Threats Tagged 'cwe-1021'

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 have a vulnerability involving improper restriction of rendered UI layers or frames. This flaw could allow a low privileged remote attacker to elevate privileges and steal sessions. The vulnerability is identified as CWE-1021 and has a medium severity rating with a CVSS score of 5.4.

CVE-2026-84388 is a critical vulnerability in the FortiPAM Chrome extension used for Privileged Access Management. It allows any website visited by the user to manipulate the browser's proxy settings for the session and to open new tabs that can be screen recorded and streamed to an attacker's server. This enables attackers to conduct phishing attacks by capturing sensitive user activity in attacker-controlled tabs without user consent.

CVE-2026-75548 is a medium severity vulnerability in the Ebyte NA111-M Firmware web management interface. The interface does not prevent being rendered inside an external frame, which could allow an unauthenticated remote attacker to trick an authenticated administrator into performing unintended configuration changes or disruptive actions. The vulnerability is related to improper restriction of rendered UI layers or frames (CWE-1021). No official patch or remediation guidance is currently available.

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.

SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute malicious scripts within the application's context. Successful exploitation may result in a low impact on confidentiality and integrity, with no impact on the availability of the application.

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `internal/web/` or `internal/api/` set the standard browser-security headers. `grep` for `Content-Security-Policy`, `X-Frame-Options`, `Strict-Transport-Security`, `X-Content-Type-Options`, `Referrer-Policy` returns zero matches across the codebase. Version 0.3.1 fixes the issue.

Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker to perform spoofing over a network.

In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible

Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20.

CVE-2026-12348 is a high-severity vulnerability in Arc Search for Android by The Browser Company of New York. It involves address bar spoofing where a remote attacker can make the browser display a trusted domain in the address bar while showing attacker-controlled content. This can enable phishing attacks by misleading users about the legitimacy of the website they are visiting. No specific affected versions or patches have been disclosed yet.