CWE-1021

Improper Restriction of Rendered UI Layers or Frames

Parent: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

401 vulnerabilities with CWE-1021

CVE-2023-37455 MEDIUM

Firefox for iOS < 115 - Info Disclosure

CVSS 5.4

CVE-2023-34658 MEDIUM

Telegram 9.6.3 - UI Layer Spoofing via SFSafariViewController

CVSS 5.3

CVE-2023-23343 LOW

HCL BigFix OSD Bare Metal Server < 311.12 - Clickjacking via Transparent or Opaque Layers

CVSS 2.4

CVE-2023-2013 LOW

GitLab CE/EE <15.10.8, <15.11.7, <16.0.2 - Info Disclosure

CVSS 2.6

CVE-2023-3140 MEDIUM

KNIME Business Hub < 1.4.0 - Clickjacking via Missing HTTP Headers

CVSS 4.3

CVE-2023-28159 MEDIUM

Firefox < 111.0 - UI Spoofing via Fullscreen Notification Bypass

CVSS 4.3

CVE-2023-25748 MEDIUM

Firefox < 111.0 - UI Spoofing via Fullscreen Notification Obscuring

CVSS 4.3

CVE-2023-25730 MEDIUM

Firefox <110, Thunderbird <102.8, Firefox ESR <102.8 - Info Disclosure

CVSS 5.4

CVE-2023-1362 MEDIUM

unilogies/bumsys <2.0.2 - Info Disclosure

CVSS 6.1

CVE-2023-0780 MEDIUM

Cockpit <2.3.9-dev - Info Disclosure

CVSS 5.4

CVE-2023-23126 MEDIUM

Connectwise Automate 2022.11 - CSRF

CVSS 6.1

CVE-2023-20913 HIGH

Android - Tapjacking/Overlay Attack via PhoneAccountSettingsActivity

CVSS 7.8

CVE-2023-0057 MEDIUM

pyload <0.5.0b3.dev33 - Info Disclosure

CVSS 6.1

CVE-2022-32919 MEDIUM

iPadOS < 16.2 - UI Spoofing via Malicious Framed Content

CVSS 4.7

CVE-2022-20443 HIGH

Android 13 - Tapjacking/Overlay Attack in Layer.cpp

CVSS 7.8

CVE-2022-43378 MEDIUM

NetBotz 4 - Improper Restriction of Rendered UI Layers or Frames

CVSS 6.5

CVE-2022-32891 MEDIUM

Safari < 16.0 - UI Spoofing via Malicious Framed Content

CVSS 6.1

CVE-2022-40268 MEDIUM

Mitsubishi Electric GOT2000 Series - CSRF

CVSS 6.1

CVE-2022-45096 MEDIUM

Dell PowerScale OneFS <9.3.0 - Info Disclosure

CVSS 5.4

CVE-2022-32517 MEDIUM

Conext ComBox Firmware - Clickjacking via Unrestricted UI Layer Rendering

CVSS 6.5

CVE-2022-20215 MEDIUM

Android - Local Denial of Service via Tapjacking Overlay Attack

CVSS 5.5

CVE-2022-20214 MEDIUM

Android 10-12 - Tapjacking Attack via Car Settings Toggle Button

CVSS 4.7

CVE-2022-20213 MEDIUM

Android - Denial of Service via Tapjacking/Overlay Attack in ApplicationsDetailsActivity

CVSS 5.5

CVE-2022-45420 MEDIUM

Firefox ESR < 102.5 & Thunderbird < 102.5 & Firefox < 107 - XSS

CVSS 6.5

CVE-2022-45418 MEDIUM

Firefox ESR < 102.5 & Thunderbird < 102.5 & Firefox < 107 - SSRF

CVSS 6.1

Details

Vulnerabilities 401

Links