Falhas do tipo CWE-1021

234 resultados

Implementação inadequada de mecanismo de segurança

A lógica de segurança foi implementada de forma incompleta ou incorreta, deixando brechas que um atacante pode explorar. É quando o desenvolvedor tenta fazer o certo (validar entrada, criptografar dados, autenticar usuário), mas comete erros na execução que anulam a proteção.

Exemplo

Um sistema implementa autenticação de dois fatores, mas aceita o código OTP mesmo depois de expirado; ou valida se um arquivo é imagem checando apenas a extensão, não o conteúdo real do arquivo.

Como mitigar

Revise a implementação de controles de segurança críticos (autenticação, validação, criptografia) com code review rigoroso e testes de segurança específicos. Use bibliotecas consolidadas em vez de reinventar mecanismos; nunca implemente criptografia ou lógica sensível do zero sem expertise comprovada.

CVE-2022-2965MEDIUMImproper Restriction of Rendered UI Layers or Frames in notrinos/notrinoserpEPSS 0.7%CVE-2022-36319HIGHWhen combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vuEPSS 0.7%CVE-2020-15793—A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header whichEPSS 0.7%CVE-2017-20041MEDIUMUcweb UC Browser HTML URL improper restriction of rendered ui layersEPSS 0.7%CVE-2018-19957—Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloudEPSS 0.7%CVE-2022-36182MEDIUMHashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to maliEPSS 0.7%CVE-2021-27467—A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected product’s web interface allowsEPSS 0.7%CVE-2024-29981MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.7%CVE-2021-38472MEDIUMInHand Networks IR615 RouterEPSS 0.7%CVE-2022-34318MEDIUMIBM CICS TX clickjackingEPSS 0.7%CVE-2024-40817MEDIUMThe issue was addressed with improved UI handling. This issue is fixed in Safari 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS VentuEPSS 0.7%CVE-2023-2013LOWAn issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 beforEPSS 0.7%CVE-2026-58595HIGHMicrosoft Bing App for IOS Spoofing VulnerabilityEPSS 0.7%CVE-2022-22552MEDIUMDell EMC AppSync versions 3.9 to 4.3 contain a clickjacking vulnerability in AppSync. A remote unauthenticated attacker could potentially exEPSS 0.7%CVE-2020-13174—The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which couEPSS 0.7%CVE-2022-29914MEDIUMWhen reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofEPSS 0.7%CVE-2024-2177MEDIUMImproper Restriction of Rendered UI Layers or Frames in GitLabEPSS 0.7%CVE-2023-4958MEDIUMStackrox: missing http security headers allows for clickjacking in web uiEPSS 0.6%CVE-2026-20942MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.6%CVE-2022-29911MEDIUMAn improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execuEPSS 0.6%