# CWE-1021.

Every Advisory and CVE whose sources give the weakness CWE-1021, newest first.

## Records, newest first (an older page)

- [Clickjacking in Mozilla Firefox and others](https://agentprime.io/advisories/CVE-2023-25730.md)
  `CVE-2023-25730` · CVE record: Mozilla Firefox and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 2 Jun 2023 · Tags: CWE-1021
- [Clickjacking in Schneider Electric NetBotz 4 - 355/450/455/550/570](https://agentprime.io/advisories/CVE-2022-43378.md)
  `CVE-2022-43378` · CVE record: Schneider Electric NetBotz 4 - 355/450/455/550/570 · CVSS 6.5 Medium · Not analysed yet · Published 18 Apr 2023 · Tags: CWE-1021
- [Improper Restriction of Rendered UI Layers or Frames in unilogies/bumsys](https://agentprime.io/advisories/CVE-2023-1362.md)
  `CVE-2023-1362` · CVE record: unilogies unilogies/bumsys · CVSS 8.4 High · Not analysed yet · Published 13 Mar 2023 · Tags: CWE-1021
- [Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit](https://agentprime.io/advisories/GHSA-gm7m-rqf8-jx4m.md)
  `GHSA-gm7m-rqf8-jx4m`, `CVE-2023-0780`, `PKSA-ch6m-qfpx-wtvr` · Packagist `cockpit-hq/cockpit`: affected `<2.3.9`, fixed in `2.3.9` · CVSS 4.0 Medium · Not analysed yet · Published 11 Feb 2023 · Tags: CWE-1021
- [Clickjacking in Mitsubishi Electric Corporation GOT2000 Series GT27 model and others](https://agentprime.io/advisories/CVE-2022-40268.md)
  `CVE-2022-40268` · CVE record: Mitsubishi Electric Corporation GOT2000 Series GT27 model and 2 more · CVSS 6.1 Medium · Not analysed yet · Published 2 Feb 2023 · Tags: CWE-1021
- [Clickjacking in Schneider Electric Conext™ ComBox](https://agentprime.io/advisories/CVE-2022-32517.md)
  `CVE-2022-32517` · CVE record: Schneider Electric Conext™ ComBox · CVSS 6.5 Medium · Not analysed yet · Published 30 Jan 2023 · Tags: CWE-1021
- [Clickjacking in Android](https://agentprime.io/advisories/CVE-2023-20913.md)
  `CVE-2023-20913` · CVE record: Android · CVSS 7.8 High · Not analysed yet · Published 24 Jan 2023 · Tags: CWE-1021
- [Clickjacking in Android](https://agentprime.io/advisories/CVE-2022-20215.md)
  `CVE-2022-20215` · CVE record: Android · CVSS 5.5 Medium · Not analysed yet · Published 24 Jan 2023 · Tags: CWE-1021
- [Clickjacking in Android](https://agentprime.io/advisories/CVE-2022-20214.md)
  `CVE-2022-20214` · CVE record: Android · CVSS 4.7 Medium · Not analysed yet · Published 24 Jan 2023 · Tags: CWE-1021
- [Clickjacking in Android](https://agentprime.io/advisories/CVE-2022-20213.md)
  `CVE-2022-20213` · CVE record: Android · CVSS 5.5 Medium · Not analysed yet · Published 24 Jan 2023 · Tags: CWE-1021
- [pyLoad vulnerable to Improper Restriction of Rendered UI Layers or Frames](https://agentprime.io/advisories/GHSA-h8r9-467r-vjjf.md)
  `GHSA-h8r9-467r-vjjf`, `CVE-2023-0057`, `PYSEC-2026-904` · PyPI `pyload-ng`: affected `<0.5.0b3.dev33`, fixed in `0.5.0b3.dev33` · CVSS 3.1 Low · Not analysed yet · Published 5 Jan 2023 · Tags: CWE-1021
- [Clickjacking in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-45420.md)
  `CVE-2022-45420` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-1021
- [Clickjacking in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-45418.md)
  `CVE-2022-45418` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 6.1 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-1021
- [Clickjacking in Mozilla Firefox](https://agentprime.io/advisories/CVE-2022-45417.md)
  `CVE-2022-45417` · CVE record: Mozilla Firefox · CVSS 4.3 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-1021
- [Clickjacking in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-36319.md)
  `CVE-2022-36319` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 7.5 High · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-1021
- [Clickjacking in Mozilla Thunderbird](https://agentprime.io/advisories/CVE-2022-3034.md)
  `CVE-2022-3034` · CVE record: Mozilla Thunderbird · CVSS 4.3 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-1021
- [Clickjacking in Mozilla Thunderbird and others](https://agentprime.io/advisories/CVE-2022-29914.md)
  `CVE-2022-29914` · CVE record: Mozilla Thunderbird and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-1021
- [Clickjacking in Mozilla Thunderbird and others](https://agentprime.io/advisories/CVE-2022-29911.md)
  `CVE-2022-29911` · CVE record: Mozilla Thunderbird and 2 more · CVSS 6.1 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-1021
- [Clickjacking in Mozilla Thunderbird and others](https://agentprime.io/advisories/CVE-2022-28286.md)
  `CVE-2022-28286` · CVE record: Mozilla Thunderbird and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-1021
- [Clickjacking in Android](https://agentprime.io/advisories/CVE-2022-20553.md)
  `CVE-2022-20553` · CVE record: Android · CVSS 6.5 Medium · Not analysed yet · Published 16 Dec 2022 · Tags: CWE-1021
- [Clickjacking in Apple tvOS and others](https://agentprime.io/advisories/CVE-2022-46695.md)
  `CVE-2022-46695` · CVE record: Apple tvOS and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 15 Dec 2022 · Tags: CWE-1021
- [AeroCMS v0.0.1 is vulnerable to ClickJacking.](https://agentprime.io/advisories/CVE-2022-46061.md)
  `CVE-2022-46061` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 13 Dec 2022 · Tags: CWE-1021
- [Clickjacking in Android](https://agentprime.io/advisories/CVE-2022-20501.md)
  `CVE-2022-20501` · CVE record: Android · CVSS 7.3 High · Not analysed yet · Published 13 Dec 2022 · Tags: CWE-1021
- [Clickjacking in Android](https://agentprime.io/advisories/CVE-2022-20442.md)
  `CVE-2022-20442` · CVE record: Android · CVSS 7.3 High · Not analysed yet · Published 13 Dec 2022 · Tags: CWE-1021
- [Clickjacking in Openshift](https://agentprime.io/advisories/CVE-2022-3260.md)
  `CVE-2022-3260` · CVE record: Openshift · CVSS 4.8 Medium · Not analysed yet · Published 8 Dec 2022 · Tags: CWE-1021
- [IBM CICS TX clickjacking](https://agentprime.io/advisories/CVE-2022-34318.md)
  `CVE-2022-34318` · CVE record: IBM CICS TX · CVSS 5.4 Medium · Not analysed yet · Published 14 Nov 2022 · Tags: CWE-1021
- [Clickjacking in Apple macOS and others](https://agentprime.io/advisories/CVE-2022-42799.md)
  `CVE-2022-42799` · CVE record: Apple macOS and 2 more · CVSS 6.1 Medium · Not analysed yet · Published 1 Nov 2022 · Tags: CWE-1021
- [Hashicorp Boundary vulnerable to clickjacking](https://agentprime.io/advisories/GHSA-xqv2-3vvq-qg6r.md)
  `GHSA-xqv2-3vvq-qg6r`, `CVE-2022-36182` · Go `github.com/hashicorp/boundary`: affected `<=0.11.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 27 Oct 2022 · Tags: CWE-1021
- [rdiffweb vulnerable to Improper Restriction of Rendered UI Layers or Frames](https://agentprime.io/advisories/GHSA-m379-x4xc-38x9.md)
  `GHSA-m379-x4xc-38x9`, `CVE-2022-3167`, `PYSEC-2022-268` · PyPI `rdiffweb`: affected `<2.4.1`, fixed in `2.4.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2022 · Tags: CWE-1021
- [Improper Restriction of Rendered UI Layers or Frames in notrinos/notrinoserp](https://agentprime.io/advisories/CVE-2022-2965.md)
  `CVE-2022-2965` · CVE record: notrinos notrinos/notrinoserp · CVSS 6.4 Medium · Not analysed yet · Published 23 Aug 2022 · Tags: CWE-1021
- [Cisco Webex Meetings Web Interface Vulnerabilities](https://agentprime.io/advisories/CVE-2022-20820.md)
  `CVE-2022-20820` · CVE record: Cisco Cisco Webex Meetings · CVSS 5.4 Medium · Not analysed yet · Published 10 Aug 2022 · Tags: CWE-1021
- [Cisco Webex Meetings Web Interface Vulnerabilities](https://agentprime.io/advisories/CVE-2022-20852.md)
  `CVE-2022-20852` · CVE record: Cisco Cisco Webex Meetings · CVSS 5.4 Medium · Not analysed yet · Published 10 Aug 2022 · Tags: CWE-1021
- [Improper Restriction of Rendered UI Layers or Frames in openemr/openemr](https://agentprime.io/advisories/CVE-2022-2734.md)
  `CVE-2022-2734` · CVE record: openemr openemr/openemr · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Aug 2022 · Tags: CWE-1021
- [Clickjacking in Samsung Mobile Devices](https://agentprime.io/advisories/CVE-2022-33727.md)
  `CVE-2022-33727` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.8 Medium · Not analysed yet · Published 5 Aug 2022 · Tags: CWE-1021
- [Clickjacking in Samsung Mobile Devices](https://agentprime.io/advisories/CVE-2022-33723.md)
  `CVE-2022-33723` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.8 Medium · Not analysed yet · Published 5 Aug 2022 · Tags: CWE-1021
- [ICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or Frames](https://agentprime.io/advisories/CVE-2022-2179.md)
  `CVE-2022-2179` · CVE record: Rockwell Automation MicroLogix 1400 and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 20 Jul 2022 · Tags: CWE-1021
- [Apache Druid before 0.23.0 vulnerable to clickjacking](https://agentprime.io/advisories/GHSA-pgq7-jcj5-xx6h.md)
  `GHSA-pgq7-jcj5-xx6h`, `CVE-2022-28889` · Maven `org.apache.druid:druid`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 4.3 Medium · Not analysed yet · Published 8 Jul 2022 · Tags: CWE-1021
- [Ucweb UC Browser HTML URL improper restriction of rendered ui layers](https://agentprime.io/advisories/CVE-2017-20041.md)
  `CVE-2017-20041` · CVE record: Ucweb UC Browser · CVSS 5.4 Medium · Not analysed yet · Published 13 Jun 2022 · Tags: CWE-1021
- [EC-CUBE Improper Restriction of Rendered UI Layers or Frames](https://agentprime.io/advisories/GHSA-rwh8-h525-4jvj.md)
  `GHSA-rwh8-h525-4jvj`, `CVE-2020-5679`, `PKSA-v9zg-hvb2-3g6s` · Packagist `ec-cube/ec-cube`: affected `>=3.0.0, <=3.0.18`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 24 May 2022 · Tags: CWE-1021
- [Jenkins REST APIs vulnerable to clickjacking](https://agentprime.io/advisories/GHSA-7xp8-7wqx-5hqx.md)
  `GHSA-7xp8-7wqx-5hqx`, `BIT-jenkins-2020-2105`, `CVE-2020-2105` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.204.2 || >=2.205, <2.219`, fixed in `2.204.2`, `2.219` · CVSS 3.1 Low · Not analysed yet · Published 24 May 2022 · Tags: CWE-1021
- [Improper Restriction of Rendered UI Layers or Frames in polonel/trudesk](https://agentprime.io/advisories/CVE-2022-1803.md)
  `CVE-2022-1803` · CVE record: polonel polonel/trudesk · CVSS 8.4 High · Not analysed yet · Published 20 May 2022 · Tags: CWE-1021
- [Clickjacking in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2022-28649.md)
  `CVE-2022-28649` · CVE record: JetBrains YouTrack · CVSS 4.6 Medium · Not analysed yet · Published 5 Apr 2022 · Tags: CWE-1021
- [Improper Restriction of Rendered UI Layers or Frames in Sylius](https://agentprime.io/advisories/GHSA-4jp3-q2qm-9fmw.md)
  `GHSA-4jp3-q2qm-9fmw`, `CVE-2022-24733`, `PKSA-ftgj-pjx7-dswf` · Packagist `sylius/sylius`: affected `<1.9.10 || >=1.10.0, <1.10.11 || >=1.11.0, <1.11.2`, fixed in `1.9.10`, `1.10.11`, `1.11.2` · CVSS 6.1 Medium · Not analysed yet · Published 14 Mar 2022 · Tags: CWE-1021
- [Spoofing attack in swagger-ui-dist](https://agentprime.io/advisories/GHSA-6c9x-mj3g-h47x.md)
  `GHSA-6c9x-mj3g-h47x`, `CVE-2021-46708` · npm `swagger-ui-dist`: affected `<4.1.3`, fixed in `4.1.3` · CVSS 6.1 Medium · Not analysed yet · Published 12 Mar 2022 · Tags: CWE-1021
- [Clickjacking in cockpit](https://agentprime.io/advisories/CVE-2021-3660.md)
  `CVE-2021-3660` · CVE record: cockpit · No CVSS score · Not analysed yet · Published 7 Mar 2022 · Tags: CWE-1021
- [Clickjacking in EcoStruxure EV Charging Expert (formerly known as EVlink Load Management…](https://agentprime.io/advisories/CVE-2022-22807.md)
  `CVE-2022-22807` · CVE record: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13) · No CVSS score · Not analysed yet · Published 9 Feb 2022 · Tags: CWE-1021
- [Clickjacking in Dell AppSync](https://agentprime.io/advisories/CVE-2022-22552.md)
  `CVE-2022-22552` · CVE record: Dell AppSync · CVSS 6.9 Medium · Not analysed yet · Published 21 Jan 2022 · Tags: CWE-1021
- [Clickjacking Vulnerability](https://agentprime.io/advisories/CVE-2021-35237.md)
  `CVE-2021-35237` · CVE record: SolarWinds Kiwi Syslog Server · CVSS 5.0 Medium · Not analysed yet · Published 29 Oct 2021 · Tags: CWE-1021
- [InHand Networks IR615 Router](https://agentprime.io/advisories/CVE-2021-38472.md)
  `CVE-2021-38472` · CVE record: InHand Networks IR615 Router · CVSS 4.7 Medium · Not analysed yet · Published 19 Oct 2021 · Tags: CWE-1021
- [Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin](https://agentprime.io/advisories/CVE-2021-3799.md)
  `CVE-2021-3799` · CVE record: getgrav getgrav/grav-plugin-admin · CVSS 5.4 Medium · Not analysed yet · Published 27 Sept 2021 · Tags: CWE-1021
- [Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloud](https://agentprime.io/advisories/CVE-2018-19957.md)
  `CVE-2018-19957` · CVE record: QNAP Systems Inc. QTS and 2 more · No CVSS score · Not analysed yet · Published 10 Sept 2021 · Tags: CWE-1021
- [Improper Restriction of Rendered UI Layers or Frames in yourls](https://agentprime.io/advisories/GHSA-r6g8-jmj9-g945.md)
  `GHSA-r6g8-jmj9-g945`, `CVE-2021-3734`, `PKSA-ds9p-gn9y-hv4j` · Packagist `yourls/yourls`: affected `<=1.8.1`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 30 Aug 2021 · Tags: Cross-site request forgery (CSRF), CWE-1021
- [Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb](https://agentprime.io/advisories/CVE-2021-3731.md)
  `CVE-2021-3731` · CVE record: ledgersmb ledgersmb/ledgersmb · CVSS 5.9 Medium · Not analysed yet · Published 23 Aug 2021 · Tags: CWE-1021
- [Clickjacking in Emerson Rosemount X-STREAM Gas Analyzer](https://agentprime.io/advisories/CVE-2021-27467.md)
  `CVE-2021-27467` · CVE record: Emerson Rosemount X-STREAM Gas Analyzer · No CVSS score · Not analysed yet · Published 20 May 2021 · Tags: CWE-1021
- [Clickjacking in Easergy T300 (firmware 2.7 and older)](https://agentprime.io/advisories/CVE-2020-28218.md)
  `CVE-2020-28218` · CVE record: Easergy T300 (firmware 2.7 and older) · No CVSS score · Not analysed yet · Published 11 Dec 2020 · Tags: CWE-1021
- [Clickjacking in Siemens Desigo Insight](https://agentprime.io/advisories/CVE-2020-15793.md)
  `CVE-2020-15793` · CVE record: Siemens Desigo Insight · No CVSS score · Not analysed yet · Published 15 Oct 2020 · Tags: CWE-1021
- [Clickjacking in - Management Console](https://agentprime.io/advisories/CVE-2020-13174.md)
  `CVE-2020-13174` · CVE record: \- Management Console · No CVSS score · Not analysed yet · Published 11 Aug 2020 · Tags: CWE-1021
- [Improper Restriction of Rendered UI Layers or Frames in Keycloak](https://agentprime.io/advisories/GHSA-3gg7-9q2x-79fc.md)
  `GHSA-3gg7-9q2x-79fc`, `CVE-2020-1728` · Maven `org.keycloak:keycloak-core`: affected `<=9.0.3`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 15 Apr 2020 · Tags: CWE-358, CWE-1021
- [Clickjacking in CA Technologies, A Broadcom Company CA Strong Authentication and others](https://agentprime.io/advisories/CVE-2019-7393.md)
  `CVE-2019-7393` · CVE record: CA Technologies, A Broadcom Company CA Strong Authentication and 1 more · No CVSS score · Not analysed yet · Published 28 May 2019 · Tags: CWE-1021
- [Clickjacking in Synology SSO Server](https://agentprime.io/advisories/CVE-2017-16775.md)
  `CVE-2017-16775` · CVE record: Synology SSO Server · CVSS 7.1 High · Not analysed yet · Published 1 Apr 2019 · Tags: CWE-1021

Newest: <https://agentprime.io/advisories/tag/cwe-1021.md>
Older: <https://agentprime.io/advisories/tag/cwe-1021.md?cursor=WyIyMDE5LTA0LTAxVDE0OjI1OjE1LjQ5NDAwMFoiLCJDVkUtMjAxNy0xNjc3NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1021&cursor=WyIyMDIzLTA2LTAyVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yNTc0OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1021/?cursor=WyIyMDIzLTA2LTAyVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yNTc0OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.