Falhas do tipo CWE-1021

199 resultados

Implementação inadequada de mecanismo de segurança

A lógica de segurança foi implementada de forma incompleta ou incorreta, deixando brechas que um atacante pode explorar. É quando o desenvolvedor tenta fazer o certo (validar entrada, criptografar dados, autenticar usuário), mas comete erros na execução que anulam a proteção.

Exemplo

Um sistema implementa autenticação de dois fatores, mas aceita o código OTP mesmo depois de expirado; ou valida se um arquivo é imagem checando apenas a extensão, não o conteúdo real do arquivo.

Como mitigar

Revise a implementação de controles de segurança críticos (autenticação, validação, criptografia) com code review rigoroso e testes de segurança específicos. Use bibliotecas consolidadas em vez de reinventar mecanismos; nunca implemente criptografia ou lógica sensível do zero sem expertise comprovada.

CVE-2019-7393—A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.EPSS 2.3%CVE-2022-28889—Clickjacking in the web consoleEPSS 1.8%CVE-2022-1803HIGHImproper Restriction of Rendered UI Layers or Frames in polonel/trudeskEPSS 1.6%CVE-2021-3799MEDIUMImproper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-adminEPSS 1.6%CVE-2023-1362HIGHImproper Restriction of Rendered UI Layers or Frames in unilogies/bumsysEPSS 1.4%CVE-2022-46695MEDIUMA spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2,EPSS 1.3%CVE-2021-3660—Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via anotEPSS 1.3%CVE-2022-42799MEDIUMThe issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 anEPSS 1.2%CVE-2022-2179MEDIUMICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or FramesEPSS 1.1%CVE-2021-3731MEDIUMImproper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmbEPSS 1.1%CVE-2020-28218—A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 (firmware 2.7 and older), that would aEPSS 1.1%CVE-2017-16775HIGHImproper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote atEPSS 1.1%CVE-2022-3167CRITICALImproper Restriction of Rendered UI Layers or Frames in ikus060/rdiffwebEPSS 1.0%CVE-2023-41897HIGHLack of XFO header allows clickjacking in Home Assistant CoreEPSS 0.9%CVE-2022-22807—A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the producEPSS 0.9%CVE-2021-35237MEDIUMClickjacking VulnerabilityEPSS 0.9%CVE-2024-26167MEDIUMMicrosoft Edge for Android Spoofing VulnerabilityEPSS 0.9%CVE-2022-24733MEDIUMImproper Restriction of Rendered UI Layers or Frames in SyliusEPSS 0.9%CVE-2022-2734CRITICALImproper Restriction of Rendered UI Layers or Frames in openemr/openemrEPSS 0.8%CVE-2020-15793—A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header whichEPSS 0.7%