Weakness (CWE)
CWE-1021: Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
How to prevent it (4 mitigations)
-
Implementation
Use the "frame-ancestors" directive in the Content Security Policy, which is intended to define restrictions when it comes to allowing embedded content [REF-1544].
-
Implementation
The use of X-Frame-Options (now partially obsolete as of September 2026 [REF-1545]) allows developers of web content to restrict the usage of their application within the form of overlays, frames, or iFrames. The developer can indicate from which domains can frame the content.
The concept of X-Frame-Options is well documented, but implementation of this protection mechanism is in development to cover gaps; often, there is a need for allowing frames from multiple domains.
-
Implementation
Use a "frame-breaker" script in each page that should not be framed. This is very helpful for legacy browsers that do not support the X-Frame-Options security feature previously mentioned (which is now partially obsolete).
-
Implementation
In addition to frames or iframes as previously mentioned, the web application is expected to place restrictions on whether it is allowed to be rendered within objects, embed, or applet elements.
Source: MITRE CWE-1021
247 results · Feed
-
Medium 5.4
WordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerability
Improper Restriction of Rendered UI Layers or Frames vulnerability in Automattic Jetpack allows Clickjacking.This issue affects Jetpack: from n/a before 12.7.
-
Medium 6.5
Welotec: Clickjacking Vulnerability in WebUI
An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames.
-
Medium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
High 7.5
Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption …
-
Medium 6.5
Clickjacking in your_spotify
your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version < 1.9.0 does not prevent other pages from displaying it in an iframe and is thus vulnerable to clickjacking. Clickjacking can be used to trick an existing user of Your…
-
Medium 4.3
Microsoft Edge for Android Spoofing Vulnerability
Microsoft Edge for Android Spoofing Vulnerability
-
Medium 6.4
Clickjacking vulnerability in Sunny Webbox
Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack on Sunny WebBox firmware version 1.6.1 and earlier.
-
Medium 6.1
A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user…
-
Medium 4.8
HCL Sametime is impacted by clickjacking
Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect users from clickjacking attacks.
-
Medium 6.3
Cross-Frame Scripting (XFS) on Plone CMS
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element.
-
Medium 4.7
The issue was addressed with improved UI handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1.…
-
Medium 5.3
OnCell G3150A-LTE Series: Clickjacking Vulnerability
A clickjacking vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. This vulnerability is caused by incorrectly restricts frame objects, which can lead to user confusion about which interface the user is interacting …
-
Medium 6.1
Stackrox: missing http security headers allows for clickjacking in web ui
In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attac…
-
Medium 4.3
Improper restriction of rendered UI layers or frames could lead to clickjacking attack
An Improper Restriction of Rendered UI Layers or Frames in the Schweitzer Engineering Laboratories SEL-411L could allow an unauthenticated attacker to perform clickjacking based attacks against an authenticated and authorized user. See product Instruction Man…
-
Medium 6.5
Quay: clickjacking on config-editor page severity
A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page. During the pentest, it has been detected t…
-
Medium 6.1
Clickjacking vulnerability in SAP Enable Now
In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not implemented, allowing an unauthenticated attacker to attempt clickjacking, which could result in disc…
-
High 8.8
Lack of XFO header allows clickjacking in Home Assistant Core
Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and correlating headers fa…
-
Medium 4.3
Improper Restriction of Rendered UI Layers or Frames in RDT400 in SICK APU allows an unprivileged remote attacker to po…
-
Medium 6.5CVE-2023-38873 Public exploit
Economizzer vulnerable to Clickjacking
The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or…
-
Low 3.9
Spoofing User's Activity Loads in WARP Mobile Client (Android)
Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to trick the …
-
Medium 4.3
ioLogik 4000 Series: Session Headers Not Implemented
A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, potentially exposing users to security risks. This vulnerability may allow attackers to trick users into interacting with malicious content, leading t…
-
Unscored —
Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFS…
-
Medium 4.3
KNIME Hub Web Application is vulnerable to clickjacking
Missing HTTP headers (X-Frame-Options, Content-Security-Policy) in KNIME Business Hub before 1.4.0 has left users vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into cl…
-
Low 2.6
An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions star…
-
Medium 4.3
The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potent…
-
Medium 5.4
A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser i…
-
Medium 4.3
By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potent…
-
Medium 6.5
A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be t…
-
High 8.4
Improper Restriction of Rendered UI Layers or Frames in unilogies/bumsys
Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2.
-
Medium 4.0
Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit
Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.
-
Medium 6.1
Improper Restriction of Rendered UI Layers or Frames vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT…
-
Medium 6.5
A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to …
-
High 7.8
In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into en…
-
Medium 5.5
In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. T…
-
Medium 5.5
In ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This…
-
Medium 4.7
In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can over…
-
Low 3.1
Improper Restriction of Rendered UI Layers or Frames in pyload/pyload
Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.
-
Medium 5.4
Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user con…
-
Medium 6.5
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have …
-
Medium 6.1
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could…