CWE-1021

Improper Restriction of Rendered UI Layers or Frames

Parent: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

401 vulnerabilities with CWE-1021

CVE-2020-4322 MEDIUM

IBM Security Secret Server 10.7 - CSRF

CVSS 4.3

CVE-2020-4406 MEDIUM

IBM Spectrum Protect Client <8.1.9.1 - CSRF

CVSS 5.4

CVE-2020-4195 MEDIUM

IBM API Connect V2018.4.1.0-2018.4.1.10 - CSRF

CVSS 5.4

CVE-2020-6827 MEDIUM

Firefox for Android - Info Disclosure

CVSS 4.7

CVE-2020-9444 MEDIUM

Zulip Server <2.1.3 - Info Disclosure

CVSS 6.1

CVE-2020-10951 MEDIUM

Western Digital My Cloud Home & ibi <2.2.0 - CSRF

CVSS 4.7

CVE-2020-1728 MEDIUM

Keycloak < 10.0.0 - Missing HTTP Security Headers in Admin Console

CVSS 4.8

CVE-2020-0051 HIGH

Android 10 - Tapjacking Attack in SettingsHomepageActivity

CVSS 7.8

CVE-2020-9517 MEDIUM

Micro Focus Service Manager Release Control <9.51 - XSS

CVSS 5.4

CVE-2020-0014 MEDIUM

Android 8.0-10 - Unauthenticated Privilege Escalation via TYPE_TOAST Window Injection

CVSS 5.5

CVE-2020-2105 MEDIUM

Jenkins < 2.204.1 and < 2.218 - Clickjacking via REST API Endpoints

CVSS 5.4

CVE-2019-8771 MEDIUM

Safari < 13.0.1 - Iframe Sandbox Policy Bypass

CVSS 6.1

CVE-2019-4323 MEDIUM

HCL AppScan < 10.0.0 - Clickjacking via API Documentation

CVSS 4.3

CVE-2019-19001 MEDIUM

Hitachi Energy eSOMS 4.0-6.0.2 - ClickJacking via Missing X-Frame-Options Header

CVSS 6.5

CVE-2019-13924 MEDIUM

SCALANCE X-200 and X-300 Firmware - Clickjacking via Missing X-Frame-Options Header

CVSS 5.4

CVE-2019-4548 MEDIUM

IBM Security Directory Server 6.4.0 - CSRF

CVSS 6.1

CVE-2019-4742 MEDIUM

IBM Financial Transaction Manager 3.0 - CSRF

CVSS 6.1

CVE-2019-15930 MEDIUM

Intesync Solismed 3.3sp - Clickjacking

CVSS 4.3

CVE-2019-5861 MEDIUM

Google Chrome < 76.0.3809.87 - Anti-Clickjacking Policy Bypass via Crafted HTML Page

CVSS 4.3

CVE-2019-4215 MEDIUM

IBM SmartCloud Analytics <1.3.5 - CSRF

CVSS 6.1

CVE-2019-17131 MEDIUM

vBulletin < 5.5.4 - Clickjacking

CVSS 4.3

CVE-2019-4109 MEDIUM

IBM WebSphere eXtreme Scale 8.6 - CSRF

CVSS 6.1

CVE-2019-1975 MEDIUM

Cisco HyperFlex HX220c AF M5 < 3.5.2f - Cross-Frame Scripting via iframe

CVSS 6.1

CVE-2019-4086 MEDIUM

IBM Cloud Application Performance Management 8.1.4 - CSRF

CVSS 6.1

CVE-2019-16371 HIGH

LastPass < 4.33.0 - Credential Capture via Clickjacking Bypass

CVSS 8.2

Details

Vulnerabilities 401

Links