CWE-1021 · Misconfiguration and Insecure Design
Improper Restriction of Rendered UI Layers or Frames
402CVEs
0exploited
1with a public check
2likely (EPSS 10%+)
SortMost likely exploited
402 CVEs with CWE-1021 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-1362Checkunilogies/bumsys < v2.0.2 - Clickjackingunilogies · unilogies/bumsys · CVSS 8.4 · 2023-03-13 | 8.4 | 1.4% | 2023-03-13 |
| CVE-2021-21132Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Extension.Google · Chrome · 2021-02-09 | – | 25% | 2021-02-09 |
| CVE-2011-1244Microsoft Internet Explorer 6, 7, and 8 does not enforce intended domain restrictions on content access, which allows remote attackers to obtain sensitive information or conduct c…Microsoft · Internet Explorer · 2011-04-13 | – | 15% | 2011-04-13 |
| CVE-2013-2682Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive information.Cisco · Linksys E4200 Firmware · 2020-02-05 | – | 6.3% | 2020-02-05 |
| CVE-2021-21139Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.Google · Chrome · 2021-02-09 | – | 5.1% | 2021-02-09 |
| CVE-2017-11290An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A UI Redress (or Clickjacking) vulnerability exists. This issue has been resolved by adding a feature that ena…Adobe · Adobe Connect 9.6.2 and earlier versions · 2017-12-09 | – | 3.0% | 2017-12-09 |
| CVE-2008-2716Unspecified vulnerability in Opera before 9.5 allows remote attackers to spoof the contents of trusted frames on the same parent page by modifying the location, which can facilita…Opera · Opera Browser · 2008-06-16 | – | 3.0% | 2008-06-16 |
| CVE-2005-2407A design error in Opera 8.01 and earlier allows user-assisted attackers to execute arbitrary code by overlaying a malicious new window above a file download dialog box, then trick…Opera · Opera Browser · 2005-07-28 | – | 2.7% | 2005-07-28 |
| CVE-2018-17192The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results inc…Apache Software Foundation · Apache NiFi · 2018-12-19 | – | 2.7% | 2018-12-19 |
| CVE-2014-1480The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers…Mozilla · Firefox · 2014-02-06 | – | 2.7% | 2014-02-06 |
| CVE-2014-1483Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjun…Mozilla · Firefox · 2014-02-06 | – | 2.4% | 2014-02-06 |
| CVE-2013-5614Mozilla Firefox before 26.0 and SeaMonkey before 2.23 do not properly consider the sandbox attribute of an IFRAME element during processing of a contained OBJECT element, which al…Mozilla · Firefox · 2013-12-11 | – | 2.4% | 2013-12-11 |
| CVE-2019-7393A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2…CA Technologies, A Broadcom Company · CA Strong Authentication · 2019-05-28 | – | 2.3% | 2019-05-28 |
| CVE-2013-2675Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attackers to obtain sensitive information.Brother · Mfc-9970cdw Firmware · 2020-02-05 | – | 2.2% | 2020-02-05 |
| CVE-2015-1241Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers…Google · Chrome · 2015-04-19 | – | 2.2% | 2015-04-19 |
| CVE-2022-28889Clickjacking in the web consoleApache Software Foundation · Apache Druid · 2022-07-07 | – | 1.9% | 2022-07-07 |
| CVE-2020-2105REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.Jenkins project · Jenkins · 2020-01-29 | – | 1.8% | 2020-01-29 |
| CVE-2021-38509Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpa…Mozilla · Firefox · 2021-12-08 | – | 1.8% | 2021-12-08 |
| CVE-2022-2179ICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or FramesRockwell Automation · MicroLogix 1400 · CVSS 6.5 · 2022-07-20 | 6.5 | 1.7% | 2022-07-20 |
| CVE-2022-42799The issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Visiting a malicious websi…Apple · macOS · CVSS 6.1 · 2022-11-01 | 6.1 | 1.7% | 2022-11-01 |
| CVE-2021-38508By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the promp…Mozilla · Firefox · 2021-12-08 | – | 1.6% | 2021-12-08 |
| CVE-2022-1803Improper Restriction of Rendered UI Layers or Frames in polonel/trudeskpolonel · polonel/trudesk · CVSS 8.4 · 2022-05-20 | 8.4 | 1.6% | 2022-05-20 |
| CVE-2021-3799Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admingetgrav · getgrav/grav-plugin-admin · CVSS 5.4 · 2021-09-27 | 5.4 | 1.6% | 2021-09-27 |
| CVE-2020-24711The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attackGetgophish · Gophish · 2020-10-28 | – | 1.6% | 2020-10-28 |
| CVE-2021-37788A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjacking attack. The vul…Gurock · Testrail · 2021-08-09 | – | 1.5% | 2021-08-09 |
| CVE-2021-38506Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI incl…Mozilla · Firefox · 2021-12-08 | – | 1.5% | 2021-12-08 |
| CVE-2021-43546It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and…Mozilla · Thunderbird · 2021-12-08 | – | 1.5% | 2021-12-08 |
| CVE-2021-46708The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web sit…Smartbear · Swagger-Ui-Dist · 2022-03-11 | – | 1.5% | 2022-03-11 |
| CVE-2019-9147Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applications, the browser's…Mailvelope · Mailvelope · 2019-07-09 | – | 1.4% | 2019-07-09 |
| CVE-2022-46695A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPa…Apple · tvOS · CVSS 6.5 · 2022-12-15 | 6.5 | 1.4% | 2022-12-15 |
| CVE-2019-12880BCN Quark Quarking Password Manager 3.1.84 suffers from a clickjacking vulnerability caused by allowing * within web_accessible_resources. An attacker can take advantage of this v…Bcnquark · Quarking Password Manager · 2019-06-24 | – | 1.4% | 2019-06-24 |
| CVE-2017-5026Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which allowed a remote attacker to show alerts…Google · Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac · 2017-02-17 | – | 1.4% | 2017-02-17 |
| CVE-2019-15930Intesync Solismed 3.3sp allows Clickjacking.Intesync · Solismed · 2019-12-12 | – | 1.4% | 2019-12-12 |
| CVE-2019-5767Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a malicious application…Google · Chrome · 2019-02-19 | – | 1.3% | 2019-02-19 |
| CVE-2020-26953It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the use…Mozilla · Firefox · 2020-12-09 | – | 1.3% | 2020-12-09 |
| CVE-2017-5016Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements from being displayed by non-visible pa…Google · Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.8… · 2017-02-17 | – | 1.3% | 2017-02-17 |
| CVE-2021-43048TIBCO PartnerExpress Click-Jacking vulnerabilityTIBCO Software Inc. · TIBCO PartnerExpress · CVSS 9.8 · 2021-11-16 | 9.8 | 1.3% | 2021-11-16 |
| CVE-2021-37971Incorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.Google · Chrome · 2021-10-08 | – | 1.3% | 2021-10-08 |
| CVE-2021-3660Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML en…Cockpit-Project · cockpit · 2022-03-07 | – | 1.3% | 2022-03-07 |
| CVE-2019-4109IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a re…IBM · WebSphere eXtreme Scale · CVSS 6.1 · 2019-09-30 | 6.1 | 1.3% | 2019-09-30 |
| CVE-2019-3639MWG UI: Cross-Frame Scripting vulnerabilityMcAfee, LLC · McAfee Web Gateway (MWG) · CVSS 7.1 · 2019-08-14 | 7.1 | 1.2% | 2019-08-14 |
| CVE-2021-3731Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmbledgersmb · ledgersmb/ledgersmb · CVSS 5.9 · 2021-08-23 | 5.9 | 1.2% | 2021-08-23 |
| CVE-2020-4644IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site,…IBM · Planning Analytics · CVSS 6.1 · 2020-07-29 | 6.1 | 1.2% | 2020-07-29 |
| CVE-2021-23274TIBCO API Exchange Gateway Clickjack VulnerabilityTIBCO Software Inc. · TIBCO API Exchange Gateway · CVSS 9.8 · 2021-03-23 | 9.8 | 1.2% | 2021-03-23 |
| CVE-2017-4015Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to inject arbitrary web script or HTML via HTTP resp…McAfee · Network Data Loss Prevention (NDLP) · 2017-05-17 | – | 1.2% | 2017-05-17 |
| CVE-2019-4086IBM Cloud Application Performance Management 8.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site,…IBM · Cloud Application Performance Management · CVSS 6.1 · 2019-09-17 | 6.1 | 1.2% | 2019-09-17 |
| CVE-2022-3167Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffwebikus060 · ikus060/rdiffweb · CVSS 10 · 2022-09-08 | 10.0 | 1.2% | 2022-09-08 |
| CVE-2019-4217IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a maliciou…IBM · Security Information Queue · CVSS 6.1 · 2019-06-06 | 6.1 | 1.2% | 2019-06-06 |
| CVE-2018-1853IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a maliciou…IBM · Spectrum Protect · CVSS 6.1 · 2019-04-08 | 6.1 | 1.2% | 2019-04-08 |
| CVE-2018-1803IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a vi…IBM · Security Access Manager Appliance · CVSS 6.1 · 2018-12-13 | 6.1 | 1.2% | 2018-12-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.