CVE-2021-25938

In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting XSS, since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named to. There is no X-Frame-Options Header set, which makes it more susceptible for...

PT-2021-16866

Name of the Vulnerable Software and Affected Versions ArangoDB versions v2.2.6.2 through v3.7.10 Description The issue is related to Cross-Site Scripting XSS due to the lack of validation of the .zip file name and filtering of potential abusive characters in zip file names. Additionally, the...

Cross site scripting

Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie...

CVE-2020-35592

CVE-2020-35592 affects Pi-hole 5.0, 5.1, and 5.1.1. A reflected XSS flaw arises from insufficient sanitization of user-supplied data in the Options header forwarded to the admin/ URI, enabling a remote attacker to inject arbitrary web script or HTML and potentially steal the session cookie. The d...

PT-2021-11811

Name of the Vulnerable Software and Affected Versions: Pi-hole versions 5.0 through 5.1.1 Description: The issue allows a remote user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data, achieving a Reflected Cross-Site Scripting attack against other users a...

CVE-2020-35592: Improper Neutralization of Input During Web Page Generation

Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie...

Pi-hole 跨站脚本漏洞

Pi-hole is a multi-platform, network-wide ad-blocking tool. A cross-site scripting vulnerability exists in Pi-hole 5.0, 5.1, 5.1.1. The vulnerability stems from insufficient validation of user-supplied data. An attacker can exploit this vulnerability to inject arbitrary web script or HTML via the...

CVE-2021-21444

SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nullify the added X-Frame-Options header leading to Clickjacking attack...

CVE-2020-13174

The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which could allow an attacker to trick a user into clicking a malicious link via clickjacking...

CVE-2019-19089

For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displayed as different content type other than declared. A possible attack scenario would be unauthorized code execution via text...

CVE-2018-6909

CVE-2018-6909 affects Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 Web Application. Root cause: missing X-Frame-Options header. Impact: allows clickjacking by remote attacker via an API page request; CVSSv3 base score 6.5 (NETWORK, LOW toward exploitation, user interactio...

CVE-2018-6909: Improper Restriction of Rendered UI Layers or Frames

A missing X-Frame-Options header in the Green Electronics RainMachine Mini-8 2nd Generation and Touch HD 12 web application could be used by a remote attacker for clickjacking, as demonstrated by triggering an API page request...

PT-2018-17817

Name of the Vulnerable Software and Affected Versions Green Electronics RainMachine Mini-8 2nd Generation and Touch HD 12 affected versions not specified Description A missing X-Frame-Options header in the web application could be used by a remote attacker for clickjacking, as demonstrated by...

A sample to set http response header X-Frame-Options by rewrite policy

A sample to set http response header X-Frame-Options by rewrite policy on vpn vserver...

Windows DoS

The vulnerability of the TCP protocol in the Windows operating system allows a malicious actor to induce a service failure by creating TCP packets that contain incorrect data fields in the “Options” header...

CVE-2016-0734

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2 IFRAME element...

AS/WildFly: missing X-Frame-Options header leading to clickjacking

It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...

AS/WildFly: missing X-Frame-Options header leading to clickjacking

It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...

AS/WildFly: missing X-Frame-Options header leading to clickjacking

It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...

IBM License Metric Tool and Endpoint Manager for Software Use Analysis Clickjacking Vulnerability

IBM License Metric Tool is a free tool that helps IBM Passport Advantage customers determine their processor value unit PVU licensing needs; IBM Endpoint Manager for Software Use Analysis is a solution that enables overall software asset management by accurately discovering whether software in al...