CWE-1021 · Improper Restriction of Rendered UI Layers or Frames (Clickjacking) (page 2)
Page 2 of 5 — CVEs classified under CWE-1021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-29827 | Medium | 5.2 | 2024-12-19 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious W… |
CVE-2024-55888 | High | 7.1 | 2024-12-12 | Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been… |
CVE-2024-54112 | Medium | 5.5 | 2024-12-12 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-54110 | Medium | 6.2 | 2024-12-12 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-53976 | Medium | 5.4 | 2024-11-26 | Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what the URL was for the… |
CVE-2024-11700 | High | 8.1 | 2024-11-26 | Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of… |
CVE-2024-11695 | Medium | 5.4 | 2024-11-26 | A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This… |
CVE-2024-7404 | Medium | 6.8 | 2024-11-14 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 pr… |
CVE-2024-43084 | Medium | 5.5 | 2024-11-13 | In visitUris of multiple files, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with no ad… |
CVE-2024-10454 | Medium | 6.1 | 2024-10-31 | Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel. This vulnerability occurs due to the absence of an X-Fra… |
CVE-2024-10004 | Critical | 9.1 | 2024-10-15 | Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padlock icon sho… |
CVE-2024-9397 | Medium | 6.1 | 2024-10-01 | A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerabilit… |
CVE-2024-8388 | Medium | 5.3 | 2024-09-03 | Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing the transition to fullscreen mode after t… |
CVE-2024-34743 | High | 7.8 | 2024-08-15 | In setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due to a logic error in the code. This could lead to local escalati… |
CVE-2024-7523 | High | 8.1 | 2024-08-06 | A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. *This issue only a… |
CVE-2024-7518 | Medium | 6.5 | 2024-08-06 | Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. This vulnerability affect… |
CVE-2024-39320 | Medium | 6.1 | 2024-07-30 | Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypass… |
CVE-2024-40817 | Medium | 6.1 | 2024-07-29 | The issue was addressed with improved UI handling. This issue is fixed in Safari 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. Visiting… |
CVE-2023-7013 | Medium | 4.7 | 2024-07-16 | Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially spoof security UI via a crafted H… |
CVE-2024-31324 | High | 7.3 | 2024-07-09 | In hide of WindowState.java, there is a possible way to bypass tapjacking/overlay protection by launching the activity in portrait mode first and then rotating… |
CVE-2024-31323 | High | 7.8 | 2024-07-09 | In onCreate of multiple files, there is a possible way to trick the user into granting health permissions due to tapjacking. This could lead to local escalatio… |
CVE-2024-2177 | Medium | 6.8 | 2024-07-09 | A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1… |
CVE-2024-30109 | Low | 3.7 | 2024-06-28 | HCL DRYiCE AEX is impacted by a lack of clickjacking protection in the AEX web application. An attacker can use multiple transparent or opaque layers to trick… |
CVE-2023-42011 | Medium | 4.3 | 2024-06-27 | IBM Sterling B2B Integrator Standard Edition 6.1 and 6.2 does not restrict or incorrectly restricts frame objects or UI layers that belong to another applicati… |
CVE-2024-33377 | High | 8.1 | 2024-06-14 | LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attackers can cause victim users to perform arb… |
CVE-2024-5698 | Medium | 6.1 | 2024-06-11 | By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user… |
CVE-2024-2383 | Medium | 6.1 | 2024-06-06 | A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options o… |
CVE-2024-4950 | Medium | 6.5 | 2024-05-15 | Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2023-47774 | Medium | 5.4 | 2024-04-24 | Improper Restriction of Rendered UI Layers or Frames vulnerability in Automattic Jetpack allows Clickjacking.This issue affects Jetpack: from n/a before 12.7. |
CVE-2024-3911 | Medium | 6.5 | 2024-04-23 | An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames. |
CVE-2024-29981 | Medium | 4.3 | 2024-04-04 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-2613 | High | 7.5 | 2024-03-19 | Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. This vulnerability affects… |
CVE-2024-28196 | Medium | 6.5 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version < 1.9.0 does not prevent other pages from displaying it in an ifram… |
CVE-2024-26167 | Medium | 4.3 | 2024-03-07 | Microsoft Edge for Android Spoofing Vulnerability |
CVE-2024-1890 | Medium | 6.4 | 2024-02-26 | Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack… |
CVE-2024-1550 | Medium | 6.1 | 2024-02-20 | A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedl… |
CVE-2023-45698 | Medium | 4.8 | 2024-02-10 | Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect user… |
CVE-2024-20810 | Low | 3.3 | 2024-02-06 | Implicit intent hijacking vulnerability in Smart Suggestions prior to SMR Feb-2024 Release 1 allows local attackers to get sensitive information. |
CVE-2024-0669 | Medium | 6.3 | 2024-01-18 | A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an ad… |
CVE-2022-32919 | Medium | 4.7 | 2024-01-10 | The issue was addressed with improved UI handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Visiting a website that frames maliciou… |
CVE-2023-6093 | Medium | 5.3 | 2023-12-31 | A clickjacking vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. This vulnerability is caused by incorrectly res… |
CVE-2023-6867 | Medium | 6.1 | 2023-12-19 | The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possib… |
CVE-2023-4958 | Medium | 6.1 | 2023-12-12 | In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a cl… |
CVE-2023-2265 | Medium | 4.3 | 2023-11-30 | An Improper Restriction of Rendered UI Layers or Frames in the Schweitzer Engineering Laboratories SEL-411L could allow an unauthenticated attacker to perform… |
CVE-2023-6211 | Medium | 6.5 | 2023-11-21 | If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked the user into click… |
CVE-2023-6206 | Medium | 5.4 | 2023-11-21 | The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact t… |
CVE-2023-47311 | Medium | 6.1 | 2023-11-20 | An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking. |
CVE-2023-4956 | Medium | 6.5 | 2023-11-07 | A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on anot… |
CVE-2023-36920 | Medium | 6.1 | 2023-10-30 | In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not i… |
CVE-2023-5721 | Medium | 4.3 | 2023-10-25 | It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. This… |
CVE-2023-41897 | High | 8.8 | 2023-10-19 | Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which spe… |
CVE-2023-5103 | Medium | 4.3 | 2023-10-09 | Improper Restriction of Rendered UI Layers or Frames in RDT400 in SICK APU allows an unprivileged remote attacker to potentially reveal sensitive information v… |
CVE-2023-38873 | Medium | 6.5 | 2023-09-28 | The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when… |
CVE-2023-30961 | Medium | 6.5 | 2023-09-27 | Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly c… |
CVE-2023-0654 | Low | 3.9 | 2023-08-29 | Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious… |
CVE-2023-4229 | Medium | 4.3 | 2023-08-24 | A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, potentially exposing users to security risks. This… |
CVE-2023-37455 | Medium | 5.4 | 2023-07-12 | The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. This vulnerability affects Firefox for… |
CVE-2023-34658 | Medium | 5.3 | 2023-06-29 | Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController. |
CVE-2022-20443 | High | 7.8 | 2023-06-28 | In hasInputInfo of Layer.cpp, there is a possible bypass of user interaction requirements due to a tapjacking/overlay attack. This could lead to local escalati… |
CVE-2023-23343 | Low | 2.4 | 2023-06-22 | A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a use… |
CVE-2023-2013 | Low | 2.6 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all vers… |
CVE-2023-3140 | Medium | 4.3 | 2023-06-07 | Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Clickjacking i… |
CVE-2023-28159 | Medium | 4.3 | 2023-06-02 | The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks… |
CVE-2023-25748 | Medium | 4.3 | 2023-06-02 | By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potential user confusion or spoofing attacks… |
CVE-2023-25730 | Medium | 5.4 | 2023-06-02 | A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, result… |
CVE-2022-43378 | Medium | 6.5 | 2023-04-18 | A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be tricked into performing unintended… |
CVE-2023-1362 | Medium | 6.1 | 2023-03-13 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2. |
CVE-2022-32891 | Medium | 6.1 | 2023-02-27 | The issue was addressed with improved UI handling. This issue is fixed in Safari 16, tvOS 16, watchOS 9, iOS 16. Visiting a website that frames malicious conte… |
CVE-2023-0780 | Medium | 5.4 | 2023-02-11 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev. |
CVE-2022-40268 | Medium | 6.1 | 2023-02-02 | Improper Restriction of Rendered UI Layers or Frames vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000… |
CVE-2023-23126 | Medium | 6.1 | 2023-02-01 | Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: t… |
CVE-2022-45096 | Medium | 5.4 | 2023-02-01 | Dell PowerScale OneFS, 8.2.0 through 9.3.0, contain an User Interface Security Issue. An unauthenticated remote user could unintentionally lead an administrat… |
CVE-2022-32517 | Medium | 6.5 | 2023-01-30 | A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to trick the interface user/admin into inte… |
CVE-2023-20913 | High | 7.8 | 2023-01-26 | In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious phone account due to… |
CVE-2022-20215 | Medium | 5.5 | 2023-01-26 | In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. This could lead to local denial of servic… |
CVE-2022-20214 | Medium | 4.7 | 2023-01-26 | In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can overlay the toggle button to enable apps to… |
CVE-2022-20213 | Medium | 5.5 | 2023-01-26 | In ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local denial of service w… |
CVE-2023-0057 | Medium | 6.1 | 2023-01-05 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33. |
CVE-2022-45420 | Medium | 6.5 | 2022-12-22 | Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user… |
CVE-2022-45418 | Medium | 6.1 | 2022-12-22 | If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user con… |
CVE-2022-45417 | Medium | 4.3 | 2022-12-22 | Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited… |
CVE-2022-3034 | Medium | 4.3 | 2022-12-22 | When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to the remote document was sent. However… |
CVE-2022-36319 | High | 7.5 | 2022-12-22 | When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vulnerability affects… |
CVE-2022-29914 | Medium | 6.5 | 2022-12-22 | When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. This v… |
CVE-2022-29911 | Medium | 6.1 | 2022-12-22 | An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>… |
CVE-2022-28286 | Medium | 5.4 | 2022-12-22 | Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnera… |
CVE-2022-20553 | Medium | 6.5 | 2022-12-16 | In onCreate of LogAccessDialogActivity.java, there is a possible way to bypass a permission check due to a tapjacking/overlay attack. This could lead to local… |
CVE-2022-20520 | High | 7.8 | 2022-12-16 | In onCreate of various files, there is a possible tapjacking/overlay attack. This could lead to local escalation of privilege or denial of server with User exe… |
CVE-2022-46695 | Medium | 6.5 | 2022-12-15 | A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, macOS Ventura 13.1… |
CVE-2022-20501 | High | 7.3 | 2022-12-13 | In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account due to a tapjacking/ov… |
CVE-2022-20442 | High | 7.3 | 2022-12-13 | In onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a separate app with API level < 23 due to a tapjacking/overlay… |
CVE-2022-46061 | Medium | 6.1 | 2022-12-13 | AeroCMS v0.0.1 is vulnerable to ClickJacking. |
CVE-2022-34318 | Medium | 5.4 | 2022-12-12 | IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote att… |
CVE-2022-3260 | Medium | 4.8 | 2022-12-08 | The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these results incorrectly… |
CVE-2022-42799 | Medium | 6.1 | 2022-11-01 | The issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Visiti… |
CVE-2022-36182 | Medium | 6.1 | 2022-10-27 | Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or cau… |
CVE-2022-22503 | Medium | 6.1 | 2022-10-06 | IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious We… |
CVE-2022-3167 | High | 8.8 | 2022-09-08 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1. |
CVE-2022-36736 | Medium | 6.1 | 2022-09-08 | Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request. NOT… |
CVE-2022-2965 | Medium | 4.3 | 2022-08-23 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository notrinos/notrinoserp prior to 0.7. |