Falhas do tipo CWE-1021

234 resultados

Implementação inadequada de mecanismo de segurança

A lógica de segurança foi implementada de forma incompleta ou incorreta, deixando brechas que um atacante pode explorar. É quando o desenvolvedor tenta fazer o certo (validar entrada, criptografar dados, autenticar usuário), mas comete erros na execução que anulam a proteção.

Exemplo

Um sistema implementa autenticação de dois fatores, mas aceita o código OTP mesmo depois de expirado; ou valida se um arquivo é imagem checando apenas a extensão, não o conteúdo real do arquivo.

Como mitigar

Revise a implementação de controles de segurança críticos (autenticação, validação, criptografia) com code review rigoroso e testes de segurança específicos. Use bibliotecas consolidadas em vez de reinventar mecanismos; nunca implemente criptografia ou lógica sensível do zero sem expertise comprovada.

CVE-2022-28649MEDIUMIn JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue descriptionEPSS 0.4%CVE-2023-2265MEDIUMImproper restriction of rendered UI layers or frames could lead to clickjacking attackEPSS 0.4%CVE-2025-64387MEDIUMCLICKJACKINGEPSS 0.4%CVE-2025-49139MEDIUM@haxtheweb/haxcms-nodejs Iframe Phishing vulnerabilityEPSS 0.4%CVE-2026-114125HIGHStorybook: Missing origin validation in Storybook preview allows code injection from malicious websitesEPSS 0.4%CVE-2024-10004CRITICALOpening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in tEPSS 0.4%CVE-2026-74978HIGHClickjacking issue in the Widget componentEPSS 0.4%CVE-2026-70486HIGHOpen WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-originEPSS 0.4%CVE-2026-84388CRITICALA improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions may allow attackEPSS 0.4%CVE-2023-0780MEDIUMImproper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpitEPSS 0.4%CVE-2024-9397MEDIUMA missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjackingEPSS 0.4%CVE-2023-4229MEDIUMioLogik 4000 Series: Session Headers Not ImplementedEPSS 0.4%CVE-2026-60008LOWGitea Jupyter notebook UI redress through CSS class injectionEPSS 0.4%CVE-2024-57369MEDIUMClickjacking vulnerability in typecho v1.2.1.EPSS 0.4%CVE-2024-30109LOWLack of Clickjacking Protection vulnerability affects DRYiCE AEX v10EPSS 0.4%CVE-2025-1019MEDIUMFullscreen notification not properly displayedEPSS 0.4%CVE-2024-8388MEDIUMMultiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing the transition to fullEPSS 0.4%CVE-2025-24310MEDIUMImproper restriction of rendered UI layers or frames issue exists in HMI ViewJet C-more series, which may allow a remote unauthenticated attEPSS 0.4%CVE-2024-2383MEDIUMClickjacking Vulnerability in zenml-io/zenmlEPSS 0.4%CVE-2025-54139MEDIUMHAX CMS' application pages are vulnerable to clickjackingEPSS 0.4%