Vulnerabilities (CVE)

Filtered by CWE-1021
Total 279 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-15793 1 Siemens 1 Desigo Insight 2024-02-28 5.8 MEDIUM 5.4 MEDIUM
A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header which makes it vulnerable to Clickjacking attacks. This could allow an unauthenticated attacker to retrieve or modify data in the context of a legitimate user by tricking that user to click on a website controlled by the attacker.
CVE-2020-13119 1 Gogogate 2 Ismartgate Pro, Ismartgate Pro Firmware 2024-02-28 4.3 MEDIUM 8.1 HIGH
ismartgate PRO 1.5.9 is vulnerable to clickjacking.
CVE-2021-23976 1 Mozilla 1 Firefox 2024-02-28 5.8 MEDIUM 8.1 HIGH
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.
CVE-2021-27375 1 Containous 1 Traefik 2024-02-28 5.0 MEDIUM 5.3 MEDIUM
Traefik before 2.4.5 allows the loading of IFRAME elements from other domains.
CVE-2020-26953 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2024-02-28 4.3 MEDIUM 4.3 MEDIUM
It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
CVE-2020-16033 1 Google 1 Chrome 2024-02-28 4.3 MEDIUM 4.3 MEDIUM
Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVE-2019-8771 1 Apple 2 Iphone Os, Safari 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate iframe sandboxing policy.
CVE-2020-5679 1 Ec-cube 1 Ec-cube 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted.
CVE-2021-21111 3 Debian, Fedoraproject, Google 3 Debian Linux, Fedora, Chrome 2024-02-28 6.8 MEDIUM 9.6 CRITICAL
Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
CVE-2020-9945 1 Apple 2 Mac Os X, Safari 2024-02-28 4.3 MEDIUM 4.3 MEDIUM
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, Safari 14.0.1. Visiting a malicious website may lead to address bar spoofing.
CVE-2020-26962 1 Mozilla 1 Firefox 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in clickjacking attacks, as well as be read across partitions in dynamic first party isolation. This vulnerability affects Firefox < 83.
CVE-2021-0391 1 Google 1 Android 2024-02-28 6.8 MEDIUM 7.8 HIGH
In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-172841550
CVE-2020-9987 1 Apple 1 Safari 2024-02-28 4.3 MEDIUM 4.3 MEDIUM
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 14.0. Visiting a malicious website may lead to address bar spoofing.
CVE-2020-27059 1 Google 1 Android 2024-02-28 4.4 MEDIUM 7.8 HIGH
In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, 11; Android ID: A-159249069.
CVE-2021-0333 1 Google 1 Android 2024-02-28 6.9 MEDIUM 7.3 HIGH
In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay that obscures the phonebook permissions dialog when a Bluetooth device is connecting. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-168504491
CVE-2021-23274 1 Tibco 2 Api Exchange Gateway, Api Exchange Gateway Distribution 2024-02-28 7.5 HIGH 9.8 CRITICAL
The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows an unauthenticated attacker with network access to execute a clickjacking attack on the affected system. A successful attack using this vulnerability does not require human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO API Exchange Gateway: versions 2.3.3 and below and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric: versions 2.3.3 and below.
CVE-2020-24711 1 Getgophish 1 Gophish 2024-02-28 4.3 MEDIUM 6.5 MEDIUM
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack
CVE-2020-4547 1 Ibm 11 Collaborative Lifecycle Management, Engineering Insights, Engineering Lifecycle Management and 8 more 2024-02-28 3.5 LOW 5.4 MEDIUM
IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 183315.
CVE-2021-0386 1 Google 1 Android 2024-02-28 6.8 MEDIUM 7.8 HIGH
In onCreate of UsbConfirmActivity, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173421110
CVE-2020-6547 3 Debian, Fedoraproject, Google 3 Debian Linux, Fedora, Chrome 2024-02-28 4.3 MEDIUM 6.5 MEDIUM
Incorrect security UI in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page.