Fallos del tipo CWE-1021
234 resultadosImplementação inadequada de requisito de segurança
É quando um desenvolvedor implementa um controle de segurança ou funcionalidade crítica de forma incompleta, incorreta ou desalinhada com a intenção original. O código executa, mas não protege contra a ameaça que deveria, deixando brechas exploráveis.
Ejemplo
Um sistema implementa validação de entrada verificando apenas letras, mas esquece de validar tamanho máximo de string. Um atacante envia um payload gigante que causa buffer overflow apesar da validação existir.
Cómo mitigar
Revise a especificação de segurança contra a implementação real (code review com foco em completude). Use testes de segurança específicos (fuzzing, testes de limite) antes de deploy, não confie que 'parece estar protegido'.
CVE-2026-87655MEDIUMClickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elemenEPSS 0.2%CVE-2025-43854LOWDIFY vulnerable to Clickjacking AttackEPSS 0.2%CVE-2025-53096MEDIUMSunshine clickjacking in the UI leads to unauthorized actions being performedEPSS 0.2%CVE-2026-24839MEDIUMDokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headersEPSS 0.2%CVE-2024-10454MEDIUMClickjacking vulnerability in Clibo ManagerEPSS 0.2%CVE-2025-36027MEDIUMIBM Datacap clickjackingEPSS 0.2%CVE-2025-14809HIGHAddress bar spoofing risk in ArcSearch on AndroidEPSS 0.2%CVE-2022-20214MEDIUMIn Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can overlay the toggle buttonEPSS 0.2%CVE-2025-6557MEDIUMInsufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker who convinced a user tEPSS 0.2%CVE-2026-71177MEDIUMDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or FrEPSS 0.2%CVE-2026-59791LOWIn JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possibleEPSS 0.2%CVE-2025-0421MEDIUMiFrame Injection in Mikrogrup's ShopsideEPSS 0.2%CVE-2023-42011MEDIUMIBM Sterling B2B Integrator Standard Edition tapjackingEPSS 0.2%CVE-2026-10733MEDIUMImproper Restriction of Rendered UI Layers or Frames in GitLabEPSS 0.2%CVE-2023-0654LOWSpoofing User's Activity Loads in WARP Mobile Client (Android)EPSS 0.2%CVE-2026-87538MEDIUMClickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveragEPSS 0.2%CVE-2026-119715MEDIUMNocoDB before 2026.08.0 Clickjacking via Missing Frame-Control HeadersEPSS 0.2%CVE-2025-28129MEDIUMPhpgurukul Hostel Management System 2.1 is vulnerable to clickjacking.EPSS 0.2%CVE-2025-63522MEDIUMReverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management functionEPSS 0.2%CVE-2025-1923MEDIUMInappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to instaEPSS 0.2%