Multiple X-Frame-Options Header Entries

Home/Alerts/Alert detail/

Risk:
Medium

Type:
Passive

CWE:
CWE-1021

Summary: X-Frame-Options (XFO) headers were found, a response with multiple XFO header entries may not be predictably treated by all user-agents.

Solution: Ensure only a single X-Frame-Options header is present in the response.

References: https://tools.ietf.org/html/rfc7034

Top Security News

PoC exploit for critical WhatsUp Gold RCE vulnerability released (CVE-2024-8785)

Microsoft 365 outage impacts Exchange Online, Teams, Sharepoint

APT-K-47 Uses Hajj-Themed Lures to Deliver Advanced Asyncshell Malware

INTERPOL Arrests 5,500 in Global Cybercrime Crackdown, Seizes Over $400 Million

Google Chrome’s AI feature lets you quickly check website trustworthiness

Microsoft says having a TPM is "non-negotiable" for Windows 11

Hackers Leveraging Cloudflare Tunnels, DNS Fast-Flux to Hide GammaDrop Malware

Veeam plugs serious holes in Service Provider Console (CVE-2024-42448, CVE-2024-42449)

Common Alerts

LowStrict-Transport-Security Disabled

HighOut of Band XSS

InformationalSec-Fetch-Mode Header Has an Invalid Value

HighSource Code Disclosure - /WEB-INF Folder

InformationalNon-Storable Content

HighProperties File Disclosure - /WEB-INF folder

InformationalPossible Username Enumeration

InformationalSec-Fetch-Site Header Has an Invalid Value

MediumExponential Entity Expansion (Billion Laughs Attack)

MediumDirectory Browsing

Latest CVE List

CVE-2024-51378 CyberPanel Incorrect Default Permissions Vulnerability

CVE-2023-45727 North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability

CVE-2024-11680 ProjectSend Improper Authentication Vulnerability

CVE-2024-11667 Zyxel Multiple Firewalls Path Traversal Vulnerability

CVE-2023-28461 Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

CVE-2024-44308 Apple Multiple Products Code Execution Vulnerability

CVE-2024-44309 Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability

CVE-2024-21287 Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability

CVE-2024-38812 VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

CVE-2024-38813 VMware vCenter Server Privilege Escalation Vulnerability

Top CWE List

HighCWE-863 Incorrect Authorization

CWE-1395 Dependency on Vulnerable Third-Party Component

CWE-15 External Control of System or Configuration Setting

HighCWE-200 Exposure of Sensitive Information to an Unauthorized Actor

HighCWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-1245 Improper Finite State Machines (FSMs) in Hardware Logic

CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

CWE-1426 Improper Validation of Generative AI Output

MediumCWE-190 Integer Overflow or Wraparound

CWE-236 Improper Handling of Undefined Parameters

Free security scan for your website

Don't show website scan report rating on the leaderboard