CWE-1021: Clickjacking
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
Also known as Improper Restriction of Rendered UI Layers or Frames, UI Redress Attack, Tapjacking.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- getgrav getgrav/grav-plugin-admin, grav-plugin-admin +1 moreImproper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin5.4 Medium
- qnap qts, quts hero, qutscloud +2 moreInsufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloud6.1 Medium
- google androidIn onCreate of ConfirmConnectActivity.java, there is a possible pairing of untrusted Bluetooth...7.3 High
- yourls, yourls yourls/yourls +1 moreImproper Restriction of Rendered UI Layers or Frames in yourls/yourls6.5 Medium
- ledgersmb, ledgersmb ledgersmb/ledgersmb, debian linux +2 moreImproper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb5.9 Medium
- mitel micollabThe MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to...5.4 Medium
- gurock testrailA vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated,...5.4 Medium
- f-secure safe, mobile security +1 moreFake Apple login prompt in F-Secure SAFE browser for iOS3.5 Low
- ibm sterling connect:direct browser user interface, sterling connect direct user interface +1 moreIBM Sterling Connect:Direct Browser User Interface 1.4.1.1 and 1.5.0.2 could allow a remote...5.4 Medium
- google androidIn onCreate of ContactSelectionActivity.java, there is a possible way to get access to contacts...7.8 High
- google androidIn onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an...7.8 High
- zammadText injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote...4.3 Medium
- google androidIn onStart of ContactsDumpActivity.java, there is possible access to contacts due to a tapjacking...5.0 Medium
- google androidIn onCreate of EmergencyCallbackModeExitDialog.java, there is a possible exit of emergency...7.3 High
- google androidIn onCreate of WiFiInstaller.java, there is a possible way to install a malicious Hotspot 2.0...7.3 High
- google androidIn onCreate of WifiScanModeActivity.java, there is a possible way to enable Wi-Fi scanning...7.3 High
- google androidIn ActivityPicker.java, there is a possible bypass of user interaction in intent resolution due...7.3 High
- emerson x-stream enhanced xefd firmware, x-stream enhanced xegk firmware, x-stream enhanced xegp firmware +1 more +3 moreA vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer....6.1 Medium
- github enterprise serverUI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user resources8.8 High
- google androidIn onCreate of CalendarDebugActivity.java, there is a possible way to export calendar data to the...7.8 High
- google androidIn ImportVCardActivity, there is a possible way to bypass user consent due to a tapjacking...7.3 High
- google androidIn several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there...7.8 High
- google androidIn onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when...8.0 High
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software Web UI Cross-Site WebSocket Hijacking Vulnerability7.4 High
- tibco api exchange gateway, api exchange gateway distribution, tibco software inc. api exchange gateway distribution for tibco silver fabric +2 moreTIBCO API Exchange Gateway Clickjack Vulnerability9.8 Critical
- google androidIn onCreate of UsbConfirmActivity, there is a possible tapjacking vector due to an insecure...7.8 High
- google androidIn onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the...7.8 High
- mozilla firefoxWhen accepting a malicious intent from other installed apps, Firefox for Android accepted...8.1 High
- containous traefikTraefik before 2.4.5 allows the loading of IFRAME elements from other domains.5.3 Medium
- sap businessobjects business intelligence, sap se business objects business intelligence platform (cmc and bi launchpad) +1 moreSAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options...5.4 Medium
- google androidIn onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a...7.3 High
- google androidIn onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack...7.3 High
- google androidIn onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed...7.3 High
- google androidIn PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This...7.8 High
- google androidIn PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This...7.8 High
- ibm collaborative lifecycle management, engineering lifecycle optimization, engineering test management +14 more +16 moreIBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the...5.4 Medium
- google chrome, microsoft edge chromium +1 moreInappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a...6.5 Medium
- google chrome, microsoft edge chromium +1 moreInappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote...9.6 Critical
- mozilla firefoxThe browser could have been confused into transferring a pointer lock state into another tab,...6.1 Medium
- google androidIn onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when...7.8 High
- ibm spectrum protect plusIBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the...6.1 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInsufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an...9.6 Critical
- google androidIn onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to convince the...7.3 High
- vidyoVidyo 02-09-/D allows clickjacking via the portal/ URI.4.7 Medium
- schneider-electric easergy t300 firmwareA CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy...6.5 Medium
- apple ipados, safari, watchos +2 more +4 moreThe issue was addressed with improved UI handling. This issue is fixed in watchOS 7.0, Safari 14...4.3 Medium
- apple safariAn inconsistent user interface issue was addressed with improved state management. This issue is...4.3 Medium
- apple macos, safari, mac os x +2 moreA spoofing issue existed in the handling of URLs. This issue was addressed with improved input...4.3 Medium
- apple macos, safari, mac os x +2 moreAn inconsistent user interface issue was addressed with improved state management. This issue is...4.3 Medium
- ec-cubeEC-CUBE Improper Restriction of Rendered UI Layers or Frames6.1 Medium
- Show moreLoading…