Fallos del tipo CWE-1021
215 resultadosImplementação inadequada de requisito de segurança
É quando um desenvolvedor implementa um controle de segurança ou funcionalidade crítica de forma incompleta, incorreta ou desalinhada com a intenção original. O código executa, mas não protege contra a ameaça que deveria, deixando brechas exploráveis.
Ejemplo
Um sistema implementa validação de entrada verificando apenas letras, mas esquece de validar tamanho máximo de string. Um atacante envia um payload gigante que causa buffer overflow apesar da validação existir.
Cómo mitigar
Revise a especificação de segurança contra a implementação real (code review com foco em completude). Use testes de segurança específicos (fuzzing, testes de limite) antes de deploy, não confie que 'parece estar protegido'.
CVE-2022-45418MEDIUMIf a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting inEPSS 0.7%CVE-2022-2965MEDIUMImproper Restriction of Rendered UI Layers or Frames in notrinos/notrinoserpEPSS 0.7%CVE-2018-19957—Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloudEPSS 0.7%CVE-2017-20041MEDIUMUcweb UC Browser HTML URL improper restriction of rendered ui layersEPSS 0.7%CVE-2021-27467—A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected product’s web interface allowsEPSS 0.7%CVE-2024-29981MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.7%CVE-2021-38472MEDIUMInHand Networks IR615 RouterEPSS 0.7%CVE-2022-36319HIGHWhen combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vuEPSS 0.7%CVE-2024-40817MEDIUMThe issue was addressed with improved UI handling. This issue is fixed in Safari 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS VentuEPSS 0.7%CVE-2026-58595HIGHMicrosoft Bing App for IOS Spoofing VulnerabilityEPSS 0.7%CVE-2023-2013LOWAn issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 beforEPSS 0.7%CVE-2022-22552MEDIUMDell EMC AppSync versions 3.9 to 4.3 contain a clickjacking vulnerability in AppSync. A remote unauthenticated attacker could potentially exEPSS 0.7%CVE-2020-13174—The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which couEPSS 0.7%CVE-2022-34318MEDIUMIBM CICS TX clickjackingEPSS 0.7%CVE-2024-2177MEDIUMImproper Restriction of Rendered UI Layers or Frames in GitLabEPSS 0.7%CVE-2023-4958MEDIUMStackrox: missing http security headers allows for clickjacking in web uiEPSS 0.6%CVE-2022-29914MEDIUMWhen reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofEPSS 0.6%CVE-2024-1550MEDIUMA malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-posEPSS 0.6%CVE-2022-36182MEDIUMHashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to maliEPSS 0.6%CVE-2022-45420MEDIUMUse tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resultingEPSS 0.6%