CWE-1021: Clickjacking
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
Also known as Improper Restriction of Rendered UI Layers or Frames, UI Redress Attack, Tapjacking.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- clibo manager managerClickjacking vulnerability in Clibo Manager6.1 Medium
- mozilla firefox, firefox for ios +1 moreOpening an external link to an HTTP website when Firefox iOS was previously closed and had an...9.1 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA missing delay in directory upload UI could have made it possible for an attacker to trick a...6.1 Medium
- mozilla firefoxMultiple prompts and panels from both Firefox and the Android OS could be used to obscure the...5.3 Medium
- mozilla firefox, firefox mobile +1 moreA select option could partially obscure security prompts. This could be used by a malicious site...8.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreSelect options could obscure the fullscreen notification dialog. This could be used by a...6.5 Medium
- google androidIn setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due...7.8 High
- discourseDiscourse allows iframe injection though default site setting6.1 Medium
- apple macos, safari +1 moreThe issue was addressed with improved UI handling. This issue is fixed in macOS Sonoma 14.6,...6.1 Medium
- gitlabImproper Restriction of Rendered UI Layers or Frames in GitLab6.8 Medium
- hcl software dryice aexLack of Clickjacking Protection vulnerability affects DRYiCE AEX v103.7 Low
- ibm sterling b2b integrator standard edition, sterling b2b integrator +1 moreIBM Sterling B2B Integrator Standard Edition tapjacking4.3 Medium
- lb-link bl-w1210m, bl-w1210m firmware +1 moreLB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the...8.1 High
- mozilla firefoxBy manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid...6.1 Medium
- zenml, zenml-io zenml-io/zenml +1 moreClickjacking Vulnerability in zenml-io/zenml4.3 Medium
- google androidIn hide of WindowState.java, there is a possible way to bypass tapjacking/overlay protection by...7.3 High
- google androidIn onCreate of multiple files, there is a possible way to trick the user into granting health...7.8 High
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a...6.5 Medium
- automattic jetpackWordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerability5.4 Medium
- welotec smart ems, vpn security suite +1 moreWelotec: Clickjacking Vulnerability in WebUI6.5 Medium
- microsoft edge (chromium-based), edge chromium, edge (chromium-based) extended stable +2 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability4.3 Medium
- mozilla firefoxData was not properly sanitized when decoding a QUIC ACK frame; this could have led to...7.5 High
- yooooomi your spotifyClickjacking in your_spotify6.5 Medium
- microsoft edge, edge for android +1 moreMicrosoft Edge for Android Spoofing Vulnerability4.3 Medium
- sma sunny webbox, sunny webbox firmware +1 moreClickjacking vulnerability in Sunny Webbox6.4 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA malicious website could have used a combination of exiting fullscreen mode and ...6.1 Medium
- hcl software sametime, hcltech sametime chat and meetings +1 moreHCL Sametime is impacted by clickjacking4.8 Medium
- samsung android, samsung mobile devices +1 moreImplicit intent hijacking vulnerability in Smart Suggestions prior to SMR Feb-2024 Release 1...3.3 Low
- plone, plone cms cms +1 moreCross-Frame Scripting (XFS) on Plone CMS6.3 Medium
- moxa oncell g3150a-lte series, oncell g3150a-lte firmware +1 moreOnCell G3150A-LTE Series: Clickjacking Vulnerability5.3 Medium
- mozilla firefox, firefox esr, debian linux +2 moreThe timing of a button click causing a popup to disappear was approximately the same length as...6.1 Medium
- redhat advanced cluster security, red hat advanced cluster security 3, advanced cluster security 4.2 +2 moreStackrox: missing http security headers allows for clickjacking in web ui6.1 Medium
- schweitzer engineering laboratories sel-411l, selinc sel-411l firmware +1 moreImproper restriction of rendered UI layers or frames could lead to clickjacking attack4.3 Medium
- mozilla firefoxIf an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThe black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking...5.4 Medium
- spaceapplications yacmsAn issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via...6.1 Medium
- redhat quay, red hat quay 3 +1 moreQuay: clickjacking on config-editor page severity6.5 Medium
- google chromeInappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a...4.7 Medium
- sap se enable now, sap enable now enable now consump del, enable now wpb manager +2 more +4 moreClickjacking vulnerability in SAP Enable Now6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIt was possible for certain browser prompts and dialogs to be activated or dismissed...4.3 Medium
- home-assistant core, home-assistant +1 moreLack of XFO header allows clickjacking in Home Assistant Core8.8 High
- sick apu0200 firmware, sick ag apu0200 +1 moreImproper Restriction of Rendered UI Layers or Frames in RDT400 in SICK APU allows an unprivileged...4.3 Medium
- economizzerEconomizzer vulnerable to Clickjacking6.5 Medium
- palantir com.palantir.acme:gotham-fe-bundle, com.palantir.acme:titanium-browser-app-bundle, gotham-fe-bundle +1 more +3 morePalantir Gotham UI bug that could lead to incorrect data classification6.5 Medium
- cloudflare warp, warp client +1 moreSpoofing User's Activity Loads in WARP Mobile Client (Android)3.9 Low
- moxa iologik 4000 series, iologik e4200 firmware +1 moreioLogik 4000 Series: Session Headers Not Implemented4.3 Medium
- mozilla firefox, firefox for ios +1 moreThe permission request prompt from the site in the background tab was overlaid on top of the site...5.4 Medium
- telegramTelegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via...5.3 Medium
- google androidIn hasInputInfo of Layer.cpp, there is a possible bypass of user interaction requirements due to...7.8 High
- hcl software bigfix osd bare metal serverHCL BigFix OSD Bare Metal Server version 311.12 or lower is affected by a clickjacking vulnerability.2.4 Low
- Show moreLoading…