CWE-1021 Improper Restriction of Rendered UI Layers or Frames
baseThe web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (521)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-45092US | critical9.8 | Exploit | ||
Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter. | ||||
| CVE-2002-1217US | high7.5 | Exploit | ||
Cross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or c… | ||||
| CVE-2021-21132US | critical9.6 | — | ||
Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Extension. | ||||
| CVE-2021-0433US | high8.0 | Exploit | ||
In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a tapjacking/overlay attack. This could lead to loc… | ||||
| CVE-2021-39692US | high7.8 | Exploit | ||
In onCreate of SetupLayoutActivity.java, there is a possible way to setup a work profile bypassing user consent due to a tapjacking/overlay attack. This could lead to local escalat… | ||||
| CVE-2021-0586US | high7.8 | Exploit | ||
In onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an unwanted bluetooth device due to a tapjacking/overlay attack. This could lead to lo… | ||||
| CVE-2021-0391US | high7.8 | Exploit | ||
In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/overlay attack. This coul… | ||||
| CVE-2021-0302US | high7.8 | Exploit | ||
In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional exe… | ||||
| CVE-2020-0394US | high7.8OT erhöht | Exploit | ||
In onCreate of BluetoothPairingDialog.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege and untrusted d… | ||||
| CVE-2002-0440US | high7.5 | Exploit | ||
Trend Micro InterScan VirusWall HTTP proxy 3.6 with the "Skip scanning if Content-length equals 0" option enabled allows malicious web servers to bypass content scanning via a Cont… | ||||
| CVE-2000-1244US | high7.5 | Exploit | ||
Computer Associates InoculateIT Agent for Exchange Server does not recognize an e-mail virus attachment if the SMTP header is missing the "From" field, which allows remote attacker… | ||||
| CVE-2021-4140US | critical10.0 | — | ||
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.… | ||||
| CVE-2021-0954US | high7.3 | Exploit | ||
In ResolverActivity, there is a possible user interaction bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges… | ||||
| CVE-2021-43048US | critical9.8 | — | ||
The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain a vulnerability that theoretically allows an unauthenticated attacker with n… | ||||
| CVE-2021-0506US | high7.3 | Exploit | ||
In ActivityPicker.java, there is a possible bypass of user interaction in intent resolution due to a tapjacking/overlay attack. This could lead to local escalation of privilege wit… | ||||
| CVE-2021-23274US | critical9.8 | — | ||
The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theore… | ||||
| CVE-2021-0333US | high7.3 | Exploit | ||
In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay that obscures the phonebook permissions dialog when a Bluetooth… | ||||
| CVE-2021-0331US | high7.3 | Exploit | ||
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure default value. This could lead to local escalation of privilege an… | ||||
| CVE-2021-0314US | high7.3 | Exploit | ||
In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay attack. This could lead to local escalatio… | ||||
| CVE-2021-0315US | high7.3 | Exploit | ||
In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to convince the user to grant an app access to an account due to a tapjacking/overlay attack. This c… | ||||
03
Angriffsmuster (7)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan