Multiple X-Frame-Options Header Entries

Home/Alerts/Alert detail/

Risk:
Medium

Type:
Passive

CWE:
CWE-1021

Summary: X-Frame-Options (XFO) headers were found, a response with multiple XFO header entries may not be predictably treated by all user-agents.

Solution: Ensure only a single X-Frame-Options header is present in the response.

References: https://tools.ietf.org/html/rfc7034

Top Security News

CISA orders federal agencies to secure Microsoft 365 tenants

Recorded Future CEO applauds "undesirable" designation by Russia

BeyondTrust fixes critical vulnerability in remote access, support solutions (CVE-2024-12356)

Google Chrome uses AI to analyze pages in new scam detection feature

Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack

Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware

Exploit released for critical WhatsUp Gold RCE flaw, patch now

Microsoft fixes exploited zero-day (CVE-2024-49138)

Top Alert List

MediumAbsence of Anti-CSRF Tokens

Content Security Policy (CSP) Header Not Set

InformationalInformation Disclosure - Suspicious Comments

LowStrict-Transport-Security Multiple Header Entries (Non-compliant with Spec)

LowCookie without SameSite Attribute

CSP

InformationalRe-examine Cache-control Directives

MediumMissing Anti-clickjacking Header

InformationalModern Web Application

LowX-Content-Type-Options Header Missing

Latest CVE List

CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

CVE-2018-14933 NUUO NVRmini Devices OS Command Injection Vulnerability

CVE-2022-23227 NUUO NVRmini 2 Devices Missing Authentication Vulnerability

CVE-2019-11001 Reolink Multiple IP Cameras OS Command Injection Vulnerability

CVE-2021-40407 Reolink RLC-410W IP Camera OS Command Injection Vulnerability

CVE-2024-55956 Cleo Multiple Products Unauthenticated File Upload Vulnerability

CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability

CVE-2024-35250 Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability

CVE-2024-50623 Cleo Multiple Products Unrestricted File Upload Vulnerability

CVE-2024-49138 Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Common CWEs

CWE-40 Path Traversal: '\\UNC\share\name\' (Windows UNC Share)

CWE-1420 Exposure of Sensitive Information during Transient Execution

CWE-474 Use of Function with Inconsistent Implementations

MediumCWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-1316 Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges

CWE-593 Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created

CWE-214 Invocation of Process Using Visible Sensitive Information

CWE-553 Command Shell in Externally Accessible Directory

LowCWE-252 Unchecked Return Value

CWE-667 Improper Locking

Free security scan for your website

Don't show website scan report rating on the leaderboard