CWE-1022: tabnabbing
The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.
Also known as Use of Web Link to Untrusted Target with window.opener Access.
A kind of CWE-266 Incorrect Privilege Assignment.
From the CWE List. © The MITRE Corporation.
Newest
- ibm db2 recovery expert for linux, unix and windows IBM Db2 Recovery Expert for Linux, Unix and Windows Information Disclosure 6.1 Medium
- thm-health pilos PILOS: Reverse tabnabbing in room description 4.1 Medium
- jupyter jupyterlab JupyterLab LaTeX typesetter links did not enforce `noopener` attribute 2.1 Low
- sap se fiori (launchpad) Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad) 3.5 Low
-
hfsnpm HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit 2.9 Low - ibm sterling b2b integrator, sterling file gateway +1 more IBM Sterling B2B Integrator and IBM Sterling File Gateway link injection 5.4 Medium
- ibm engineering insights, engineering lifecycle optimization - engineering insights +1 more IBM Engineering Lifecycle Optimization - Engineering Insights tabnabbing 6.1 Medium
- glb meetup tag extension, meetup tag +1 more glb Meetup Tag Extension Link Attribute reverse tabnabbing 3.5 Low
- ualberta neosdiscovery ualbertalib NEOSDiscovery _refworks.html.erb reverse tabnabbing 5.5 Medium
- twitter-post-fetcher project twitter-post-fetcher Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbing 4.2 Medium
- ahorner text-helpers, texthelpers project texthelpers +1 more ahorner text-helpers translation.rb reverse tabnabbing 6.3 Medium
- auto-hyperlink urls project urls, unknown auto-hyperlink urls +1 more Auto-hyperlink URLs <= 5.4.1 - Tab Nabbing 5.4 Medium
- unknown external links in new window / new tab, webfactoryltd external links in new window \/ new tab +1 more External Links in New Window / New Tab < 1.43 - Tabnabbing 6.5 Medium
- sap businessobjects business intelligence, sap se businessobjects business intelligence platform (sapui5) +1 more Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions -... 4.7 Medium
- atlassian data center, jira, jira server +1 more +3 more Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect... 4.8 Medium
-
showdownnpm Reverse Tabnabbing in showdown 3.1 Low -
quillnpm Reverse Tabnabbing in quill 6.5 Medium -
swagger-uinpm Cross-Site Scripting in swagger-ui 6.5 Medium