Weakness (CWE)
CWE-1021: Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
How to prevent it (4 mitigations)
-
Implementation
Use the "frame-ancestors" directive in the Content Security Policy, which is intended to define restrictions when it comes to allowing embedded content [REF-1544].
-
Implementation
The use of X-Frame-Options (now partially obsolete as of September 2026 [REF-1545]) allows developers of web content to restrict the usage of their application within the form of overlays, frames, or iFrames. The developer can indicate from which domains can frame the content.
The concept of X-Frame-Options is well documented, but implementation of this protection mechanism is in development to cover gaps; often, there is a need for allowing frames from multiple domains.
-
Implementation
Use a "frame-breaker" script in each page that should not be framed. This is very helpful for legacy browsers that do not support the X-Frame-Options security feature previously mentioned (which is now partially obsolete).
-
Implementation
In addition to frames or iframes as previously mentioned, the web application is expected to place restrictions on whether it is allowed to be rendered within objects, embed, or applet elements.
Source: MITRE CWE-1021
163 results · Clear filters · Feed
-
Medium 5.4
A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser i…
-
Medium 4.3
By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potent…
-
Medium 6.5
A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be t…
-
Medium 4.0
Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit
Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.
-
Medium 6.1
Improper Restriction of Rendered UI Layers or Frames vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT…
-
Medium 6.5
A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to …
-
Medium 5.5
In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. T…
-
Medium 5.5
In ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This…
-
Medium 4.7
In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can over…
-
Medium 5.4
Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user con…
-
Medium 6.5
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have …
-
Medium 6.1
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could…
-
Medium 4.3
When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to…
-
Medium 4.3
Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers be…
-
Medium 6.5
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of …
-
Medium 6.1
If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the bro…
-
Medium 6.5
In onCreate of LogAccessDialogActivity.java, there is a possible way to bypass a permission check due to a tapjacking/o…
-
Medium 6.5
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue i…
-
Medium 6.1
AeroCMS v0.0.1 is vulnerable to ClickJacking.
-
Medium 4.8
The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers w…
-
Medium 5.4
IBM CICS TX clickjacking
IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch furth…
-
Medium 6.1
The issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Saf…
-
Medium 6.1
Hashicorp Boundary vulnerable to clickjacking
Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site.
-
Medium 6.4
Improper Restriction of Rendered UI Layers or Frames in notrinos/notrinoserp
Improper Restriction of Rendered UI Layers or Frames in GitHub repository notrinos/notrinoserp prior to 0.7.
-
Medium 5.4
Cisco Webex Meetings Web Interface Vulnerabilities
Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface. For more information about these vulnerabilitie…
-
Medium 5.4
Cisco Webex Meetings Web Interface Vulnerabilities
Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface. For more information about these vulnerabilitie…
-
Medium 4.8
A vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the u…
-
Medium 4.8
A vulnerable code in onCreate of BluetoothScanDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the use…
-
Medium 6.5
ICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or Frames
The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clickjacking attacks.
-
Medium 4.3
Clickjacking in the web console
In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.
-
Medium 5.4
Ucweb UC Browser HTML URL improper restriction of rendered ui layers
A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers (URL). It i…
-
Medium 4.6
In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue d…
-
Medium 6.1
Improper Restriction of Rendered UI Layers or Frames in Sylius
Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays…
-
Medium 6.1
Spoofing attack in swagger-ui-dist
The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's cli…
-
Medium 6.9
Dell EMC AppSync versions 3.9 to 4.3 contain a clickjacking vulnerability in AppSync. A remote unauthenticated attacker…
-
Medium 5.0
Clickjacking Vulnerability
A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, suc…
-
Medium 4.7
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an attacker may take advantage of by sending a link to an administrator that frames the router’s management portal and coul…
-
Medium 5.4
Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin
grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames
-
Medium 6.5
Improper Restriction of Rendered UI Layers or Frames in yourls/yourls
yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames
-
Medium 5.9
Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb
LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.