CWE-1021 · Improper Restriction of Rendered UI Layers or Frames (Clickjacking) (page 3)
Page 3 of 5 — CVEs classified under CWE-1021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2800 | Medium | 4.3 | 2022-08-12 | A vulnerability, which was classified as problematic, has been found in SourceCodester Gym Management System. Affected by this issue is some unknown functional… |
CVE-2022-20331 | High | 7.8 | 2022-08-12 | In the Framework, there is a possible way to enable a work profile without user consent due to a tapjacking/overlay attack. This could lead to local escalation… |
CVE-2022-20852 | Medium | 5.4 | 2022-08-10 | Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame h… |
CVE-2022-20820 | Medium | 5.4 | 2022-08-10 | Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame h… |
CVE-2022-2734 | Medium | 5.4 | 2022-08-09 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1. |
CVE-2022-33727 | Medium | 4.8 | 2022-08-05 | A vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth devi… |
CVE-2022-33723 | Medium | 4.8 | 2022-08-05 | A vulnerable code in onCreate of BluetoothScanDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device… |
CVE-2022-34162 | Medium | 6.1 | 2022-08-01 | IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote atta… |
CVE-2022-1138 | Medium | 6.5 | 2022-07-23 | Inappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who had compromised the renderer process to obscur… |
CVE-2022-2179 | Medium | 6.5 | 2022-07-20 | The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clic… |
CVE-2022-20226 | Low | 3.9 | 2022-07-13 | In finishDrawingWindow of WindowManagerService.java, there is a possible tapjacking due to improper input validation. This could lead to local escalation of pr… |
CVE-2022-20212 | High | 7.8 | 2022-07-13 | In wifi.RequestToggleWifiActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of pr… |
CVE-2022-28889 | Medium | 4.3 | 2022-07-07 | In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the C… |
CVE-2021-29865 | Medium | 5.4 | 2022-06-24 | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to… |
CVE-2021-39691 | High | 7.3 | 2022-06-15 | In WindowManager, there is a possible tapjacking attack due to an incorrect window flag when processing user input. This could lead to local escalation of priv… |
CVE-2022-27220 | Medium | 4.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in… |
CVE-2022-27219 | Medium | 4.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in… |
CVE-2017-20041 | Medium | 5.4 | 2022-06-13 | A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. Th… |
CVE-2022-1803 | Medium | 6.9 | 2022-05-20 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2. |
CVE-2021-27773 | Medium | 4.2 | 2022-05-12 | This vulnerability allows users to execute a clickjacking attack in the meeting's chat. |
CVE-2021-39796 | High | 7.3 | 2022-04-12 | In HarmfulAppWarningActivity of HarmfulAppWarningActivity.java, there is a possible way to trick victim to install harmful app due to a tapjacking/overlay atta… |
CVE-2022-28649 | Medium | 4.6 | 2022-04-05 | In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description |
CVE-2022-0455 | Medium | 6.5 | 2022-04-05 | Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed a remote attacker to spoof the contents of the Omnib… |
CVE-2021-44683 | High | 8.2 | 2022-03-25 | The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of the JavaScript window.open function (used to open a secondary browser wi… |
CVE-2021-39702 | High | 7.8 | 2022-03-16 | In onCreate of RequestManageCredentials.java, there is a possible way for a third party app to install certificates without user approval due to a tapjacking/o… |
CVE-2021-39692 | High | 7.8 | 2022-03-16 | In onCreate of SetupLayoutActivity.java, there is a possible way to setup a work profile bypassing user consent due to a tapjacking/overlay attack. This could… |
CVE-2022-24733 | Medium | 6.1 | 2022-03-14 | Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the web… |
CVE-2021-27414 | Medium | 5.5 | 2022-03-11 | An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 into visiting a mali… |
CVE-2021-46708 | Medium | 6.1 | 2022-03-11 | The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit… |
CVE-2021-41657 | Medium | 6.1 | 2022-03-10 | SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack. |
CVE-2021-3660 | Medium | 4.3 | 2022-03-10 | Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside… |
CVE-2021-39038 | Medium | 5.4 | 2022-02-24 | IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clickin… |
CVE-2022-0110 | Medium | 4.3 | 2022-02-12 | Incorrect security UI in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
CVE-2021-39669 | High | 7.8 | 2022-02-11 | In onCreate of InstallCaCertificateWarning.java, there is a possible way to mislead an user about CA installation circumstances due to a tapjacking/overlay att… |
CVE-2022-22807 | High | 7.4 | 2022-02-09 | A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user… |
CVE-2021-22819 | Medium | 4.3 | 2022-01-28 | A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user… |
CVE-2022-22552 | Medium | 6.9 | 2022-01-21 | Dell EMC AppSync versions 3.9 to 4.3 contain a clickjacking vulnerability in AppSync. A remote unauthenticated attacker could potentially exploit this vulnerab… |
CVE-2021-1036 | High | 7.8 | 2022-01-14 | In LocationSettingsActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privileg… |
CVE-2021-34087 | High | 7.1 | 2022-01-10 | In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver can be used… |
CVE-2021-1040 | High | 7.8 | 2021-12-15 | In onCreate of BluetoothPairingSelectionFragment.java, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privi… |
CVE-2021-1039 | High | 7.8 | 2021-12-15 | In NotificationAccessActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privil… |
CVE-2021-1038 | Medium | 5.5 | 2021-12-15 | In UserDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local denial of service with no a… |
CVE-2021-1016 | High | 7.3 | 2021-12-15 | In onCreate of UsbPermissionActivity.java, there is a possible way to grant an app access to USB without informed user consent due to a tapjacking/overlay atta… |
CVE-2021-1006 | Medium | 4.4 | 2021-12-15 | In several functions of DatabaseManager.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. This could lead to local i… |
CVE-2021-0992 | Low | 3.3 | 2021-12-15 | In onCreate of PaymentDefaultDialog.java, there is a possible way to change a default payment app without user consent due to tapjack overlay. This could lead… |
CVE-2021-0963 | High | 7.1 | 2021-12-15 | In onCreate of KeyChainActivity.java, there is a possible way to use an app certificate stored in keychain due to a tapjacking/overlay attack. This could lead… |
CVE-2021-0954 | High | 7.3 | 2021-12-15 | In ResolverActivity, there is a possible user interaction bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User… |
CVE-2021-39054 | Medium | 5.4 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit… |
CVE-2021-40834 | Medium | 4.3 | 2021-12-10 | A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a specially crafted seemingly legitimate URL SAF… |
CVE-2021-43546 | Medium | 4.3 | 2021-12-08 | It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird < 91.4.0, Firefo… |
CVE-2021-38509 | Medium | 4.3 | 2021-12-08 | Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top a… |
CVE-2021-38508 | Medium | 4.3 | 2021-12-08 | By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could hav… |
CVE-2021-38506 | Medium | 4.3 | 2021-12-08 | Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on… |
CVE-2021-43048 | Critical | 9.8 | 2021-11-16 | The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain a vulnerability that theoretically allows an unauthenti… |
CVE-2021-35237 | Medium | 5.0 | 2021-10-29 | A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an att… |
CVE-2021-38472 | Medium | 4.7 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an attacker may take ad… |
CVE-2021-27003 | Medium | 4.7 | 2021-10-12 | Clustered Data ONTAP versions prior to 9.5P18, 9.6P15, 9.7P14, 9.8P5 and 9.9.1 are missing an X-Frame-Options header which could allow a clickjacking attack. |
CVE-2021-0583 | High | 7.3 | 2021-10-11 | In onCreate of BluetoothPairingDialog, there is a possible way to enable Bluetooth without user consent due to a tapjacking/overlay attack. This could lead to… |
CVE-2021-37971 | Medium | 4.3 | 2021-10-08 | Incorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
CVE-2021-0598 | High | 7.3 | 2021-10-06 | In onCreate of ConfirmConnectActivity.java, there is a possible pairing of untrusted Bluetooth devices due to a tapjacking/overlay attack. This could lead to l… |
CVE-2021-3799 | Medium | 5.4 | 2021-09-27 | grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames |
CVE-2018-19957 | Medium | 6.1 | 2021-09-10 | A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability all… |
CVE-2021-3734 | High | 8.8 | 2021-08-26 | yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames |
CVE-2021-3731 | Medium | 5.9 | 2021-08-23 | LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targette… |
CVE-2021-32070 | Medium | 5.4 | 2021-08-13 | The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecure header response… |
CVE-2021-37788 | Medium | 5.4 | 2021-08-09 | A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjac… |
CVE-2021-33596 | Low | 3.5 | 2021-08-05 | Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit do… |
CVE-2021-20560 | Medium | 5.4 | 2021-07-26 | IBM Sterling Connect:Direct Browser User Interface 1.4.1.1 and 1.5.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading… |
CVE-2021-0603 | High | 7.8 | 2021-07-14 | In onCreate of ContactSelectionActivity.java, there is a possible way to get access to contacts without permission due to a tapjacking/overlay attack. This cou… |
CVE-2021-0586 | High | 7.8 | 2021-07-14 | In onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an unwanted bluetooth device due to a tapjacking/overlay attack… |
CVE-2021-35300 | Medium | 4.3 | 2021-06-28 | Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page. |
CVE-2021-0538 | High | 7.3 | 2021-06-22 | In onCreate of EmergencyCallbackModeExitDialog.java, there is a possible exit of emergency callback mode due to a tapjacking/overlay attack. This could lead to… |
CVE-2021-0537 | High | 7.3 | 2021-06-22 | In onCreate of WiFiInstaller.java, there is a possible way to install a malicious Hotspot 2.0 configuration due to a tapjacking/overlay attack. This could lead… |
CVE-2021-0569 | Medium | 5.0 | 2021-06-22 | In onStart of ContactsDumpActivity.java, there is possible access to contacts due to a tapjacking/overlay attack. This could lead to local information disclosu… |
CVE-2021-0523 | High | 7.3 | 2021-06-21 | In onCreate of WifiScanModeActivity.java, there is a possible way to enable Wi-Fi scanning without user consent due to a tapjacking/overlay attack. This could… |
CVE-2021-0506 | High | 7.3 | 2021-06-21 | In ActivityPicker.java, there is a possible bypass of user interaction in intent resolution due to a tapjacking/overlay attack. This could lead to local escala… |
CVE-2021-0487 | High | 7.8 | 2021-06-11 | In onCreate of CalendarDebugActivity.java, there is a possible way to export calendar data to the sdcard without user consent due to a tapjacking/overlay attac… |
CVE-2020-10743 | Medium | 4.3 | 2021-06-02 | It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate… |
CVE-2021-27467 | Medium | 6.1 | 2021-05-20 | A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected product’s web interface allows an attacker to rou… |
CVE-2021-22866 | High | 8.8 | 2021-05-14 | A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authoriz… |
CVE-2021-0446 | High | 7.3 | 2021-04-13 | In ImportVCardActivity, there is a possible way to bypass user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege wit… |
CVE-2021-0438 | High | 7.8 | 2021-04-13 | In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an incorrect FLAG_OBSCU… |
CVE-2021-0433 | High | 8.0 | 2021-04-13 | In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a tapjacking/overlay attack. T… |
CVE-2021-1403 | High | 7.4 | 2021-03-24 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site WebSocket hijacking (CSW… |
CVE-2021-23274 | Critical | 9.8 | 2021-03-23 | The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vuln… |
CVE-2021-0386 | High | 7.8 | 2021-03-10 | In onCreate of UsbConfirmActivity, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege wit… |
CVE-2021-0391 | High | 7.8 | 2021-03-10 | In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/over… |
CVE-2021-23955 | Medium | 6.1 | 2021-02-26 | The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks. This vulnerability… |
CVE-2021-23976 | High | 8.1 | 2021-02-26 | When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp mani… |
CVE-2021-27375 | Medium | 5.3 | 2021-02-18 | Traefik before 2.4.5 allows the loading of IFRAME elements from other domains. |
CVE-2021-0333 | High | 7.3 | 2021-02-10 | In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay that obscures the phonebook permissions dia… |
CVE-2021-0331 | High | 7.3 | 2021-02-10 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure default value. This could lead to local escal… |
CVE-2021-0314 | High | 7.3 | 2021-02-10 | In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay attack. This could le… |
CVE-2021-0305 | High | 7.8 | 2021-02-10 | In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions w… |
CVE-2021-0302 | High | 7.8 | 2021-02-10 | In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions w… |
CVE-2021-21444 | Medium | 6.1 | 2021-02-09 | SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictab… |
CVE-2021-21139 | Medium | 6.5 | 2021-02-09 | Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2021-21132 | Critical | 9.6 | 2021-02-09 | Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted… |
CVE-2020-4547 | Medium | 5.4 | 2021-01-27 | IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a… |
CVE-2021-0315 | High | 7.3 | 2021-01-11 | In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to convince the user to grant an app access to an account due to a tapjacking/o… |