Fallos del tipo CWE-1021
234 resultadosImplementação inadequada de requisito de segurança
É quando um desenvolvedor implementa um controle de segurança ou funcionalidade crítica de forma incompleta, incorreta ou desalinhada com a intenção original. O código executa, mas não protege contra a ameaça que deveria, deixando brechas exploráveis.
Ejemplo
Um sistema implementa validação de entrada verificando apenas letras, mas esquece de validar tamanho máximo de string. Um atacante envia um payload gigante que causa buffer overflow apesar da validação existir.
Cómo mitigar
Revise a especificação de segurança contra a implementação real (code review com foco em completude). Use testes de segurança específicos (fuzzing, testes de limite) antes de deploy, não confie que 'parece estar protegido'.
CVE-2023-36920MEDIUMClickjacking vulnerability in SAP Enable NowEPSS 0.4%CVE-2023-28159MEDIUMThe fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion orEPSS 0.3%CVE-2023-25748MEDIUMBy displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potential user confusion orEPSS 0.3%CVE-2025-49191MEDIUMDashboards and iFrames can link malicious web contentEPSS 0.3%CVE-2024-39320MEDIUMDiscourse allows iframe injection though default site settingEPSS 0.3%CVE-2025-1917MEDIUMInappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofiEPSS 0.3%CVE-2025-27455MEDIUMCVE-2025-27455EPSS 0.3%CVE-2026-18534HIGHAddress bar spoofing risk in affected iOS versions of Arc SearchEPSS 0.3%CVE-2026-84139CRITICALClickjacking issue in the DOM: Events componentEPSS 0.3%CVE-2026-60370HIGHVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). SupporEPSS 0.3%CVE-2025-41000LOWCross-Frame Scripting (XFS) in BoomCMSEPSS 0.3%CVE-2025-9108MEDIUMPortabilis i-Diario Login Page ui layerEPSS 0.3%CVE-2025-49192MEDIUMClickjackingEPSS 0.3%CVE-2026-37470HIGHAn issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTTEPSS 0.3%CVE-2025-24874MEDIUMMissing Defense in Depth Against Clickjacking in SAP Commerce BackofficeEPSS 0.3%CVE-2025-25213MEDIUMImproper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views and clicks on the cEPSS 0.3%CVE-2024-53976MEDIUMUnder certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what tEPSS 0.3%CVE-2026-22918MEDIUMAn attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously craEPSS 0.3%CVE-2023-45698MEDIUMHCL Sametime is impacted by clickjackingEPSS 0.3%CVE-2025-54527MEDIUMIn JetBrains YouTrack before 2025.2.86935,
2025.2.87167,
2025.3.87341,
2025.3.87344 improper iframe configuration in widget sandbox allowEPSS 0.3%