web-console: XSS in OAuth server /oauth/token/request endpoint

A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction ...

Shopify: Clickjacking in [exchangemarketplace.com]

Hi Team, Summary: X-Frame-Options ALLOW-FROM https://exchangemarketplace.com not supported by several Browser, this caused Clickjacking on https://exchangemarketplace.com Type of issue : Clickjacking Description: Clickjacking User Interface redress attack, UI redress attack, UI redressing is a...

Cloud Foundry UAA Input Validation Error Vulnerability

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry cloud platform from the Cloud Foundry Foundation in the United States. A security vulnerability exists in Cloud Foundry UAA versions prior to 73.4.0 that stems from the program not setting the X-FRAME-OPTIONS...

CVE-2019-3794

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites...

CVE-2019-3794

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites...

CVE-2019-3794: Improper Access Control

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites...

PT-2019-16724

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 73.4.0 Description The issue allows a remote user to perform clickjacking attacks on UAA's frontend sites due to the absence of an X-FRAME-OPTIONS header on various endpoints. Recommendations For versions...

X (Formerly Twitter): Twitter Periscope Clickjacking Vulnerability

Bonjour, Summary X-Frame-Options ALLOW-FROM https://twitter.com/ not supported by several Browser, this caused Clickjacking on Twitter Periscope subdomain https://canary-web.pscp.tv & https://canary-web.periscope.tv Steps To Reproduce: 1. Create a new HTML file 2. Put 3. Save the file 4. Open...

Cuvva: Clickjacking in ops.cuvva.com

Hi, Description: Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking contr...

Clickjacking Attack

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2012-1948,...

Passit: URL is vulnerable to clickjacking https://app.passit.io/

URLs do not have X-FRAME-OPTIONS set to DENY or SAMEORIGIN, and they are vulnerable to clickjacking. Reproduce steps: 1. enter your credentials and click on stay logged into this device then login 2. Run under the browser's code and you will see that the listed links are vulnerable to clickjackin...

CVE-2019-3876

A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction ...

ADM Click Jack Vulnerability: X-Frame-Option/ Content-Security-Policy's frame ancestor entry missing

Vulnerability scanner detecting HTTP Click-Jacking vulnerability on the ADM management IP as the response from the ADM is missing theX-Frame-Options or the Content-Security-Policy’s frame ancestor option...

Clickjacking vulnerability in Monitoring Plugin

Monitoring Plugin did not set the X-Frame-Options header, allowing its pages to be embedded. This could result in clickjacking attacks. Monitoring Plugin now sets the X-Frame-Options header to sameorigin, preventing embedding...

Improper Restriction of Rendered UI Layers or Frames in Apache nifif

The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on...

GHSA-2XPP-75VR-22VQ Improper Restriction of Rendered UI Layers or Frames in Apache nifif

The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on...

Clickjacking Attack

nifi-web-api is vulnerable to clickjacking attacks. The vulnerability exists due to the way the X-Frame-Options headers were inconsistently applied on HTTP responses. This results in different outcomes such as duplicate, or missing security headers, causing some browsers to insecurely interpret t...

CVE-2018-17192

The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on...

Design/Logic Flaw

The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on...

CVE-2018-17192

CVE-2018-17192 affects Apache NiFi where the X-Frame-Options headers were inconsistently applied on HTTP responses, leading to duplicate or missing security headers and potential clickjacking. The issue is documented across multiple sources, with mitigations indicating that a fix was applied in N...