CWE-1021 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-1021/ Sun, 26 Feb 2023 09:09:39 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-1021 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-1021/ 32 32 CVE-2008-2716 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-2716/ Sun, 26 Feb 2023 09:09:39 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-2716/ Unspecified vulnerability in Opera before 9.5 allows remote attackers to spoof the contents of trusted frames on the same parent page by modifying the location, which can facilitate phishing attacks.

The post CVE-2008-2716 appeared first on CVE Vulnerability.

]]> Unspecified vulnerability in Opera before 9.5 allows remote attackers to spoof the contents of trusted frames on the same parent page by modifying the location, which can facilitate phishing attacks.

The post CVE-2008-2716 appeared first on CVE Vulnerability.

]]> CVE-2018-9524 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-9524/ Sun, 26 Feb 2023 06:51:50 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-9524/ In functionality implemented in System UI, there are insufficient protections implemented around overlay windows. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1. Android ID: A-34170870

The post CVE-2018-9524 appeared first on CVE Vulnerability.

]]> In functionality implemented in System UI, there are insufficient protections implemented around overlay windows. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1. Android ID: A-34170870

The post CVE-2018-9524 appeared first on CVE Vulnerability.

]]> CVE-2018-9458 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-9458/ Sun, 26 Feb 2023 06:51:49 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-9458/ In computeFocusedWindow of RootWindowContainer.java, and related functions, there is possible interception of keypresses due to focus being on the wrong window. This could lead to local escalation of privilege revealing the user’s keypresses while the screen was locked with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.0 Android-8.1 […]

The post CVE-2018-9458 appeared first on CVE Vulnerability.

]]> In computeFocusedWindow of RootWindowContainer.java, and related functions, there is possible interception of keypresses due to focus being on the wrong window. This could lead to local escalation of privilege revealing the user’s keypresses while the screen was locked with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.0 Android-8.1 Android ID: A-71786287.

The post CVE-2018-9458 appeared first on CVE Vulnerability.

]]> CVE-2018-7491 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7491/ Sun, 26 Feb 2023 06:51:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7491/ In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an admin, because the generateHtaccess function in classes/Tools.php sets neither X-Frame-Options nor ‘Content-Security-Policy “frame-ancestors’ values.

The post CVE-2018-7491 appeared first on CVE Vulnerability.

]]> In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an admin, because the generateHtaccess function in classes/Tools.php sets neither X-Frame-Options nor ‘Content-Security-Policy “frame-ancestors’ values.

The post CVE-2018-7491 appeared first on CVE Vulnerability.

]]> CVE-2018-6909 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-6909/ Sun, 26 Feb 2023 06:50:52 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-6909/ A missing X-Frame-Options header in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application could be used by a remote attacker for clickjacking, as demonstrated by triggering an API page request.

The post CVE-2018-6909 appeared first on CVE Vulnerability.

]]> A missing X-Frame-Options header in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application could be used by a remote attacker for clickjacking, as demonstrated by triggering an API page request.

The post CVE-2018-6909 appeared first on CVE Vulnerability.

]]> CVE-2018-6178 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-6178/ Sun, 26 Feb 2023 06:50:37 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-6178/ Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to Hide Chrome Security UI via a crafted Chrome Extension.

The post CVE-2018-6178 appeared first on CVE Vulnerability.

]]> Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to Hide Chrome Security UI via a crafted Chrome Extension.

The post CVE-2018-6178 appeared first on CVE Vulnerability.

]]> CVE-2018-19957 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-19957/ Sun, 26 Feb 2023 06:48:23 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-19957/ A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS 4.5.4.1715 build 20210630 and later QuTS hero h4.5.4.1771 build 20210825 and later QuTScloud […]

The post CVE-2018-19957 appeared first on CVE Vulnerability.

]]> A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS 4.5.4.1715 build 20210630 and later QuTS hero h4.5.4.1771 build 20210825 and later QuTScloud c4.5.6.1755 build 20210809 and later

The post CVE-2018-19957 appeared first on CVE Vulnerability.

]]> CVE-2018-1853 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-1853/ Sun, 26 Feb 2023 06:47:49 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-1853/ IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim’s click actions and possibly launch further attacks against the victim. IBM […]

The post CVE-2018-1853 appeared first on CVE Vulnerability.

]]> IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim’s click actions and possibly launch further attacks against the victim. IBM X-Force ID: 151014.

The post CVE-2018-1853 appeared first on CVE Vulnerability.

]]> CVE-2018-18496 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-18496/ Sun, 26 Feb 2023 06:47:48 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-18496/ When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. *Note: This issue only affects Windows operating systems. Other operating systems are not affected.*. This vulnerability […]

The post CVE-2018-18496 appeared first on CVE Vulnerability.

]]> When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. *Note: This issue only affects Windows operating systems. Other operating systems are not affected.*. This vulnerability affects Firefox < 64.

The post CVE-2018-18496 appeared first on CVE Vulnerability.

]]> CVE-2018-1803 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-1803/ Sun, 26 Feb 2023 06:47:40 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-1803/ IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim’s click actions and possibly launch further attacks against the victim. […]

The post CVE-2018-1803 appeared first on CVE Vulnerability.

]]> IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim’s click actions and possibly launch further attacks against the victim. IBM X-Force ID: 149702.

The post CVE-2018-1803 appeared first on CVE Vulnerability.

]]>