CWE-1021: Clickjacking
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
Also known as Improper Restriction of Rendered UI Layers or Frames, UI Redress Attack, Tapjacking.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- knime business hubKNIME Hub Web Application is vulnerable to clickjacking4.3 Medium
- gitlabAn issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15...2.6 Low
- schneider electric netbotz 4 - 355/450/455/550/570, schneider-electric netbotz 355 firmware, netbotz 450 firmware +3 more +5 moreA CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that...6.5 Medium
- mozilla firefoxThe fullscreen notification could have been hidden on Firefox for Android by using download...4.3 Medium
- mozilla firefoxBy displaying a prompt with a long description, the fullscreen notification could have been...4.3 Medium
- bumsys project bumsys, unilogies unilogies/bumsys +1 moreImproper Restriction of Rendered UI Layers or Frames in unilogies/bumsys8.4 High
- mozilla firefox, firefox esr, thunderbird +2 moreA background script invoking <code>requestFullscreen</code> and then blocking the main thread...5.4 Medium
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreImproper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit4.0 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreThe issue was addressed with improved UI handling. This issue is fixed in iOS 16.2 and iPadOS 16...4.7 Medium
- mitsubishi electric got2000 series gt25 model, got2000 series gt27 model, mitsubishi electric corporation gt softgot2000 +2 more +4 moreImproper Restriction of Rendered UI Layers or Frames vulnerability in Mitsubishi Electric...6.1 Medium
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS, 8.2.0 through 9.3.0, contain an User Interface Security Issue. An...5.4 Medium
- connectwise automateConnectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and...6.1 Medium
- schneider electric conext™ combox, schneider-electric conext combox firmware +1 moreA CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could...6.5 Medium
- google androidIn onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a...5.5 Medium
- google androidIn Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking...4.7 Medium
- google androidIn ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a...5.5 Medium
- pyload, pyload pyload/pyload, pyload-ng project pyload-ng +2 moreImproper Restriction of Rendered UI Layers or Frames in pyload/pyload3.1 Low
- google androidIn onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to...7.8 High
- apple ipados, macos, tvos +2 more +4 moreA spoofing issue existed in the handling of URLs. This issue was addressed with improved input...6.5 Medium
- aerocms project aerocmsAeroCMS v0.0.1 is vulnerable to ClickJacking.6.1 Medium
- redhat openshiftThe response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking...4.8 Medium
- google androidIn onCreate of LogAccessDialogActivity.java, there is a possible way to bypass a permission check...6.5 Medium
- google androidIn onCreate of various files, there is a possible tapjacking/overlay attack. This could lead to...7.8 High
- google androidIn onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user...7.3 High
- google androidIn onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a...7.3 High
- mozilla firefox, firefox esr, thunderbird +2 moreUse tables inside of an iframe, an attacker could have caused iframe contents to be rendered...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have...6.1 Medium
- mozilla firefoxService Workers did not detect Private Browsing Mode correctly in all cases, which could have led...4.3 Medium
- ibm cics txIBM CICS TX clickjacking5.4 Medium
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS...6.1 Medium
- hashicorp boundaryHashicorp Boundary vulnerable to clickjacking6.1 Medium
- ibm robotic process automation, robotic process automation as a service +1 moreIBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action...6.1 Medium
- ikus-soft rdiffweb, ikus060 ikus060/rdiffweb +1 moreImproper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb10.0 Critical
- jitsi** DISPUTED ** Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which...6.1 Medium
- mozilla thunderbirdWhen receiving an HTML email that specified to load an <code>iframe</code> element from a remote...4.3 Medium
- notrinos notrinos/notrinoserp, notrinoserp +1 moreImproper Restriction of Rendered UI Layers or Frames in notrinos/notrinoserp6.4 Medium
- apple ios, safari, tvos +2 more +4 moreThe issue was addressed with improved UI handling. This issue is fixed in Safari 16, tvOS 16,...6.1 Medium
- code-projects gym management system, gym management system project management system +1 moreSourceCodester Gym Management System clickjacking4.3 Medium
- google androidIn the Framework, there is a possible way to enable a work profile without user consent due to a...7.8 High
- cisco webex meetingsCisco Webex Meetings Web Interface Vulnerabilities5.4 Medium
- cisco webex meetingsCisco Webex Meetings Web Interface Vulnerabilities5.4 Medium
- open-emr openemr, openemr openemr/openemr +1 moreImproper Restriction of Rendered UI Layers or Frames in openemr/openemr10.0 Critical
- google android, samsung mobile devices +1 moreA vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows...4.8 Medium
- google android, samsung mobile devices +1 moreA vulnerable code in onCreate of BluetoothScanDialog prior to SMR Aug-2022 Release 1, allows...4.8 Medium
- ibm cics tx, cics tx advanced, cics tx standard +2 moreIBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By...5.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen combining CSS properties for overflow and transform, the mouse cursor could interact with...7.5 High
- rockwell automation micrologix 1100, micrologix 1400, rockwellautomation micrologix 1100 firmware +1 more +3 moreICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or Frames6.5 Medium
- google androidIn wifi.RequestToggleWifiActivity of AndroidManifest.xml, there is a possible EoP due to a...7.8 High
- apache druidClickjacking in the web console4.3 Medium
- google androidIn finishDrawingWindow of WindowManagerService.java, there is a possible tapjacking due to...3.9 Low
- Show moreLoading…