Falhas do tipo CWE-1021

196 resultados

Implementação inadequada de mecanismo de segurança

A lógica de segurança foi implementada de forma incompleta ou incorreta, deixando brechas que um atacante pode explorar. É quando o desenvolvedor tenta fazer o certo (validar entrada, criptografar dados, autenticar usuário), mas comete erros na execução que anulam a proteção.

Exemplo

Um sistema implementa autenticação de dois fatores, mas aceita o código OTP mesmo depois de expirado; ou valida se um arquivo é imagem checando apenas a extensão, não o conteúdo real do arquivo.

Como mitigar

Revise a implementação de controles de segurança críticos (autenticação, validação, criptografia) com code review rigoroso e testes de segurança específicos. Use bibliotecas consolidadas em vez de reinventar mecanismos; nunca implemente criptografia ou lógica sensível do zero sem expertise comprovada.

CVE-2018-19957—Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloudEPSS 0.7%CVE-2024-40817MEDIUMThe issue was addressed with improved UI handling. This issue is fixed in Safari 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS VentuEPSS 0.7%CVE-2021-27467—A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected product’s web interface allowsEPSS 0.7%CVE-2024-29981MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.7%CVE-2022-36319HIGHWhen combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vuEPSS 0.7%CVE-2023-2013LOWAn issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 beforEPSS 0.7%CVE-2022-22552MEDIUMDell EMC AppSync versions 3.9 to 4.3 contain a clickjacking vulnerability in AppSync. A remote unauthenticated attacker could potentially exEPSS 0.7%CVE-2017-20041MEDIUMUcweb UC Browser HTML URL improper restriction of rendered ui layersEPSS 0.7%CVE-2020-13174—The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which couEPSS 0.7%CVE-2021-38472MEDIUMInHand Networks IR615 RouterEPSS 0.7%CVE-2022-2734CRITICALImproper Restriction of Rendered UI Layers or Frames in openemr/openemrEPSS 0.7%CVE-2024-2177MEDIUMImproper Restriction of Rendered UI Layers or Frames in GitLabEPSS 0.7%CVE-2022-2965MEDIUMImproper Restriction of Rendered UI Layers or Frames in notrinos/notrinoserpEPSS 0.6%CVE-2022-29914MEDIUMWhen reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofEPSS 0.6%CVE-2022-34318MEDIUMIBM CICS TX clickjackingEPSS 0.6%CVE-2024-1550MEDIUMA malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-posEPSS 0.6%CVE-2022-45420MEDIUMUse tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resultingEPSS 0.6%CVE-2022-28286MEDIUMDue to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing atEPSS 0.6%CVE-2022-29911MEDIUMAn improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execuEPSS 0.6%CVE-2023-25730MEDIUMA background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode iEPSS 0.5%