cve.bz

CWE-1021: Improper Restriction of Rendered UI Layers or Frames, page 5

Filter

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

What the weakness is: CWE-1021 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 7
  • CAPEC-103 Clickjacking Likelihood: Medium · Severity: High
  • CAPEC-181 Flash File Overlay Severity: Medium
  • CAPEC-222 iFrame Overlay Likelihood: Medium · Severity: High
  • CAPEC-504 Task Impersonation Likelihood: Medium · Severity: High
  • CAPEC-506 Tapjacking Likelihood: Low · Severity: Low
  • CAPEC-587 Cross Frame Scripting (XFS) Severity: High
  • CAPEC-654 Credential Prompt Impersonation Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-1021, as MITRE names them. Credits.

Ask an AI about CWE-1021

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1021: Improper Restriction of Rendered UI Layers or Frames and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1021.html and https://cve.bz/cve/cwe/1021?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.1CVE-2023-23126EPSS 0.4%

    Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: the vendor's position is that a Content-Security-Policy HTTP response header is p…

  2. 6.5CVE-2022-45096EPSS 0.5%

    Dell PowerScale OneFS, 8.2.0 through 9.3.0, contain an User Interface Security Issue. An unauthenticated remote user could unintentionally lead an administrator to enable this vulnerability, leading to disclosure of information.

  3. 6.5CVE-2022-32517EPSS 0.4%

    A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to trick the interface user/admin into interacting with the application in an unintended way when the product does not impl…

  4. 7.8CVE-2023-20913EPSS 0.1%

    In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious phone account due to a tapjacking/overlay attack. This could lead to local escalation of privilege wi…

  5. 5.5CVE-2022-20215EPSS 0.1%

    In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for…

  6. 4.7CVE-2022-20214EPSS 0.2%

    In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can overlay the toggle button to enable apps to modify system settings without user consent.Product: AndroidVersions: Android-10…

  7. 5.5CVE-2022-20213EPSS 0.1%

    In ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for ex…

  8. 6.1CVE-2023-0057EPSS 0.5%

    Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.

  9. 6.5CVE-2022-45420EPSS 0.6%

    Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, T…

  10. 6.1CVE-2022-45418EPSS 0.8%

    If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thun…

  11. 4.3CVE-2022-45417EPSS 0.4%

    Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. This would not have persisted them in a state where t…

  12. 4.3CVE-2022-3034EPSS 0.6%

    When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird …

  13. 7.5CVE-2022-36319EPSS 0.7%

    When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, a…

  14. 6.5CVE-2022-29914EPSS 0.7%

    When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.

  15. 6.1CVE-2022-29911EPSS 0.6%

    An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present. This vulnerability affects Thunderbird < 91.…

  16. 5.4CVE-2022-28286EPSS 0.6%

    Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.

  17. 6.5CVE-2022-20553EPSS 0.1%

    In onCreate of LogAccessDialogActivity.java, there is a possible way to bypass a permission check due to a tapjacking/overlay attack. This could lead to local escalation of privilege with System execution privileges needed. User interactio…

  18. 7.8CVE-2022-20520EPSS 0.2%

    In onCreate of various files, there is a possible tapjacking/overlay attack. This could lead to local escalation of privilege or denial of server with User execution privileges needed. User interaction is not needed for exploitation.Produc…

  19. 6.5CVE-2022-46695EPSS 1.4%

    A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Visiting …

  20. 7.3CVE-2022-20501EPSS 0.1%

    In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User executi…

  21. 7.3CVE-2022-20442EPSS 0.1%

    In onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a separate app with API level < 23 due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution pri…

  22. 6.1CVE-2022-46061EPSS 0.5%

    AeroCMS v0.0.1 is vulnerable to ClickJacking.

  23. 6.1CVE-2022-34318EPSS 0.7%

    IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and p…

  24. 4.8CVE-2022-3260EPSS 0.5%

    The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these results incorrectly, allowing clickjacking attacks.

  25. 6.1CVE-2022-42799EPSS 1.7%

    The issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Visiting a malicious website may lead to user interface spoofing.

  26. 6.1CVE-2022-36182EPSS 0.7%

    Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site.

  27. 6.1CVE-2022-22503EPSS 0.7%

    IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim'…

  28. 8.8CVE-2022-3167EPSS 1.2%

    Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.

  29. 6.1CVE-2022-36736EPSS 0.7%

    Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request. NOTE: this is disputed by the vendor

  30. 4.3CVE-2022-2965EPSS 0.7%

    Improper Restriction of Rendered UI Layers or Frames in GitHub repository notrinos/notrinoserp prior to 0.7.

  31. 6.1CVE-2022-2800EPSS 0.6%

    A vulnerability, which was classified as problematic, has been found in SourceCodester Gym Management System. Affected by this issue is some unknown functionality. The manipulation leads to clickjacking. The attack may be launched remotely…

  32. 7.8CVE-2022-20331EPSS 0.1%

    In the Framework, there is a possible way to enable a work profile without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction i…

  33. 6.5CVE-2022-20852EPSS 0.5%

    Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface. For more information about …

  34. 5.4CVE-2022-20820EPSS 0.6%

    Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface. For more information about …

  35. 5.4CVE-2022-2734EPSS 0.8%

    Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1.

  36. 6.1CVE-2022-33727EPSS 0.2%

    A vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack.

  37. 6.1CVE-2022-33723EPSS 0.2%

    A vulnerable code in onCreate of BluetoothScanDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack.

  38. 6.1CVE-2022-34162EPSS 0.9%

    IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and p…

  39. 6.5CVE-2022-1138EPSS 0.9%

    Inappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who had compromised the renderer process to obscure the contents of the Omnibox (URL bar) via a crafted HTML page.

  40. 6.5CVE-2022-2179EPSS 1.7%

    The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clickjacking attacks.

  41. 3.9CVE-2022-20226EPSS 0.1%

    In finishDrawingWindow of WindowManagerService.java, there is a possible tapjacking due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for ex…

  42. 7.8CVE-2022-20212EPSS 0.1%

    In wifi.RequestToggleWifiActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is need…

  43. 4.3CVE-2022-28889EPSS 1.9%

    In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.

  44. 5.4CVE-2021-29865EPSS 0.7%

    IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability …

  45. 7.3CVE-2021-39691EPSS 0.1%

    In WindowManager, there is a possible tapjacking attack due to an incorrect window flag when processing user input. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed…

  46. 4.3CVE-2022-27220EPSS 0.7%

    A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server configured on port 6220. This could aid attackers by making the …

  47. 4.3CVE-2022-27219EPSS 0.7%

    A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server configured on port 443. This could aid attackers by making the s…

  48. 6.5CVE-2017-20041EPSS 0.7%

    A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered u…

  49. 6.9CVE-2022-1803EPSS 1.6%

    Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2.

  50. 4.3CVE-2021-27773EPSS 0.5%

    This vulnerability allows users to execute a clickjacking attack in the meeting's chat.