CWE-1021 · Improper Restriction of Rendered UI Layers or Frames (Clickjacking) (page 4)
Page 4 of 5 — CVEs classified under CWE-1021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-27059 | High | 7.8 | 2021-01-11 | In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overlaid window. This c… |
CVE-2021-21111 | Critical | 9.6 | 2021-01-08 | Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a user to install a malicious extension to p… |
CVE-2020-5020 | Medium | 6.1 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a ma… |
CVE-2020-16033 | Medium | 4.3 | 2021-01-08 | Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-16032 | Medium | 4.3 | 2021-01-08 | Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
CVE-2020-16031 | Medium | 4.3 | 2021-01-08 | Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte… |
CVE-2020-35735 | Medium | 4.7 | 2020-12-29 | Vidyo 02-09-/D allows clickjacking via the portal/ URI. |
CVE-2020-28218 | Medium | 6.5 | 2020-12-11 | A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker to… |
CVE-2020-26962 | Medium | 6.1 | 2020-12-09 | Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in clickjac… |
CVE-2020-26953 | Medium | 4.3 | 2020-12-09 | It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or other… |
CVE-2020-9993 | Medium | 4.3 | 2020-12-08 | The issue was addressed with improved UI handling. This issue is fixed in watchOS 7.0, Safari 14.0, iOS 14.0 and iPadOS 14.0. Visiting a malicious website may… |
CVE-2020-9987 | Medium | 4.3 | 2020-12-08 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 14.0. Visiting a malicious website may lead to… |
CVE-2020-9945 | Medium | 4.3 | 2020-12-08 | A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, Safari… |
CVE-2020-9942 | Medium | 4.3 | 2020-12-08 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, Safari 13.1.2. Visiting a malic… |
CVE-2020-5679 | Medium | 6.1 | 2020-12-03 | Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially cra… |
CVE-2020-4785 | Medium | 5.4 | 2020-11-03 | IBM App Connect Enterprise Certified Container 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 could allow a remote attacker to hijack the clicking action of the victim… |
CVE-2020-24711 | Medium | 6.5 | 2020-10-28 | The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack |
CVE-2019-8771 | Medium | 6.1 | 2020-10-27 | This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate if… |
CVE-2020-7371 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true s… |
CVE-2020-15793 | Medium | 5.4 | 2020-10-15 | A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header which makes it vulnerabl… |
CVE-2020-4727 | Medium | 6.1 | 2020-09-25 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious W… |
CVE-2020-13119 | High | 8.1 | 2020-09-24 | ismartgate PRO 1.5.9 is vulnerable to clickjacking. |
CVE-2020-6547 | Medium | 6.5 | 2020-09-21 | Incorrect security UI in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML… |
CVE-2020-0366 | High | 7.8 | 2020-09-17 | In PackageInstaller, there is a possible permissions bypass due to a tapjacking vulnerability. This could lead to local escalation of privilege using an app se… |
CVE-2020-0387 | High | 7.8 | 2020-09-17 | In manifest files of the SmartSpace package, there is a possible tapjacking vector due to a missing permission check. This could lead to local escalation of pr… |
CVE-2020-0394 | High | 7.8 | 2020-09-17 | In onCreate of BluetoothPairingDialog.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of priv… |
CVE-2020-0386 | Medium | 5.5 | 2020-09-17 | In onCreate of RequestPermissionActivity.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of p… |
CVE-2020-7705 | High | 7.1 | 2020-08-24 | This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app a… |
CVE-2020-4165 | Medium | 5.4 | 2020-08-24 | IBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web… |
CVE-2020-13174 | Medium | 6.1 | 2020-08-11 | The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which could allow an attacke… |
CVE-2020-15648 | Medium | 6.5 | 2020-08-10 | Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affec… |
CVE-2020-4644 | Medium | 5.4 | 2020-07-29 | IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a… |
CVE-2019-4323 | Medium | 4.3 | 2020-07-07 | "HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of untrusted web pages i… |
CVE-2020-4322 | Medium | 4.3 | 2020-06-24 | IBM Security Secret Server 10.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site… |
CVE-2020-4406 | Medium | 5.4 | 2020-06-15 | IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 thr… |
CVE-2020-4195 | Medium | 5.4 | 2020-05-12 | IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a ma… |
CVE-2020-6827 | Medium | 4.7 | 2020-04-24 | When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorre… |
CVE-2020-9444 | Medium | 6.1 | 2020-04-20 | Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality. |
CVE-2020-10951 | Medium | 4.7 | 2020-04-15 | Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages. |
CVE-2020-1728 | Medium | 4.8 | 2020-04-06 | A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP securit… |
CVE-2019-19001 | Medium | 6.5 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an… |
CVE-2020-0051 | High | 7.8 | 2020-03-10 | In onCreate of SettingsHomepageActivity, there is a possible tapjacking attack. This could lead to local escalation of privilege in Settings with no additional… |
CVE-2020-9517 | Medium | 5.4 | 2020-03-09 | There is an improper restriction of rendered UI layers or frames vulnerability in Micro Focus Service Manager Release Control versions 9.50 and 9.60. The vulne… |
CVE-2015-5686 | High | 8.8 | 2020-02-27 | Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an atta… |
CVE-2013-5594 | Medium | 4.3 | 2020-02-18 | Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding |
CVE-2020-0014 | Medium | 5.5 | 2020-02-13 | It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable. This could lead to a local escalation of p… |
CVE-2019-13924 | Medium | 5.4 | 2020-02-11 | A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versions < V4.1), SCALANCE… |
CVE-2016-5710 | Medium | 4.6 | 2020-02-11 | NetApp Snap Creator Framework before 4.3P1 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors. |
CVE-2013-2682 | Medium | 4.3 | 2020-02-05 | Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive information. |
CVE-2013-2675 | Medium | 6.5 | 2020-02-05 | Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attackers to obtain sensiti… |
CVE-2019-4548 | Medium | 6.1 | 2020-02-04 | IBM Security Directory Server 6.4.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web… |
CVE-2020-2105 | Medium | 5.4 | 2020-01-29 | REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks. |
CVE-2013-6772 | Medium | 4.3 | 2020-01-23 | Splunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking |
CVE-2019-4742 | Medium | 6.1 | 2019-12-20 | IBM Financial Transaction Manager 3.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious We… |
CVE-2019-15930 | Medium | 4.3 | 2019-12-12 | Intesync Solismed 3.3sp allows Clickjacking. |
CVE-2019-5861 | Medium | 4.3 | 2019-11-25 | Insufficient data validation in Blink in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to bypass anti-clickjacking policy via a crafted HTML pa… |
CVE-2019-4215 | Medium | 6.1 | 2019-11-22 | IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malic… |
CVE-2019-17131 | Medium | 4.3 | 2019-10-04 | vBulletin before 5.5.4 allows clickjacking. |
CVE-2019-4109 | Medium | 6.1 | 2019-09-30 | IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a mali… |
CVE-2019-1975 | Medium | 6.1 | 2019-09-18 | A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS)… |
CVE-2019-4086 | Medium | 6.1 | 2019-09-17 | IBM Cloud Application Performance Management 8.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a… |
CVE-2019-16371 | High | 8.2 | 2019-09-16 | LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited we… |
CVE-2019-16175 | Medium | 4.3 | 2019-09-09 | A clickjacking vulnerability was found in Limesurvey before 3.17.14. |
CVE-2019-2125 | High | 7.3 | 2019-08-20 | In ChangeDefaultDialerDialog.java, there is a possible escalation of privilege due to an overlay attack. This could lead to local escalation of privilege, gran… |
CVE-2019-3639 | High | 7.1 | 2019-08-14 | Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attac… |
CVE-2019-4285 | Medium | 5.4 | 2019-07-30 | IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to vi… |
CVE-2019-3794 | Medium | 5.4 | 2019-07-18 | Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UA… |
CVE-2019-9147 | Medium | 4.3 | 2019-07-09 | Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applicat… |
CVE-2019-12880 | Medium | 4.3 | 2019-06-24 | BCN Quark Quarking Password Manager 3.1.84 suffers from a clickjacking vulnerability caused by allowing * within web_accessible_resources. An attacker can take… |
CVE-2019-0305 | Medium | 4.3 | 2019-06-12 | Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restri… |
CVE-2019-5243 | Medium | 4.3 | 2019-06-10 | There is a Clickjacking vulnerability in Huawei HG255s product. An attacker may trick user to click a link and affect the integrity of a device by exploiting t… |
CVE-2019-4217 | Medium | 6.1 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim… |
CVE-2019-7393 | Medium | 4.3 | 2019-05-28 | A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authe… |
CVE-2019-4058 | Medium | 6.5 | 2019-05-20 | IBM BigFix Platform 9.2 and 9.5 could allow a low-privilege user to manipulate the UI into exposing interface elements and information normally restricted to a… |
CVE-2018-1853 | Medium | 6.1 | 2019-04-08 | IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim… |
CVE-2017-16775 | High | 7.1 | 2019-04-01 | Improper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote attackers to conduct… |
CVE-2018-18496 | High | 8.8 | 2019-02-28 | When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confus… |
CVE-2019-5767 | Medium | 6.5 | 2019-02-19 | Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a m… |
CVE-2018-16172 | Medium | 6.5 | 2019-01-09 | Improper countermeasure against clickjacking attack in client certificates management screen was discovered in Cybozu Remote Service 3.0.0 to 3.1.8, that allow… |
CVE-2018-6178 | Medium | 4.3 | 2019-01-09 | Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious ex… |
CVE-2018-17192 | Medium | 6.5 | 2018-12-19 | The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpr… |
CVE-2018-1803 | Medium | 6.1 | 2018-12-13 | IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 could allow a remote attacker to hijack the clicking action of the victim… |
CVE-2018-9524 | High | 7.8 | 2018-11-14 | In functionality implemented in System UI, there are insufficient protections implemented around overlay windows. This could lead to local escalation of privil… |
CVE-2018-9458 | High | 7.8 | 2018-11-06 | In computeFocusedWindow of RootWindowContainer.java, and related functions, there is possible interception of keypresses due to focus being on the wrong window… |
CVE-2018-6909 | Medium | 6.5 | 2018-11-01 | A missing X-Frame-Options header in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application could be used by a remote attacke… |
CVE-2018-15423 | Medium | 4.7 | 2018-10-05 | A vulnerability in the web UI of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjackin… |
CVE-2018-12576 | Medium | 4.3 | 2018-07-02 | TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow clickjacking. |
CVE-2018-0355 | Medium | 6.1 | 2018-06-07 | A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated, remote attacker to conduct a cross-frame scr… |
CVE-2018-1432 | Medium | 6.1 | 2018-06-05 | IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to cross-frame scripting which is a vulnerability that allows an attacker to load Inf… |
CVE-2018-7491 | High | 7.5 | 2018-02-26 | In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an adm… |
CVE-2017-11290 | Medium | 6.1 | 2017-12-09 | An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A UI Redress (or Clickjacking) vulnerability exists. This issue has been resolved by addin… |
CVE-2017-5697 | Medium | 6.5 | 2017-06-14 | Insufficient clickjacking protection in the Web User Interface of Intel AMT firmware versions before 9.1.40.1000, 9.5.60.1952, 10.0.50.1004, 11.0.0.1205, and 1… |
CVE-2017-4015 | Medium | 4.5 | 2017-05-17 | Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to inject arbitrary web script o… |
CVE-2017-7440 | Medium | 6.5 | 2017-05-02 | Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows… |
CVE-2017-0492 | Medium | 5.5 | 2017-03-08 | An elevation of privilege vulnerability in the System UI could enable a local malicious application to create a UI overlay covering the entire screen. This iss… |
CVE-2017-5026 | Medium | 4.3 | 2017-02-17 | Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which allowed a remote att… |
CVE-2017-5016 | Medium | 6.5 | 2017-02-17 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements from being display… |
CVE-2016-2496 | Critical | 9.8 | 2016-06-13 | The Framework UI permission-dialog implementation in Android 6.x before 2016-06-01 allows attackers to conduct tapjacking attacks and access arbitrary private-… |
CVE-2015-1241 | | 2015-04-19 | Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which all… | |
CVE-2014-1483 | | 2014-02-06 | Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRA… |