Falhas do tipo CWE-1021

234 resultados

Implementação inadequada de mecanismo de segurança

A lógica de segurança foi implementada de forma incompleta ou incorreta, deixando brechas que um atacante pode explorar. É quando o desenvolvedor tenta fazer o certo (validar entrada, criptografar dados, autenticar usuário), mas comete erros na execução que anulam a proteção.

Exemplo

Um sistema implementa autenticação de dois fatores, mas aceita o código OTP mesmo depois de expirado; ou valida se um arquivo é imagem checando apenas a extensão, não o conteúdo real do arquivo.

Como mitigar

Revise a implementação de controles de segurança críticos (autenticação, validação, criptografia) com code review rigoroso e testes de segurança específicos. Use bibliotecas consolidadas em vez de reinventar mecanismos; nunca implemente criptografia ou lógica sensível do zero sem expertise comprovada.

CVE-2026-87655MEDIUMClickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elemenEPSS 0.2%CVE-2025-43854LOWDIFY vulnerable to Clickjacking AttackEPSS 0.2%CVE-2025-53096MEDIUMSunshine clickjacking in the UI leads to unauthorized actions being performedEPSS 0.2%CVE-2026-24839MEDIUMDokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headersEPSS 0.2%CVE-2024-10454MEDIUMClickjacking vulnerability in Clibo ManagerEPSS 0.2%CVE-2025-36027MEDIUMIBM Datacap clickjackingEPSS 0.2%CVE-2025-14809HIGHAddress bar spoofing risk in ArcSearch on AndroidEPSS 0.2%CVE-2025-6557MEDIUMInsufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker who convinced a user tEPSS 0.2%CVE-2022-20214MEDIUMIn Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can overlay the toggle buttonEPSS 0.2%CVE-2026-71177MEDIUMDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or FrEPSS 0.2%CVE-2026-59791LOWIn JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possibleEPSS 0.2%CVE-2025-0421MEDIUMiFrame Injection in Mikrogrup's ShopsideEPSS 0.2%CVE-2023-42011MEDIUMIBM Sterling B2B Integrator Standard Edition tapjackingEPSS 0.2%CVE-2026-10733MEDIUMImproper Restriction of Rendered UI Layers or Frames in GitLabEPSS 0.2%CVE-2023-0654LOWSpoofing User's Activity Loads in WARP Mobile Client (Android)EPSS 0.2%CVE-2026-87538MEDIUMClickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveragEPSS 0.2%CVE-2026-119715MEDIUMNocoDB before 2026.08.0 Clickjacking via Missing Frame-Control HeadersEPSS 0.2%CVE-2025-28129MEDIUMPhpgurukul Hostel Management System 2.1 is vulnerable to clickjacking.EPSS 0.2%CVE-2025-63522MEDIUMReverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management functionEPSS 0.2%CVE-2025-1923MEDIUMInappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to instaEPSS 0.2%