cve.bz

CWE-1021: Improper Restriction of Rendered UI Layers or Frames, page 8

Filter

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

What the weakness is: CWE-1021 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 7
  • CAPEC-103 Clickjacking Likelihood: Medium · Severity: High
  • CAPEC-181 Flash File Overlay Severity: Medium
  • CAPEC-222 iFrame Overlay Likelihood: Medium · Severity: High
  • CAPEC-504 Task Impersonation Likelihood: Medium · Severity: High
  • CAPEC-506 Tapjacking Likelihood: Low · Severity: Low
  • CAPEC-587 Cross Frame Scripting (XFS) Severity: High
  • CAPEC-654 Credential Prompt Impersonation Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-1021, as MITRE names them. Credits.

Ask an AI about CWE-1021

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1021: Improper Restriction of Rendered UI Layers or Frames and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1021.html and https://cve.bz/cve/cwe/1021?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.1CVE-2020-4727EPSS 0.9%

    IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim…

  2. 8.1CVE-2020-13119EPSS 0.8%

    ismartgate PRO 1.5.9 is vulnerable to clickjacking.

  3. 6.5CVE-2020-6547EPSS 1.1%

    Incorrect security UI in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page.

  4. 7.8CVE-2020-0366EPSS 0.4%

    In PackageInstaller, there is a possible permissions bypass due to a tapjacking vulnerability. This could lead to local escalation of privilege using an app set as the default Assist app with User execution privileges needed. User interact…

  5. 7.8CVE-2020-0387EPSS 0.5%

    In manifest files of the SmartSpace package, there is a possible tapjacking vector due to a missing permission check. This could lead to local escalation of privilege and account hijacking with no additional execution privileges needed. Us…

  6. 7.8CVE-2020-0394EPSS 0.3%

    In onCreate of BluetoothPairingDialog.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege and untrusted devices accessing contact lists with no additional execution…

  7. 5.5CVE-2020-0386EPSS 0.4%

    In onCreate of RequestPermissionActivity.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege allowing an attacker to set Bluetooth discoverability with User executi…

  8. 8.1CVE-2020-7705EPSS 1.2%

    This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attributi…

  9. 5.4CVE-2020-4165EPSS 0.6%

    IBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's…

  10. 6.1CVE-2020-13174EPSS 0.7%

    The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which could allow an attacker to trick a user into clicking a malicious link via clickjacking.

  11. 6.5CVE-2020-15648EPSS 1.1%

    Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird < 78 and Firefox < 78.0.2.

  12. 5.4CVE-2020-4644EPSS 1.2%

    IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijac…

  13. 4.3CVE-2019-4323EPSS 0.8%

    "HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of untrusted web pages in a frame."

  14. 4.3CVE-2020-4322EPSS 1.0%

    IBM Security Secret Server 10.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's clic…

  15. 5.4CVE-2020-4406EPSS 0.8%

    IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 through 8.1.9.1 (Linux), 8.1.9.0 through 8.1.9.1 (AIX) web user interfaces could al…

  16. 5.4CVE-2020-4195EPSS 0.6%

    IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack t…

  17. 4.7CVE-2020-6827EPSS 0.8%

    When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI. <br> *Note: This issue only affects Firefox for Android. Other operating…

  18. 6.1CVE-2020-9444EPSS 0.7%

    Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality.

  19. 4.7CVE-2020-10951EPSS 0.9%

    Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages.

  20. 5.4CVE-2020-1728EPSS 0.8%

    A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, ye…

  21. 6.5CVE-2019-19001EPSS 1.6%

    For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an attacker can frame parts of the application on a malicious web site, revealing s…

  22. 7.8CVE-2020-0051EPSS 0.2%

    In onCreate of SettingsHomepageActivity, there is a possible tapjacking attack. This could lead to local escalation of privilege in Settings with no additional execution privileges needed. User interaction is needed for exploitation.Produc…

  23. 5.4CVE-2020-9517EPSS 0.5%

    There is an improper restriction of rendered UI layers or frames vulnerability in Micro Focus Service Manager Release Control versions 9.50 and 9.60. The vulnerability may result in the ability of malicious users to perform UI redress atta…

  24. 8.8CVE-2015-5686EPSS 0.5%

    Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an attacker to redirect user input to an untrusted site or hijack a user session.

  25. 4.3CVE-2013-5594EPSS 0.7%

    Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding

  26. 5.5CVE-2020-0014EPSS 0.9%

    It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable. This could lead to a local escalation of privilege with no additional execution privileges needed. User action is needed f…

  27. 5.4CVE-2019-13924EPSS 0.8%

    A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versions < V4.1), SCALANCE S627-2M (All versions < V4.1), SCALANCE X-200 switch family (incl. SIPLUS NET va…

  28. 4.6CVE-2016-5710EPSS 0.7%

    NetApp Snap Creator Framework before 4.3P1 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.

  29. 4.3CVE-2013-2682ExploitEPSS 6.3%

    Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive information.

  30. 6.5CVE-2013-2675EPSS 2.2%

    Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attackers to obtain sensitive information.

  31. 6.1CVE-2019-4548EPSS 0.9%

    IBM Security Directory Server 6.4.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's …

  32. 5.4CVE-2020-2105EPSS 1.8%

    REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.

  33. 4.3CVE-2013-6772EPSS 0.7%

    Splunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking

  34. 6.1CVE-2019-4742EPSS 0.9%

    IBM Financial Transaction Manager 3.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim'…

  35. 4.3CVE-2019-15930EPSS 1.4%

    Intesync Solismed 3.3sp allows Clickjacking.

  36. 4.3CVE-2019-5861EPSS 0.6%

    Insufficient data validation in Blink in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to bypass anti-clickjacking policy via a crafted HTML page.

  37. 6.1CVE-2019-4215EPSS 0.9%

    IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the …

  38. 4.3CVE-2019-17131EPSS 0.8%

    vBulletin before 5.5.4 allows clickjacking.

  39. 6.1CVE-2019-4109EPSS 1.2%

    IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the…

  40. 6.1CVE-2019-1975EPSS 1.2%

    A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack on an affected device. This vulnerability is due to insufficient HTML if…

  41. 6.1CVE-2019-4086EPSS 1.2%

    IBM Cloud Application Performance Management 8.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijac…

  42. 8.2CVE-2019-16371EPSS 1.2%

    LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because do_popupregister can be bypassed via clickjacking.

  43. 4.3CVE-2019-16175EPSS 0.9%

    A clickjacking vulnerability was found in Limesurvey before 3.17.14.

  44. 7.3CVE-2019-2125EPSS 0.1%

    In ChangeDefaultDialerDialog.java, there is a possible escalation of privilege due to an overlay attack. This could lead to local escalation of privilege, granting privileges to a local app without the user's informed consent, with no addi…

  45. 7.1CVE-2019-3639EPSS 1.2%

    Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attacks via a crafted web page that contains an iframe via does not send an X-Frame-O…

  46. 5.4CVE-2019-4285EPSS 1.1%

    IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could send a specially-crafted HTTP …

  47. 5.4CVE-2019-3794EPSS 1.1%

    Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites.

  48. 4.3CVE-2019-9147EPSS 1.4%

    Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applications, the browser's extension isolation mechanisms are disabled (web_accessible_…

  49. 4.3CVE-2019-12880EPSS 1.4%

    BCN Quark Quarking Password Manager 3.1.84 suffers from a clickjacking vulnerability caused by allowing * within web_accessible_resources. An attacker can take advantage of this vulnerability and cause significant harm.

  50. 4.3CVE-2019-0305EPSS 0.9%

    Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly restrict frame objects or UI layers that belong to another app…