CVE-2024-2177

MEDIUM Year: 2024
CVSS v3 Score
6.8
Medium
Weakness Type
CWE-1021
View all →

Vulnerability Description

A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload.

Related Vulnerabilities

CVE-2025-24874

MEDIUM
CVSS:6.8(Medium)

SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers migh...

CWE-10212025

CVE-2013-2675

MEDIUM
CVSS:6.5(Medium)

Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attackers to obtain sensitive information.

CWE-10212013

CVE-2017-20041

MEDIUM
CVSS:6.5(Medium)

A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title lead...

CWE-10212017

CVE-2017-5016

MEDIUM
CVSS:6.5(Medium)

Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements from being displayed by non-visible pages, which allowed a ...

CWE-10212017

CVE-2017-5697

MEDIUM
CVSS:6.5(Medium)

Insufficient clickjacking protection in the Web User Interface of Intel AMT firmware versions before 9.1.40.1000, 9.5.60.1952, 10.0.50.1004, 11.0.0.1205, and 11.6.25.1129 potentially allowing a remote...

CWE-10212017

CVE-2017-7440

MEDIUM
CVSS:6.5(Medium)

Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjacking...

CWE-10212017