CWE-1021 · Improper Restriction of Rendered UI Layers or Frames (Clickjacking) (page 5)
Page 5 of 5 — CVEs classified under CWE-1021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-6909 | Medium | 6.5 | 2018-11-01 | A missing X-Frame-Options header in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application could be used by a remote attacke… |
CVE-2018-15423 | Medium | 4.7 | 2018-10-05 | A vulnerability in the web UI of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjackin… |
CVE-2018-12576 | Medium | 4.3 | 2018-07-02 | TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow clickjacking. |
CVE-2018-0355 | Medium | 6.1 | 2018-06-07 | A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated, remote attacker to conduct a cross-frame scr… |
CVE-2018-1432 | Medium | 6.1 | 2018-06-05 | IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to cross-frame scripting which is a vulnerability that allows an attacker to load Inf… |
CVE-2018-7491 | High | 7.5 | 2018-02-26 | In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an adm… |
CVE-2017-11290 | Medium | 6.1 | 2017-12-09 | An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A UI Redress (or Clickjacking) vulnerability exists. This issue has been resolved by addin… |
CVE-2017-5697 | Medium | 6.5 | 2017-06-14 | Insufficient clickjacking protection in the Web User Interface of Intel AMT firmware versions before 9.1.40.1000, 9.5.60.1952, 10.0.50.1004, 11.0.0.1205, and 1… |
CVE-2017-4015 | Medium | 4.5 | 2017-05-17 | Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to inject arbitrary web script o… |
CVE-2017-7440 | Medium | 6.5 | 2017-05-02 | Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows… |
CVE-2017-0492 | Medium | 5.5 | 2017-03-08 | An elevation of privilege vulnerability in the System UI could enable a local malicious application to create a UI overlay covering the entire screen. This iss… |
CVE-2017-5026 | Medium | 4.3 | 2017-02-17 | Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which allowed a remote att… |
CVE-2017-5016 | Medium | 6.5 | 2017-02-17 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements from being display… |
CVE-2016-2496 | Critical | 9.8 | 2016-06-13 | The Framework UI permission-dialog implementation in Android 6.x before 2016-06-01 allows attackers to conduct tapjacking attacks and access arbitrary private-… |
CVE-2015-1241 | | 2015-04-19 | Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which all… | |
CVE-2014-1483 | | 2014-02-06 | Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRA… | |
CVE-2014-1480 | | 2014-02-06 | The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which all… | |
CVE-2013-5614 | | 2013-12-11 | Mozilla Firefox before 26.0 and SeaMonkey before 2.23 do not properly consider the sandbox attribute of an IFRAME element during processing of a contained OBJE… | |
CVE-2011-1244 | | 2011-04-13 | Microsoft Internet Explorer 6, 7, and 8 does not enforce intended domain restrictions on content access, which allows remote attackers to obtain sensitive info… | |
CVE-2008-2716 | | 2008-06-16 | Unspecified vulnerability in Opera before 9.5 allows remote attackers to spoof the contents of trusted frames on the same parent page by modifying the location… | |
CVE-2005-2407 | | 2005-08-01 | A design error in Opera 8.01 and earlier allows user-assisted attackers to execute arbitrary code by overlaying a malicious new window above a file download di… |