Fallos del tipo CWE-1021
234 resultadosImplementação inadequada de requisito de segurança
É quando um desenvolvedor implementa um controle de segurança ou funcionalidade crítica de forma incompleta, incorreta ou desalinhada com a intenção original. O código executa, mas não protege contra a ameaça que deveria, deixando brechas exploráveis.
Ejemplo
Um sistema implementa validação de entrada verificando apenas letras, mas esquece de validar tamanho máximo de string. Um atacante envia um payload gigante que causa buffer overflow apesar da validação existir.
Cómo mitigar
Revise a especificação de segurança contra a implementação real (code review com foco em completude). Use testes de segurança específicos (fuzzing, testes de limite) antes de deploy, não confie que 'parece estar protegido'.
CVE-2026-113063HIGHClickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elemeEPSS 0.3%CVE-2026-12348HIGHAddress Bar Spoofing in Arc Search for Android (window.open race condition)EPSS 0.3%CVE-2026-26000MEDIUMXWiki Platform affected by click-jacking through CSS injection in commentsEPSS 0.3%CVE-2026-109290HIGHOpen WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX PreviewEPSS 0.3%CVE-2024-55888HIGHContent Security Policy appears to be missing in software and production setupEPSS 0.3%CVE-2025-32385MEDIUMEspoCRM allows unrestricted Embedding in Iframe dashletEPSS 0.3%CVE-2025-0362MEDIUMImproper Restriction of Rendered UI Layers or Frames in GitLabEPSS 0.3%CVE-2026-23731MEDIUMWeGIA Clickjacking VulnerabilityEPSS 0.3%CVE-2024-6466MEDIUMNEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FEPSS 0.3%CVE-2026-16397MEDIUMClickjacking issue in the WebExtensions component in Firefox for AndroidEPSS 0.3%CVE-2025-15032HIGHCVE-2025-15032: Increased Spoofing risk; custom new window missing about:blankEPSS 0.3%CVE-2026-28971MEDIUMThe issue was addressed with improved UI handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS EPSS 0.3%CVE-2025-7903MEDIUMyangzongzhuan RuoYi Image Source ui layerEPSS 0.3%CVE-2026-75548MEDIUMEbyte NA111-M Improper Restriction of Rendered UI Layers or FramesEPSS 0.3%CVE-2025-1494MEDIUMIBM Cognos Command Center clickjackingEPSS 0.3%CVE-2024-0669MEDIUMCross-Frame Scripting (XFS) on Plone CMSEPSS 0.3%CVE-2025-59950MEDIUMFreshRSS: Double clickjacking can lead to privilege escalationEPSS 0.3%CVE-2025-62328LOWHCL Nomad server on Domino is affected by a missing default frame-ancestors directiveEPSS 0.3%CVE-2025-6434MEDIUMHTTPS-Only exception screen lacked anti-clickjacking delayEPSS 0.3%CVE-2025-5267MEDIUMClickjacking vulnerability could have led to leaking saved payment card detailsEPSS 0.3%