Fallos del tipo CWE-1021
228 resultadosImplementação inadequada de requisito de segurança
É quando um desenvolvedor implementa um controle de segurança ou funcionalidade crítica de forma incompleta, incorreta ou desalinhada com a intenção original. O código executa, mas não protege contra a ameaça que deveria, deixando brechas exploráveis.
Ejemplo
Um sistema implementa validação de entrada verificando apenas letras, mas esquece de validar tamanho máximo de string. Um atacante envia um payload gigante que causa buffer overflow apesar da validação existir.
Cómo mitigar
Revise a especificação de segurança contra a implementação real (code review com foco em completude). Use testes de segurança específicos (fuzzing, testes de limite) antes de deploy, não confie que 'parece estar protegido'.
CVE-2022-33727MEDIUMA vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwaEPSS 0.2%CVE-2025-65922MEDIUMPLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While EPSS 0.2%CVE-2026-8022LOWInappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in spEPSS 0.2%CVE-2026-3254LOWImproper Restriction of Rendered UI Layers or Frames in GitLabEPSS 0.2%CVE-2026-86911MEDIUMThis issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. A malicious app may be able to bypass EPSS 0.2%CVE-2026-21785MEDIUMHCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security PolicyEPSS 0.1%CVE-2022-20501HIGHIn onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account dueEPSS 0.1%CVE-2022-20553MEDIUMIn onCreate of LogAccessDialogActivity.java, there is a possible way to bypass a permission check due to a tapjacking/overlay attack. This cEPSS 0.1%CVE-2022-20213MEDIUMIn ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local EPSS 0.1%CVE-2022-20215MEDIUMIn onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. This could lead to locEPSS 0.1%CVE-2023-20913HIGHIn onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious phEPSS 0.1%CVE-2026-0007HIGHIn writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. EPSS 0.1%CVE-2026-0061MEDIUMIn multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay aEPSS 0.1%CVE-2026-87486MEDIUMClickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar viaEPSS 0.1%CVE-2025-62316LOWHCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configuredEPSS 0.1%CVE-2024-31324HIGHIn hide of WindowState.java, there is a possible way to bypass tapjacking/overlay protection by launching the activity in portrait mode firsEPSS 0.1%CVE-2025-48639HIGHIn DefaultTransitionHandler.java, there is a possible way to unknowingly grant permissions to an app due to a tapjacking/overlay attack. ThiEPSS 0.1%CVE-2022-20442HIGHIn onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a separate app with API level < 23 due to a EPSS 0.1%CVE-2024-43084MEDIUMIn visitUris of multiple files, there is a possible information disclosure due to a confused deputy. This could lead to local information diEPSS 0.1%CVE-2025-32349HIGHIn multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. This could lead to local escalation of pEPSS 0.1%