4.3
CVE-2015-2917
- EPSS 0.93%
- Veröffentlicht 21.09.2015 10:59:05
- Zuletzt bearbeitet 12.04.2025 10:46:40
- Quelle cret@cert.org
- CVE-Watchlists
- Unerledigt
LoginSecurifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a (1) FRAME, (2) IFRAME, or (3) OBJECT element.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Securifi ≫ Almond Firmware Version <= al1-r201exp10-l304-w33
Securifi ≫ Almond-2015 Firmware Version <= al2-r088
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.93% | 0.756 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.