDIUMIn onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. This could lead to locEPSS 0.1%CVE-2023-20913HIGHIn onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious phEPSS 0.1%CVE-2026-87486MEDIUMClickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar viaEPSS 0.1%CVE-2026-0007HIGHIn writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. EPSS 0.1%