628 matches found
CVE-2016-9168
A missing X-Frame-Options header in the NDS Utility Monitor in NDSD in Novell eDirectory before 9.0.2 could be used by remote attackers for clickjacking...
CVE-2016-9168: Improper Input Validation
A missing X-Frame-Options header in the NDS Utility Monitor in NDSD in Novell eDirectory before 9.0.2 could be used by remote attackers for clickjacking...
PT-2017-9982
Name of the Vulnerable Software and Affected Versions Novell eDirectory versions prior to 9.0.2 Description A missing X-Frame-Options header in the NDS Utility Monitor in NDSD could be used by remote attackers for clickjacking. Recommendations For versions prior to 9.0.2, update to version 9.0.2 ...
CVE-2017-6504
WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking...
DEBIAN-CVE-2017-6504
WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking...
UBUNTU-CVE-2017-6504
WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking...
Code injection
WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking...
CVE-2017-6504
WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking...
CVE-2017-6504
WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking...
PT-2017-17117
Name of the Vulnerable Software and Affected Versions qBittorrent versions prior to 3.3.11 Description The issue is related to the WebUI in qBittorrent, where the X-Frame-Options header was not set, potentially leading to clickjacking. Recommendations For versions prior to 3.3.11, update to versi...
CVE-2017-6504: Improper Input Validation
WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking...
WebSummit: found a vulnerability in your website
the vulnerability in your website is something called clickjacking or x-frame options header not set . when X-frame options header is not included in the HTTP the attacker can attack your website by clickjacking. so what is x-frame options? The X-Frame-Options HTTP response header can be used to...
Legal Robot: Clickjacking: X-Frame-Options header missing
Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their...
activemq: Clickjacking in Web Console
It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console...
Radancy: Application error message
Attack details HTTP Header input X-Forwarded-For was set to 12345'"'";|%00%0d%0a%bf%27'??? Error message found: Warning: inetpton function.inet-pton: Unrecognized address 12345'"\'\";|%00%0d%0a%00%bf%27' in...
Zomato: Clickjacking login page of http://book.zomato.com/
The login page on book.zomato.com http://book.zomato.com/account/login.aspx is vulnerable to a clickjacking attack. Reproduction steps: 1. Paste the following HTML into a text editor and save the file as .html 2. Open the file in a web browser 3. Note that the iframe appears with the login page...
Apache ActiveMQ XSS
The vulnerability of the Apache ActiveMQ software platform’s web console is related to errors in sending the X-Frame-Options HTTP header. Exploiting this vulnerability allows a malicious actor to deploy malicious elements on a website and force users to activate them through specially crafted web...
WS-2016-7073
Http server in Apache Hadoop versions 2.2.0 to 2.7.7, 2.8.1 to 3.0.0-alpha1 are vulnerable to clickjacking by setting an X-Frame-Options response header in all content responses...
Uber: developer.uber.com/404 and developer.uber.com/docs/404 are susceptible to iframes
Issue You can iframe the error pages for https://developer.uber.com/404 and https://developer.uber.com/docs/404 Proof of concept An example can be found here http://codepen.io/JacobReynolds/pen/VaMbde?editors=1010 Impact There is not a large security impact from a cursory glance at the 404 pages...