SAP Utility Customer E-Services Clickjacking Vulnerability

SAP Utility Customer E-Services is a j2ee-based Web application. A clickjacking vulnerability exists in SAP Utility Customer E-Services, which could be exploited by an attacker to compromise an affected application or gain access to sensitive information...

Legal Robot: Clickjacking: X-Frame-Options header missing

Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their...

IBM Financial Transaction Manager Clickjacking Vulnerability

IBM Financial Transaction Manager FTM is a financial transaction manager from IBM Corporation in the United States that is used to monitor, track and report on financial payments and transactions. A clickjacking vulnerability exists in IBM Financial Transaction Manager FTM versions 3.0.0.0 throug...

IBM Jazz Reporting Service Clickjacking Vulnerability

IBM Jazz Reporting Service JRS is a suite of IBM USA applications for discovering cross-project reports that can be used in integration with IBM Rational CLM's Rational solution for managing all lifecycles of a development project. CLM users can access reports provided by JRS in dashboards,...

Cybozu Mailwise Clickjacking Vulnerability

Cybozu Mailwise is a Web-based e-mail system from Cybozu. A clickjacking vulnerability exists in Cybozu Mailwise versions 5.0.0 through 5.3.2. An attacker could exploit this vulnerability to compromise an affected application and obtain sensitive information...

Cybozu Mailwise contains issue in preventing clickjacking attacks

Overview Cybozu Mailwise contains multiple pages for editing/sending bulk emails. Some of these pages fail to protect against clickjacking attacks. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the...

openSUSE Security Update : hawk2 (openSUSE-2016-971)

This update for hawk2 fixes one security issue and one bug. The following security change is included : - To prevent Clickjacking attacks, set Content-Security-Policy to frame-ancestors 'self' bsc984619 The following non-security issue was fixed : - In the Wizards UI, prevent text display issues...

JVN#04125292: Cybozu Mailwise contains issue in preventing clickjacking attacks

Cybozu Mailwise contains multiple pages for editing/sending bulk emails. Some of these pages fail to protect against clickjacking attacks. Impact If a user views a malicious page while logged in, the user may be tricked into conducting unintended operations. Solution Update the Software Update to...

openSUSE: Security Advisory for hawk2 (openSUSE-SU-2016:2028-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for hawk2 (important)

This update for hawk2 fixes one security issue and one bug. The following security change is included: - To prevent Clickjacking attacks, set Content-Security-Policy to frame-ancestors 'self' bsc984619 The following non-security issue was fixed: - In the Wizards UI, prevent text display issues du...

CVE-2016-1474

Cisco Prime Infrastructure 2.22 does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka Bug ID CSCuw65846, a different...

CVE-2016-1474

Cisco Prime Infrastructure 2.22 does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka Bug ID CSCuw65846, a different...

Cross site scripting

Cisco Prime Infrastructure 2.22 does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka Bug ID CSCuw65846, a different...

CVE-2016-1474

CVE-2016-1474 affects Cisco Prime Infrastructure 2.2(2). The vulnerability is a cross-frame scripting (XFS) issue caused by insufficient iframe protections, enabling an unauthenticated, remote attacker to perform clickjacking and related client-side attacks via a crafted page. The issue is docume...

CVE-2016-1474

Cisco Prime Infrastructure 2.22 does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka Bug ID CSCuw65846, a different...

OrientDB Server < 2.0.15, 2.1.x < 2.1.1 Clickjacking Vulnerability

OrientDB server is prone to a clickjacking vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:orientdb:orientdb";...

Cisco Prime Infrastructure Cross-Frame Scripting Vulnerability

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user to a...

SUSE-SU-2016:1946-1 Security update for hawk2

This update for hawk2 fixes one security issue and one bug. The following security change is included: - To prevent Clickjacking attacks, set Content-Security-Policy to frame-ancestors 'self' bsc984619 The following non-security issue was fixed: - In the Wizards UI, prevent text display issues du...

X (Formerly Twitter): Stealing User emails by clickjacking cards.twitter.com/xxx/xxx

Hello In twitter you can create cards to generate leads. For example: https://twitter.com/i/cards/tfw/v1/759046372544741376?cardname=promotion&autoplaydisabled=true&earned=true&lang=en&cardheight=357 If you visit the above URL and click the button your email and username is sent to my domain. Sin...

Unspecified Vulnerability in F-Secure SAFE for Mac

F-Secure SAFE for Mac is a suite of antivirus software for Mac from the Finnish company F-Secure. A security vulnerability exists in F-Secure SAFE for Mac versions 15.0 through 16.1. An attacker can exploit the vulnerability to send bank security notices on non-banking websites, bypass browser...