IBM Sterling B2B Integrator Clickjacking Vulnerability

IBM Sterling B2B Integrator is a suite of software that integrates essential B2B processes, transactions and relationships. IBM Sterling B2B Integrator suffers from a security vulnerability that allows a remote attacker to hijack a user's click-to-action by sending a specially crafted HTTP reques...

CVE-2015-2917

Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a 1 FRAM...

Design/Logic Flaw

Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a 1 FRAM...

CVE-2015-2917

The CVE-2015-2917 entry affects Securifi Almond devices and Almond 2015 devices where the web management interface omits the X-Frame-Options header, enabling clickjacking via crafted pages using FRAME/IFRAME/OBJECT. Root cause: missing X-Frame-Options header in affected firmware before AL1-R201EX...

CVE-2015-2917

Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a 1 FRAM...

CVE-2015-2917: Improper Input Validation

Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a 1 FRAM...

PT-2015-5975

Name of the Vulnerable Software and Affected Versions Securifi Almond devices with firmware prior to AL1-R201EXP10-L304-W34 Securifi Almond-2015 devices with firmware prior to AL2-R088M Description The issue makes it easier for remote attackers to conduct clickjacking attacks via a crafted web si...

Orient Technologies Studio for OrientDB Server Community Edition Clickjacking Vulnerability

Orient Technologies Studio for OrientDB Server Community Edition is a community edition of OrientDB Server from Orient Technologies, UK. Orient Technologies Studio for OrientDB Server Community Edition fails to enforce the same-origin policy by default in the X-Frame-Options response header,...

Securifi Almond Access Restriction Bypass Vulnerability

Securifi Almond is a wireless router product from Securifi. The Securifi Almond 2015's web management interface does not enforce the same-origin policy in the X-Frame-Options response header, allowing remote attackers to exploit specially crafted web pages that can be used for clickjacking attack...

Coinbase: OAUTH pemission set as true= lead to authorize malicious application

OAuth authorize button in the Coinbase Android App did not have the android:filterTouchesWhenObscured attribute set to true, which may have made it vulnerable to tap-jacking. Reported UI Redressing Clickjacking For Mobile application of Coinbase , attack scenario is same as...

OrientDB and Studio prior to version 2.1.1 contain multiple vulnerabilities

Overview Studio for OrientDB Server Community Edition version prior to version 2.1.1 contains several vulnerabilities. Description CWE-352: Cross-Site Request Forgery CSRF - CVE-2015-2912The Studio web interface to OrientDB contains a CSRF vulnerability. An attacker can perform actions with the...

X (Formerly Twitter): Highly wormable clickjacking in player card

Hi, I would like to report an issue where player card is vulnerable to clickjacking in certain browsers. This may result in something similar to XSS worm and many other critical damages. Details Twitter Player Card allows a website to embed a custom playerhtml into an iframe in a tweet. There are...

Web Application Potentially Vulnerable to Clickjacking

The remote web server does not set an X-Frame-Options response header or a Content-Security-Policy 'frame-ancestors' response header in all content responses. This could potentially expose the site to a clickjacking or UI redress attack, in which an attacker can trick a user into clicking an area...

Clickjacking

Overview Affected versions of this package are vulnerable to Clickjacking. By enabling the SVG setting without taking other precautions, you might expose your application to click-hijacking attacks. In these attacks, sanitized SVG elements could be positioned outside of the containing element and...

CVE-2015-1980

IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors...

Code injection

IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors...

CVE-2015-1980

IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors...

CVE-2015-1980

IBM InfoSphere Master Data Management - Collaborative Edition vulnerable to clickjacking on versions 9.1, 10.1, 11.0, 11.3, 11.4 prior to FP03. Exploitation could allow remote authenticated users to hijack the victim’s click actions via crafted HTTP requests or malicious sites. Affected versions ...

PT-2015-5528

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Master Data Management Collaborative Edition versions 9.1 through 11.4 before FP03 Description The issue allows remote authenticated users to conduct clickjacking attacks. Recommendations For versions 9.1 through 11.4 before FP0...

CVE-2015-1980: Improper Input Validation

IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors...