CWE-1021: Clickjacking
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
Also known as Improper Restriction of Rendered UI Layers or Frames, UI Redress Attack, Tapjacking.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- ibm jazz team serverIBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to...5.4 Medium
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2)....4.3 Medium
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2)....4.3 Medium
- ucweb uc browserUcweb UC Browser HTML URL improper restriction of rendered ui layers5.4 Medium
- google androidIn WindowManager, there is a possible tapjacking attack due to an incorrect window flag when...7.3 High
- polonel polonel/trudesk, trudesk project trudesk +1 moreImproper Restriction of Rendered UI Layers or Frames in polonel/trudesk8.4 High
- hcl sametimeHCL Sametime is vulnerable to clickjacking4.2 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen reusing existing popups Firefox would have allowed them to cover the fullscreen notification...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user...6.1 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party...4.6 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreDue to a layout change, iframe contents could have been rendered outside of its border. This...5.4 Medium
- google chromeInappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a...6.5 Medium
- google androidIn HarmfulAppWarningActivity of HarmfulAppWarningActivity.java, there is a possible way to trick...7.3 High
- duckduckgoThe DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of the...8.2 High
- syliusImproper Restriction of Rendered UI Layers or Frames in Sylius6.1 Medium
- hitachi abb power grids ellipse enterprise asset management (eam), hitachienergy ellipse enterprise asset management +1 moreUser interface misrepresentation of critical information in Hitachi ABB Power Grids Ellipse EAM5.5 Medium
- smartbear collaboratorSmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI...6.1 Medium
- google androidIn onCreate of RequestManageCredentials.java, there is a possible way for a third party app to...7.8 High
- google androidIn onCreate of SetupLayoutActivity.java, there is a possible way to setup a work profile...7.8 High
- ibm websphere application server, websphere application server liberty +1 moreIBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3...4.4 Medium
- schneider-electric hmibscea53d1edb firmware, hmibscea53d1edl firmware, hmibscea53d1edm firmware +4 more +6 moreA CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could...7.4 High
- google chromeInappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758...6.5 Medium
- google androidIn onCreate of InstallCaCertificateWarning.java, there is a possible way to mislead an user about...7.8 High
- schneider-electric evlink city evc1s22p4 firmware, evlink city evc1s7p4 firmware, evlink parking evf2 firmware +3 more +5 moreA CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could...4.3 Medium
- dell appsync, emc appsync +1 moreDell EMC AppSync versions 3.9 to 4.3 contain a clickjacking vulnerability in AppSync. A remote...6.9 Medium
- google androidIn LocationSettingsActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking...7.8 High
- google chrome, fedoraproject fedora +1 moreIncorrect security UI in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote...4.3 Medium
- ultimaker 3 firmware, s3 firmware, s5 firmware +2 moreIn Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3...7.1 High
- google androidIn UserDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking...5.5 Medium
- google androidIn onCreate of BluetoothPairingSelectionFragment.java, there is a possible EoP due to a...7.8 High
- google androidIn NotificationAccessActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking...7.8 High
- ibm spectrum copy data managementIBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to hijack the...5.4 Medium
- f-secure safe, mobile security +1 moreUser interface Spoofing in F-Secure SAFE browser for Android4.3 Medium
- smartbear swagger-ui-distSpoofing attack in swagger-ui-dist6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIt was possible to recreate previous cursor spoofing attacks against users with a zoomed native...4.3 Medium
- google androidIn onCreate of UsbPermissionActivity.java, there is a possible way to grant an app access to USB...7.3 High
- google androidIn several functions of DatabaseManager.java, there is a possible leak of Bluetooth MAC addresses...4.4 Medium
- google androidIn onCreate of PaymentDefaultDialog.java, there is a possible way to change a default payment app...3.3 Low
- google androidIn onCreate of KeyChainActivity.java, there is a possible way to use an app certificate stored in...7.1 High
- google androidIn ResolverActivity, there is a possible user interaction bypass due to a tapjacking/overlay...7.3 High
- tibco partnerexpressTIBCO PartnerExpress Click-Jacking vulnerability9.8 Critical
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreDue to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with...4.3 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreBy displaying a form validity message in the correct location at the same time as a permission...4.3 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThrough a series of navigations, Firefox could have entered fullscreen mode without notification...4.3 Medium
- solarwinds kiwi syslog serverClickjacking Vulnerability5.0 Medium
- inhand networks ir615 router, inhandnetworks ir615 firmware +1 moreInHand Networks IR615 Router4.7 Medium
- netapp clustered data ontapClustered Data ONTAP versions prior to 9.5P18, 9.6P15, 9.7P14, 9.8P5 and 9.9.1 are missing an X...4.7 Medium
- google androidIn onCreate of BluetoothPairingDialog, there is a possible way to enable Bluetooth without user...7.3 High
- google chrome, debian linux, fedoraproject fedora +2 moreIncorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote...4.3 Medium
- cockpit-hq cockpit, redhat enterprise linux +1 moreCockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to...4.3 Medium
- Show moreLoading…