> NOTE! Thanks for submitting a report! Please replace *all* the [square] sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! **Summary:** [The below listed links, dont have X-FRAME-OPTIONS set to DENY or SAMEORIGIN and they are vulnerable to clickjacking] **Description:** [The following url can be easily vulnerable to clickjacking] **Browsers Verified In:** * [Firefox V56] **Steps To Reproduce:** [add details for how we can reproduce the issue] 1. [Run below code from browser and you will see listed links are vulnerable to clickjacking attack] 2. [<!DOCTYPE html> <html> <frameset cols="25%,*,25%"> <frame src="https://www.semrush.com/?l=us"> <frame src="https://www.semrush.com/academy/"> <frame src="https://www.semrush.com/ranking-factors/"> </frameset> </html>] **Following links are vulnerable to clickjacking** + https://www.semrush.com/semrush-opensearch.xml + https://www.semrush.com/academy/ + https://www.semrush.com/ranking-factors/ + https://www.semrush.com/manifest.json + https://www.semrush.com/?l=us + https://www.semrush.com/blog/ + https://www.semrush.com/ + https://www.semrush.com/prices/ + https://www.semrush.com/. + https://www.semrush.com/.?l=us **Supporting Material/References:** * Screenshot is attached with ticket

Following links are vulnerable to clickjacking

Vulnerability Details

Actions

Report Stats

Share this report