CWE-1021: Clickjacking
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
Also known as Improper Restriction of Rendered UI Layers or Frames, UI Redress Attack, Tapjacking.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote...4.3 Medium
- google chromeInsufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote...4.3 Medium
- google chromeInsufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote...4.3 Medium
- mozilla firefoxCross-origin iframes that contained a login form could have been recognized by the login autofill...6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIt was possible to cause the browser to enter fullscreen mode without displaying the security UI;...4.3 Medium
- ibm app connect enterprise certified containerIBM App Connect Enterprise Certified Container 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 could allow...5.4 Medium
- getgophish gophishThe Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack6.5 Medium
- raise it solutions rits browserRaise IT Solutions RITS Browser Address Bar Spooofing4.3 Medium
- siemens desigo insightA vulnerability has been identified in Desigo Insight (All versions). The device does not...5.4 Medium
- ibm infosphere information serverIBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking...6.1 Medium
- gogogate ismartgate pro firmwareismartgate PRO 1.5.9 is vulnerable to clickjacking.8.1 High
- google androidIn PackageInstaller, there is a possible permissions bypass due to a tapjacking vulnerability....7.8 High
- google androidIn manifest files of the SmartSpace package, there is a possible tapjacking vector due to a...7.8 High
- google androidIn onCreate of BluetoothPairingDialog.java, there is a possible tapjacking vector due to an...7.8 High
- google androidIn onCreate of RequestPermissionActivity.java, there is a possible tapjacking vector due to an...5.5 Medium
- mintegral mintegraladsdkMalicious Package7.1 High
- ibm security guardium insightsIBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action...5.4 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreIncorrect security UI in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker...6.5 Medium
- teradici pcoip management consoleThe web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set...6.1 Medium
- mozilla firefox, thunderbird +1 moreUsing object or embed tags, it was possible to frame other websites, even if they disallowed...6.5 Medium
- ibm planning analytics, planning analytics local +1 moreIBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the...6.1 Medium
- elastic kibana, redhat openshift container platform +1 moreIt was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in...4.3 Medium
- hcltech appscan"HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could...4.3 Medium
- ibm security secret serverIBM Security Secret Server 10.7 could allow a remote attacker to hijack the clicking action of...4.3 Medium
- ibm spectrum protect client, spectrum protect for space management, spectrum protect client (aix) +3 more +5 moreIBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 ...5.4 Medium
- ibm api connectIBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the...5.4 Medium
- zulip serverZulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality.6.1 Medium
- westerndigital ibi, my cloud home +1 moreWestern Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages.4.7 Medium
- mozilla firefox esrWhen following a link that opened an intent://-schemed URL, causing a custom tab to be opened,...4.7 Medium
- [unknown] keycloak, quarkus +1 moreImproper Restriction of Rendered UI Layers or Frames in Keycloak4.8 Medium
- abb esomseSOMS X-FrameOption6.5 Medium
- google androidIn onCreate of SettingsHomepageActivity, there is a possible tapjacking attack. This could lead...7.8 High
- micro focus international service managerThere is an improper restriction of rendered UI layers or frames vulnerability in Micro Focus...5.4 Medium
- puppet enterpriseParts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF ...8.8 High
- mozilla firefoxMozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding4.3 Medium
- google androidIt is possible for a malicious application to construct a TYPE_TOAST window manually and make...5.5 Medium
- siemens scalance s602, scalance s612, scalance s623 +13 more +15 moreA vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) ...5.4 Medium
- netapp snap creator frameworkNetApp Snap Creator Framework before 4.3P1 allows remote authenticated users to conduct...4.6 Medium
- cisco linksys e4200 firmwareCisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows...4.3 Medium
- brother mfc-9970cdw firmwareBrother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking)...6.5 Medium
- ibm security directory serverIBM Security Directory Server 6.4.0 could allow a remote attacker to hijack the clicking action...6.1 Medium
- jenkinsJenkins REST APIs vulnerable to clickjacking5.4 Medium
- splunkSplunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking4.3 Medium
- ibm financial transaction manager, financial transaction manager for multiplatform +1 moreIBM Financial Transaction Manager 3.0 could allow a remote attacker to hijack the clicking action...6.1 Medium
- intesync solismedIntesync Solismed 3.3sp allows Clickjacking.4.3 Medium
- ibm smartcloud analytics, smartcloud analytics log analysis +1 moreIBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to hijack the clicking...6.1 Medium
- apple ios, safari, iphone os +2 moreThis issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari...6.1 Medium
- vbulletinvBulletin before 5.5.4 allows clickjacking.4.3 Medium
- ibm websphere extreme scaleIBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the...6.1 Medium
- cisco hyperflex hx-series, hyperflex hx220c af m5 firmware, hyperflex hx220c edge m5 firmware +3 more +5 moreCisco HyperFlex Software Cross-Frame Scripting Vulnerability6.5 Medium
- Show moreLoading…