6239 matches found
PT-2015-3042
Name of the Vulnerable Software and Affected Versions Cisco Firepower Extensible Operating System version 1.11.160 Description The web interface in Cisco Firepower Extensible Operating System does not properly restrict the use of IFRAME elements. This makes it easier for remote attackers to condu...
CVE-2015-6374: Improper Input Validation
The web interface in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, aka Bug ID...
Cisco Firepower 9000 Series Switch Clickjacking Vulnerability
A vulnerability in the web interface of the Cisco Firepower 9000 Series Switch could allow an unauthenticated, remote attacker to affect the integrity of the device though a clickjacking or phishing attack. The vulnerability is due to the lack of proper input sanitization of iFrame data in the HT...
Android Browser应用程序拒绝服务漏洞
Android 4.0.3浏览器应用不正确处理特殊的URI，允许攻击者在IFRAME元素SRC属性中使用特制的market: URI并诱使应用程序解析，可使应用程序崩溃。 测试方法 var mframe = ""; forvar i = 0; i...
CVE-2007-5896
Mozilla Firefox 2.0.0.9 allows remote attackers to cause a denial of service CPU consumption and crash via an iframe with Javascript that sets the document.location to contain a leading NULL byte \x00 and a 1 res://, 2 about:config, or 3 file:/// URI...
Red Hat Enterprise Application Platform Clickjacking Attack Vulnerability
Red Hat Enterprise Application Platform is the United States Red Hat Red Hat, Inc. of a set of open source, J2EE-based middleware platform, which is mainly used to build, deploy and host Java applications and services. A clickjacking attack vulnerability exists in Red Hat Enterprise Application...
AS/WildFly: missing X-Frame-Options header leading to clickjacking
It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...
AS/WildFly: missing X-Frame-Options header leading to clickjacking
It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...
Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.4 update
Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.4 and fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. Common...
AS/WildFly: missing X-Frame-Options header leading to clickjacking
It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...
CVE-2015-1303
Removed by vendor...
CVE-2015-1303: Improper Input Validation
bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME...
chromium-browser: Cross-origin bypass in DOM
bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME...
UBUNTU-CVE-2015-1303
bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME...
X2Engine 4.2 Cross Site Request Forgery
Vulnerability title: Cross-Site Request Forgery In X2Engine Inc. X2Engine CVE: CVE-2015-5075 Vendor: X2Engine Inc. Product: X2Engine Affected version: 4.2 Fixed version: 5.2 Reported by: Simone Quatrini Details: It was discovered that no protection against Cross-site Request Forgery attacks was...
X2Engine 4.2 - Cross-Site Request Forgery
X2Engine 4.2 - Cross-Site Request Forgery Source: https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-5075/ Details: It was discovered that no protection against Cross-site Request Forgery attacks was implemented, resulting in an attacker being able to...
PT-2015-2317
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 45.0.2454.101 Opera affected versions not specified Description The issue exists due to insufficient input validation in the Blink component of Google Chrome. Exploitation can allow a remote attacker to bypass...
CVE-2015-2917: Improper Input Validation
Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a 1 FRAM...
hedgeconnection.com IFRAME Injection vulnerability
Vulnerable URL: http://www.hedgeconnection.com/atlas/jump.php?url=http://xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 08:10 GMT Vulnerability type:| IFRAME Injection Vulnerability status:| Publicly disclosed Alexa Rank| 1621899...