The Solution: Return the X-Frame-Options or Content-Security-Policy (with the 'frame-ancestors' directive) HTTP header with the page's response. This prevents the page's content from being rendered by another site when using the frame or iframe HTML tags.

I found the solution for Service Desk but not for OpManager.

https://forums.manageengine.com/topic/manage-engine-web-application-potentially-vulnerable-to-clickjacking-return-the-x-frame-options-http-header-with-the-page-s-response

Please advise.