CWE-1021: Clickjacking
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
Also known as Improper Restriction of Rendered UI Layers or Frames, UI Redress Attack, Tapjacking.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- the browser company of new york` arc searchAddress Bar Spoofing in Arc Search for Android (window.open race condition)7.4 High
- mozilla firefox, thunderbird +1 moreSpoofing issue in the DOM: Core & HTML component5.4 Medium
- mozilla firefox, thunderbird +1 moreClickjacking issue in the Widget: Gtk component5.4 Medium
- gitlabImproper Restriction of Rendered UI Layers or Frames in GitLab4.3 Medium
- juev nebula-meshnebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)7.1 High
- google androidIn addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a...7.8 High
- google androidIn multiple functions of WindowState.java, there is a possible way to trick a user into accepting...5.9 Medium
- google androidIn startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a...7.8 High
- hclsoftware bigfix remote control serverHCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy4.0 Medium
- besen bs20 ev charging stationBesen BS20 EV Charging Station Firmware Version Check ui layer6.3 Medium
- golang net, golang.org/x/net golang.org/x/net/html +1 moreInvoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html6.1 Medium
- golang net, golang.org/x/net golang.org/x/net/html +1 moreInvoking duplicate attributes can cause XSS in golang.org/x/net/html6.1 Medium
- golang net, golang.org/x/net golang.org/x/net/html +1 moreInvoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html6.1 Medium
- No product listedAn issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the...7.3 High
- hcl aionHCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured2.3 Low
- apple ipados, macos, safari +3 more +5 moreThe issue was addressed with improved UI handling. This issue is fixed in iOS 26.5 and iPadOS 26...4.3 Medium
- google chromeInappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote...3.1 Low
- gitlabImproper Restriction of Rendered UI Layers or Frames in GitLab3.5 Low
- the browsercompany of new york arcsearch, thebrowser arc search +1 moreAddress bar spoofing risk in ArcSearch on Android7.4 High
- hclsoftware nomad server on dominoHCL Nomad server on Domino is affected by a missing default frame-ancestors directive3.7 Low
openclawnpmOpenClaw has Canvas route hardening for mixed-trust deployments6.3 Medium- google androidIn writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a...8.6 High
- cgm clininetLack of protection mechanisms against Clickjacking attacks5.3 Medium
- shenzhen tenda technology co., ltd. tenda f3, tenda f3 firmware +1 moreTenda F3 Clickjacking in Web Management Interface5.1 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform affected by click-jacking through CSS injection in comments5.3 Medium
- apple ipados, ios and ipados, iphone os +2 moreAn inconsistent user interface issue was addressed with improved state management. This issue is...4.6 Medium
- dokployDokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headers4.7 Medium
- labredescefetrj wegiaWeGIA Clickjacking Vulnerability4.3 Medium
- the browser company of new york diaCVE-2025-15032: Increased Spoofing risk; custom new window missing about:blank7.4 High
- juniper paragon automation, juniper networks paragon automation (pathfinder, planner, insights) +1 moreParagon Automation: A clickjacking vulnerability in the web server configuration has been addressed5.1 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreAn attacker may exploit missing protection against clickjacking by tricking users into performing...4.3 Medium
- No product listedPLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to...4.3 Medium
@tutao/tutanota-utilsnpmTuta Mail has DOM attribute and CSS injection in its Contact Viewer feature2.1 Low- the browser company of new york arcsearchAddress bar spoofing risk in ArcSearch on Android7.4 High
- the browser company of new york arcsearchAddress bar spoofing risk in Arc Search on iOS7.5 High
- hcl software bigfix remote control, hcltechsw hcl devops deploy, hcl launch +2 moreHCL BigFix Remote Control is vulnerable to an insecure CSP configuration4.7 Medium
- inaba denki sangyo co., ltd. choco tei watcher mini (ib-mct001), inaba ib-mct001 firmware +1 moreCHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper restriction of rendered UI...5.1 Medium
- google chromeInappropriate implementation in Toolbar in Google Chrome on Android prior to 143.0.7499.110...4.3 Medium
- feehi feehicmsFeehiCMS is vulnerable to reverse tabnabbing4.6 Medium
- google androidIn DefaultTransitionHandler.java, there is a possible way to unknowingly grant permissions to an...7.3 High
- google androidIn multiple locations, there is a possible way to trick a user into accepting a permission due to...7.8 High
- ibm concert, concert software +1 moreIBM Concert Software clickjacking6.3 Medium
- the browser company of new york diaDia: Increased Spoof Risk; Missing full screen toast7.4 High
- shopside software technologies inc. shopsideiFrame Injection in Mikrogrup's Shopside4.7 Medium
- circutor tcprs1plusCLICKJACKING5.1 Medium
- open-xchange gmbh ox app suiteMalicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to...5.4 Medium
- phpgurukul hostel management systemPhpgurukul Hostel Management System 2.1 is vulnerable to clickjacking.5.4 Medium
- hcl software myxalytics, hcltech dryice myxalytics +1 moreHCL MyXalytics is affected by the use of vulnerable/outdated versions3.5 Low
- freshrssFreshRSS: Double clickjacking can lead to privilege escalation6.7 Medium
- freshrssFressRSS: Clickjacking can lead to XSS and/or privilege escalation5.3 Medium
- Show moreLoading…