Skip to content

CWE-1021: Clickjacking

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

Also known as Improper Restriction of Rendered UI Layers or Frames, UI Redress Attack, Tapjacking.

A kind of CWE-441 Unintended Proxy or Intermediary.

From the CWE List. © The MITRE Corporation.

Newest

ibm application performance management, cloud application performance management +1 moreIBM Cloud Application Performance Management 8.1.4 could allow a remote attacker to hijack the...CVE-2019-40866.1 MediumSeptember 17, 2019
logmein lastpassLogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the...CVE-2019-163718.2 HighSeptember 16, 2019
limesurveyA clickjacking vulnerability was found in Limesurvey before 3.17.14.CVE-2019-161754.3 MediumSeptember 9, 2019
google androidIn ChangeDefaultDialerDialog.java, there is a possible escalation of privilege due to an overlay...CVE-2019-21257.3 HighAugust 20, 2019
mcafee web gateway, mcafee, llc mcafee web gateway (mwg) +1 moreMWG UI: Cross-Frame Scripting vulnerabilityCVE-2019-36397.1 HighAugust 14, 2019
google chromeInsufficient data validation in Blink in Google Chrome prior to 76.0.3809.87 allowed a remote...CVE-2019-5861Fix available4.3 MediumAugust 12, 2019
ibm websphere application serverIBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack...CVE-2019-42855.4 MediumJuly 30, 2019
pivotal software cloud foundry uaa, cloud foundry uaa release (oss) +1 moreUAA - Login app subject to clickjacking attackCVE-2019-37946.5 MediumJuly 18, 2019
mailvelopeMailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As...CVE-2019-91474.3 MediumJuly 9, 2019
bcnquark quarking password managerBCN Quark Quarking Password Manager 3.1.84 suffers from a clickjacking vulnerability caused by...CVE-2019-128804.3 MediumJune 24, 2019
sap netweaver process integration, sap se netweaver process integration(sap xiesr and sap xitool) +1 moreJava Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and...CVE-2019-03054.3 MediumJune 12, 2019
huawei hg255s firmwareThere is a Clickjacking vulnerability in Huawei HG255s product. An attacker may trick user to...CVE-2019-52434.3 MediumJune 10, 2019
ibm security information queueIBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to...CVE-2019-42176.1 MediumJune 6, 2019
ca risk authentication, strong authentication +1 moreA UI redress vulnerability in the administrative user interface of CA Technologies CA Strong...CVE-2019-73934.3 MediumMay 28, 2019
hclsoftware bigfix platformIBM BigFix Platform 9.2 and 9.5 could allow a low-privilege user to manipulate the UI into...CVE-2019-40586.5 MediumMay 20, 2019
ibm spectrum protect, spectrum protect backup-archive client +1 moreIBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) could allow a remote attacker to...CVE-2018-18536.1 MediumApril 8, 2019
synology sso serverImproper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology...CVE-2017-167757.1 HighApril 1, 2019
mozilla firefoxWhen the RSS Feed preview about:feeds page is framed within another page, it can be used in...CVE-2018-184968.8 HighFebruary 28, 2019
google chrome, debian linux, fedoraproject fedora +3 more +5 moreInsufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0...CVE-2019-5767Fix available6.5 MediumFebruary 18, 2019
cybozu, inc. cybozu remote service, cybozu remote service manager +1 moreImproper countermeasure against clickjacking attack in client certificates management screen was...CVE-2018-161726.5 MediumJanuary 9, 2019
apache nifiImproper Restriction of Rendered UI Layers or Frames in Apache nififCVE-2018-17192Fix available6.5 MediumDecember 19, 2018
ibm security access manager appliance, security access manager +1 moreIBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 could allow...CVE-2018-18036.1 MediumDecember 13, 2018
google androidIn functionality implemented in System UI, there are insufficient protections implemented around...CVE-2018-95247.8 HighNovember 14, 2018
google androidIn computeFocusedWindow of RootWindowContainer.java, and related functions, there is possible...CVE-2018-94587.8 HighNovember 6, 2018
rainmachine web applicationA missing X-Frame-Options header in the Green Electronics RainMachine Mini-8 (2nd Generation) and...CVE-2018-69096.5 MediumNovember 1, 2018
cisco hyperflex hx-series, hyperflex hx data platform +1 moreCisco HyperFlex UI Clickjacking VulnerabilityCVE-2018-154234.7 MediumOctober 5, 2018
google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreEliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75...CVE-2018-6178Fix available4.3 MediumJuly 26, 2018
tp-link tl-wr841n firmwareTP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow...CVE-2018-125764.3 MediumJuly 2, 2018
cisco unified communications managerA vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) could allow an...CVE-2018-03556.1 MediumJune 7, 2018
ibm infosphere information serverIBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to cross-frame...CVE-2018-14326.1 MediumJune 5, 2018
prestashopIn PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might...CVE-2018-74917.5 HighFebruary 26, 2018
adobe connectAn issue was discovered in Adobe Connect 9.6.2 and earlier versions. A UI Redress (or...CVE-2017-112906.1 MediumDecember 9, 2017
intel active management technology firmware, intel corporation active mangement technology +1 moreInsufficient clickjacking protection in the Web User Interface of Intel AMT firmware versions...CVE-2017-56976.5 MediumJune 14, 2017
mcafee network data loss prevention (ndlp), network data loss prevention +1 moreClickjacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x...CVE-2017-40154.5 MediumMay 17, 2017
gfi kerio connect, kerio connect client +1 moreKerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and...CVE-2017-74406.5 MediumMay 2, 2017
google androidAn elevation of privilege vulnerability in the System UI could enable a local malicious...CVE-2017-04925.5 MediumMarch 8, 2017
google chromeBlink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for...CVE-2017-5016Fix available6.5 MediumJanuary 31, 2017
google chromeGoogle Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from...CVE-2017-5026Fix available4.3 MediumJanuary 27, 2017
google androidThe Framework UI permission-dialog implementation in Android 6.x before 2016-06-01 allows...CVE-2016-24969.8 CriticalJune 13, 2016
google chrome, canonical ubuntu linux, debian linux +8 more +10 moreGoogle Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation...CVE-2015-1241Fix available4.3 MediumApril 19, 2015
mozilla firefox, seamonkey, canonical ubuntu linux +5 more +7 moreMozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same...CVE-2014-14835.0 MediumFebruary 6, 2014
mozilla firefox, seamonkey, canonical ubuntu linux +5 more +7 moreThe file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does...CVE-2014-14804.3 MediumFebruary 6, 2014
mozilla firefox, seamonkey, canonical ubuntu linux +13 more +15 moreMozilla Firefox before 26.0 and SeaMonkey before 2.23 do not properly consider the sandbox...CVE-2013-56144.3 MediumDecember 11, 2013
microsoft internet explorerMicrosoft Internet Explorer 6, 7, and 8 does not enforce intended domain restrictions on content...CVE-2011-1244EPSS 15.1%5.8 MediumApril 13, 2011
opera browserUnspecified vulnerability in Opera before 9.5 allows remote attackers to spoof the contents of...CVE-2008-27165.0 MediumJune 16, 2008
opera browserA design error in Opera 8.01 and earlier allows user-assisted attackers to execute arbitrary code...CVE-2005-24075.1 MediumJuly 28, 2005