Android Overlay and Accessibility Features Leave Millions at Risk

University researchers are warning that two features, not flaws, core to Google’s Android mobile operating system can be used together to launch clickjacking attacks to gain control of a target’s phone. The discovery was made by researchers at Georgia Institute of Technology, who call the researc...

Cuvva: https://admin.corp.cuvva.co/ is vulnerable to Clickjacking attacks due to missing X-Frame-Options

Description: I found the resource on https://admin.corp.cuvva.co/, which can be vulnerable to the Clickjacking. Impact The resource without X-Frame-Options potentially vulnerable to the Clickjacking. The vulnerability exist only for authenticated users possible UI redressing in the Dashboard...

WordPress: Clickjacking wordcamp.org

Hello Security, Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking contro...

CVE-2017-4015

Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote authenticated users to inject arbitrary web script or HTML via HTTP response header...

CVE-2017-4015

Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote authenticated users to inject arbitrary web script or HTML via HTTP response header...

Design/Logic Flaw

Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote authenticated users to inject arbitrary web script or HTML via HTTP response header...

CVE-2017-4015

Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote authenticated users to inject arbitrary web script or HTML via HTTP response header...

CVE-2017-4015

CVE-2017-4015 affects McAfee Network Data Loss Prevention (NDLP) 9.3.x. A remote authenticated attacker can hijack the victim’s click actions by sending specially crafted HTTP response headers to inject arbitrary web scripts/HTML. Root cause: improper validation of user-supplied HTTP response hea...

BSA-2017-279

Security Advisory ID : BSA-2017-279 Component : JBOSS Revision : 2.0: Interim The Management Console in Red Hat Enterprise Application Platform before 6.4.4 andWildFlyformerlyJBossApplication Server does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduc...

CVE-2017-4015: Improper Restriction of Rendered UI Layers or Frames

Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote authenticated users to inject arbitrary web script or HTML via HTTP response header...

Kerio Connect and Kerio Connect Client for Windows and Mac Clickjacking Vulnerability

Kerio Connect is a professional mail mail server setup software.Kerio Connect Client for Windows and Mac is a desktop application for Windows and Mac with features to manage email, chat messages, calendar, contacts, tasks and notes. A security vulnerability exists in Kerio Connect versions 8.0.0...

Yelp: User can be fooled to Bookmark any restaurant by clickjacking

In this report https://hackerone.com/reports/214087 you people said the clickjacking issue is fixed but i have found another issue of clickjacking. Using clickjacking attacker can fooled an user to bookmark n numbers of restuarants. I am attaching a PoC video , watch the video...

Yelp: ClickJacking in editing business name

SUMMARY: Hope you guys are doing great. I found clickjacking vulnerability while updating business page.One of the endpoints which is vulnerable to clickjacking is https://www.yelp.com/bizattribute?bizid=RIyHYSf3lyJcFb4El9T4tQ . Clickjacking User Interface redress attack, UI redress attack, UI...

Clickjacking Attacks

github.com/sensu/uchiwa is vulnerable to clickjacking attacks. The vulnerability exists due to the lack of X-Frame-Options header in the HTTP responses sent by the web server...

Code injection

Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjacking attacks via a crafted e-mail message...

CVE-2017-7440

Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjacking attacks via a crafted e-mail message...

CVE-2017-7440

Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjacking attacks via a crafted e-mail message...

CVE-2017-7440

Kerio Connect (versions 8.0.0–9.2.2) and Kerio Connect Client (Windows/Mac, versions 9.2.0–9.2.2) are affected by a clickjacking vulnerability when email preview is enabled. A remote attacker could exploit a specially crafted email to perform clickjacking. Impact is described as enabling (partial...

CVE-2017-7440

Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjacking attacks via a crafted e-mail message...

CVE-2017-7440

Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjacking attacks via a crafted e-mail message...