Fallos del tipo CWE-1021
234 resultadosImplementação inadequada de requisito de segurança
É quando um desenvolvedor implementa um controle de segurança ou funcionalidade crítica de forma incompleta, incorreta ou desalinhada com a intenção original. O código executa, mas não protege contra a ameaça que deveria, deixando brechas exploráveis.
Ejemplo
Um sistema implementa validação de entrada verificando apenas letras, mas esquece de validar tamanho máximo de string. Um atacante envia um payload gigante que causa buffer overflow apesar da validação existir.
Cómo mitigar
Revise a especificação de segurança contra a implementação real (code review com foco em completude). Use testes de segurança específicos (fuzzing, testes de limite) antes de deploy, não confie que 'parece estar protegido'.
CVE-2022-2965MEDIUMImproper Restriction of Rendered UI Layers or Frames in notrinos/notrinoserpEPSS 0.7%CVE-2022-36319HIGHWhen combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vuEPSS 0.7%CVE-2020-15793—A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header whichEPSS 0.7%CVE-2017-20041MEDIUMUcweb UC Browser HTML URL improper restriction of rendered ui layersEPSS 0.7%CVE-2018-19957—Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloudEPSS 0.7%CVE-2022-36182MEDIUMHashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to maliEPSS 0.7%CVE-2021-27467—A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected product’s web interface allowsEPSS 0.7%CVE-2024-29981MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.7%CVE-2021-38472MEDIUMInHand Networks IR615 RouterEPSS 0.7%CVE-2022-34318MEDIUMIBM CICS TX clickjackingEPSS 0.7%CVE-2024-40817MEDIUMThe issue was addressed with improved UI handling. This issue is fixed in Safari 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS VentuEPSS 0.7%CVE-2023-2013LOWAn issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 beforEPSS 0.7%CVE-2026-58595HIGHMicrosoft Bing App for IOS Spoofing VulnerabilityEPSS 0.7%CVE-2022-22552MEDIUMDell EMC AppSync versions 3.9 to 4.3 contain a clickjacking vulnerability in AppSync. A remote unauthenticated attacker could potentially exEPSS 0.7%CVE-2020-13174—The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which couEPSS 0.7%CVE-2022-29914MEDIUMWhen reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofEPSS 0.7%CVE-2024-2177MEDIUMImproper Restriction of Rendered UI Layers or Frames in GitLabEPSS 0.7%CVE-2023-4958MEDIUMStackrox: missing http security headers allows for clickjacking in web uiEPSS 0.6%CVE-2026-20942MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.6%CVE-2022-29911MEDIUMAn improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execuEPSS 0.6%