cve.bz

CWE-1021: Improper Restriction of Rendered UI Layers or Frames, page 3

Filter

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

What the weakness is: CWE-1021 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 7
  • CAPEC-103 Clickjacking Likelihood: Medium · Severity: High
  • CAPEC-181 Flash File Overlay Severity: Medium
  • CAPEC-222 iFrame Overlay Likelihood: Medium · Severity: High
  • CAPEC-504 Task Impersonation Likelihood: Medium · Severity: High
  • CAPEC-506 Tapjacking Likelihood: Low · Severity: Low
  • CAPEC-587 Cross Frame Scripting (XFS) Severity: High
  • CAPEC-654 Credential Prompt Impersonation Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-1021, as MITRE names them. Credits.

Ask an AI about CWE-1021

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1021: Improper Restriction of Rendered UI Layers or Frames and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1021.html and https://cve.bz/cve/cwe/1021?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.1CVE-2025-54527EPSS 0.3%

    In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass security restrictions

  2. 6.1CVE-2025-54139EPSS 0.4%

    HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers …

  3. 2.1CVE-2025-7903EPSS 0.3%

    A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the component Image Source Handler. The manipulation leads to improper restriction of ren…

  4. 5.1CVE-2025-6983EPSS 0.5%

    A Clickjacking vulnerability in TP-Link Archer C1200 web management page allows an attacker to trick users into performing unintended actions via rendered UI layers or frames.This issue affects Archer C1200 <= 1.1.5.

  5. 6.1CVE-2025-27455EPSS 0.3%

    The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing conf…

  6. 6.1CVE-2025-53096EPSS 0.2%

    Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a …

  7. 5.4CVE-2025-36027EPSS 0.2%

    IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victi…

  8. 5.4CVE-2025-6557EPSS 0.2%

    Insufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium secur…

  9. 4.3CVE-2025-6434EPSS 0.3%

    The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP. Thi…

  10. 6.1CVE-2025-49192EPSS 0.3%

    The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives. This could potentially reveal c…

  11. 6.1CVE-2025-49191EPSS 0.3%

    Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible to attack other users that access the dashboard by including malicious code. The…

  12. 6.5CVE-2025-49139EPSS 0.4%

    HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in the HAX site editor, users can create a website block to load another site in an iframe. The application allows users to supply a t…

  13. 5.4CVE-2025-5267EPSS 0.3%

    A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

  14. 2.3CVE-2025-43854EPSS 0.2%

    DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web…

  15. 6.5CVE-2025-32385EPSS 0.3%

    EspoCRM is an Open Source Customer Relationship Management software. Prior to 9.0.5, Iframe dashlet allows user to display iframes with arbitrary URLs. As the sandbox attribute is not included in the iframe, the remote page can open popups…

  16. 6.5CVE-2025-0362EPSS 0.3%

    An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions, an attacker could potentially trick users into unintentionally authorizing …

  17. 6.5CVE-2025-25213EPSS 0.3%

    Improper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views and clicks on the content on the malicious page while logged in, unintended operations may be performed.

  18. 6.6CVE-2025-31138EPSS 0.3%

    tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allo…

  19. 4.3CVE-2025-24310EPSS 0.4%

    Improper restriction of rendered UI layers or frames issue exists in HMI ViewJet C-more series, which may allow a remote unauthenticated attacker to trick the product user to perform operations on the product's web pages.

  20. 4.3CVE-2025-1923EPSS 0.2%

    Inappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security …

  21. 4.3CVE-2025-1917EPSS 0.3%

    Inappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  22. 7.1CVE-2025-1940EPSS 0.2%

    A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. *This issue only affects Android versions of Firefox.*.…

  23. 6.8CVE-2025-24874EPSS 0.3%

    SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header i…

  24. 5.4CVE-2024-49796EPSS 0.4%

    IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and p…

  25. 4.3CVE-2025-1019EPSS 0.4%

    The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.

  26. 5.3CVE-2025-1018EPSS 0.4%

    The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.

  27. 5.3CVE-2024-6466EPSS 0.3%

    NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified.

  28. 6.4CVE-2024-57369EPSS 0.4%

    Clickjacking vulnerability in typecho v1.2.1.

  29. 7.5CVE-2024-56436EPSS 0.2%

    Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  30. 7.5CVE-2024-56435EPSS 0.2%

    Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  31. 5.2CVE-2021-29827EPSS 0.3%

    IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim…

  32. 7.1CVE-2024-55888EPSS 0.3%

    Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security head…

  33. 7.5CVE-2024-54112EPSS 0.2%

    Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  34. 7.5CVE-2024-54110EPSS 0.3%

    Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  35. 5.4CVE-2024-53976EPSS 0.3%

    Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what the URL was for the loaded webpage. This vulnerability affects Firefox for iOS < 133.

  36. 8.1CVE-2024-11700EPSS 0.5%

    Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of external applications, potentially exposing them to underlying vulnerabilities. …

  37. 5.4CVE-2024-11695EPSS 0.5%

    A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and…

  38. 6.5CVE-2024-7404EPSS 0.6%

    An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as t…

  39. 5.5CVE-2024-43084EPSS 0.10%

    In visitUris of multiple files, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploit…

  40. 6.1CVE-2024-10454EPSS 0.2%

    Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel. This vulnerability occurs due to the absence of an X-Frame-Options server-side header. An attacker could overlay a transparent iframe to…

  41. 9.1CVE-2024-10004EPSS 0.4%

    Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padlock icon showing an HTTPS indicator incorrectly This vulnerability affects Firefox for iOS <…

  42. 6.1CVE-2024-9397EPSS 0.4%

    A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbi…

  43. 5.3CVE-2024-8388EPSS 0.4%

    Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing the transition to fullscreen mode after the fix for CVE-2023-6870 in Firefox 121. This could lead to spoofing the browser…

  44. 7.8CVE-2024-34743EPSS 0.08%

    In setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction…

  45. 8.1CVE-2024-7523EPSS 0.3%

    A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. *This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 129.

  46. 6.5CVE-2024-7518EPSS 0.5%

    Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.

  47. 6.1CVE-2024-39320EPSS 0.3%

    Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vuln…

  48. 6.1CVE-2024-40817EPSS 0.7%

    The issue was addressed with improved UI handling. This issue is fixed in Safari 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. Visiting a website that frames malicious content may lead to UI spoofing.

  49. 4.7CVE-2023-7013EPSS 0.2%

    Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium)

  50. 7.3CVE-2024-31324EPSS 0.1%

    In hide of WindowState.java, there is a possible way to bypass tapjacking/overlay protection by launching the activity in portrait mode first and then rotating it to landscape mode. This could lead to local escalation of privilege with Use…