Vulnerabilities (CVE)

Filtered by CWE-1021
Total 166 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-34162 1 Ibm 1 Cics Tx 2022-08-06 N/A 6.1 MEDIUM
IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 229332.
CVE-2021-1403 1 Cisco 1 Ios Xe 2022-08-05 7.1 HIGH 7.4 HIGH
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site WebSocket hijacking (CSWSH) attack and cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient HTTP protections in the web UI on an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the web UI to follow a crafted link. A successful exploit could allow the attacker to corrupt memory on the affected device, forcing it to reload and causing a DoS condition.
CVE-2020-10743 2 Elastic, Redhat 2 Kibana, Openshift Container Platform 2022-08-05 4.3 MEDIUM 4.3 MEDIUM
It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate requests. This flaw allows an attacker to trick a user into performing arbitrary actions in OCP's distribution of Kibana, such as clickjacking.
CVE-2022-2179 1 Rockwellautomation 4 Micrologix 1100, Micrologix 1100 Firmware, Micrologix 1400 and 1 more 2022-07-27 N/A 6.5 MEDIUM
The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clickjacking attacks.
CVE-2022-20226 1 Google 1 Android 2022-07-26 3.3 LOW 3.9 LOW
In finishDrawingWindow of WindowManagerService.java, there is a possible tapjacking due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-213644870
CVE-2022-20212 1 Google 1 Android 2022-07-21 4.4 MEDIUM 7.8 HIGH
In wifi.RequestToggleWifiActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-182282630
CVE-2022-28889 1 Apache 1 Druid 2022-07-15 4.3 MEDIUM 4.3 MEDIUM
In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.
CVE-2021-27375 1 Containous 1 Traefik 2022-07-12 5.0 MEDIUM 5.3 MEDIUM
Traefik before 2.4.5 allows the loading of IFRAME elements from other domains.
CVE-2021-41657 1 Smartbear 1 Codecollaborator 2022-07-12 4.3 MEDIUM 6.5 MEDIUM
SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack.
CVE-2021-0992 1 Google 1 Android 2022-07-12 1.9 LOW 3.3 LOW
In onCreate of PaymentDefaultDialog.java, there is a possible way to change a default payment app without user consent due to tapjack overlay. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-180104327
CVE-2020-13174 1 Teradici 2 Managament Console, Pcoip Management Console 2022-07-08 4.3 MEDIUM 6.1 MEDIUM
The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which could allow an attacker to trick a user into clicking a malicious link via clickjacking.
CVE-2021-29865 3 Ibm, Linux, Microsoft 3 Jazz Team Server, Linux Kernel, Windows 2022-06-30 4.9 MEDIUM 5.4 MEDIUM
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 206091.
CVE-2021-39691 1 Google 1 Android 2022-06-24 6.9 MEDIUM 7.3 HIGH
In WindowManager, there is a possible tapjacking attack due to an incorrect window flag when processing user input. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-157929241
CVE-2022-27220 1 Siemens 1 Sinema Remote Connect Server 2022-06-24 4.3 MEDIUM 4.3 MEDIUM
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server configured on port 6220. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks and other similar client-based attack vectors.
CVE-2022-27219 1 Siemens 1 Sinema Remote Connect Server 2022-06-23 4.3 MEDIUM 4.3 MEDIUM
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server configured on port 443. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks and other similar client-based attack vectors.
CVE-2017-20041 1 Ucweb 1 Uc Browser 2022-06-22 4.3 MEDIUM 6.5 MEDIUM
A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers (URL). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2020-9942 1 Apple 2 Mac Os X, Safari 2022-06-02 4.3 MEDIUM 4.3 MEDIUM
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, Safari 13.1.2. Visiting a malicious website may lead to address bar spoofing.
CVE-2020-9945 1 Apple 2 Mac Os X, Safari 2022-06-02 4.3 MEDIUM 4.3 MEDIUM
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, Safari 14.0.1. Visiting a malicious website may lead to address bar spoofing.
CVE-2021-46708 1 Smartbear 1 Swagger Ui 2022-06-01 4.3 MEDIUM 6.1 MEDIUM
The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
CVE-2022-1803 1 Trudesk Project 1 Trudesk 2022-06-01 4.9 MEDIUM 6.9 MEDIUM
Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2.