Fallos del tipo CWE-1021
199 resultadosImplementação inadequada de requisito de segurança
É quando um desenvolvedor implementa um controle de segurança ou funcionalidade crítica de forma incompleta, incorreta ou desalinhada com a intenção original. O código executa, mas não protege contra a ameaça que deveria, deixando brechas exploráveis.
Ejemplo
Um sistema implementa validação de entrada verificando apenas letras, mas esquece de validar tamanho máximo de string. Um atacante envia um payload gigante que causa buffer overflow apesar da validação existir.
Cómo mitigar
Revise a especificação de segurança contra a implementação real (code review com foco em completude). Use testes de segurança específicos (fuzzing, testes de limite) antes de deploy, não confie que 'parece estar protegido'.
CVE-2019-7393—A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.EPSS 2.3%CVE-2022-28889—Clickjacking in the web consoleEPSS 1.8%CVE-2022-1803HIGHImproper Restriction of Rendered UI Layers or Frames in polonel/trudeskEPSS 1.6%CVE-2021-3799MEDIUMImproper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-adminEPSS 1.6%CVE-2023-1362HIGHImproper Restriction of Rendered UI Layers or Frames in unilogies/bumsysEPSS 1.4%CVE-2022-46695MEDIUMA spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2,EPSS 1.3%CVE-2021-3660—Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via anotEPSS 1.3%CVE-2022-42799MEDIUMThe issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 anEPSS 1.2%CVE-2022-2179MEDIUMICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or FramesEPSS 1.1%CVE-2021-3731MEDIUMImproper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmbEPSS 1.1%CVE-2020-28218—A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 (firmware 2.7 and older), that would aEPSS 1.1%CVE-2017-16775HIGHImproper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote atEPSS 1.1%CVE-2022-3167CRITICALImproper Restriction of Rendered UI Layers or Frames in ikus060/rdiffwebEPSS 1.0%CVE-2023-41897HIGHLack of XFO header allows clickjacking in Home Assistant CoreEPSS 0.9%CVE-2022-22807—A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the producEPSS 0.9%CVE-2021-35237MEDIUMClickjacking VulnerabilityEPSS 0.9%CVE-2024-26167MEDIUMMicrosoft Edge for Android Spoofing VulnerabilityEPSS 0.9%CVE-2022-24733MEDIUMImproper Restriction of Rendered UI Layers or Frames in SyliusEPSS 0.9%CVE-2022-2734CRITICALImproper Restriction of Rendered UI Layers or Frames in openemr/openemrEPSS 0.8%CVE-2020-15793—A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header whichEPSS 0.7%