CWE-356: Human-in-the-Loop
The product encounters a situation in which some of its behavior is security-critical and should be authorized by a human before progressing, but it does not properly consult with the human user or its proxy (such as UI approval dialogues or pre-set policies) to determine whether it is allowed to perform the potentially dangerous behavior.
Also known as Missing User Interaction for Potentially Unsafe Action, HITL.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google android In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to... 7.8 High
- xmind Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability 7.8 High
- zed Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning. 6.4 Medium
- soda pdf desktop, sodapdf soda pdf desktop +1 more Soda PDF Desktop Word File Insufficient UI Warning Remote Code Execution Vulnerability 7.8 High
- soda pdf desktop, sodapdf soda pdf +1 more Soda PDF Desktop Launch Insufficient UI Warning Remote Code Execution Vulnerability 7.0 High
- soda pdf desktop, sodapdf soda pdf +1 more Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability 7.8 High
- pdfforge pdf architect pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerability 7.0 High
- pdfforge pdf architect pdfforge PDF Architect Launch Insufficient UI Warning Remote Code Execution Vulnerability 7.8 High
- pdfforge pdf architect pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerability 7.0 High
- pdfsam enhanced PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability 7.0 High
- pdfsam enhanced PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability 7.8 High
- pdfsam enhanced PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution Vulnerability 7.0 High
- jetbrains junie In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61,... 5.5 Medium
- mozilla thunderbird JavaScript Execution via Spoofed PDF Attachment and file:/// Link 8.1 High
-
epiphanyopenSUSE,epiphany-browserDebian +1 more Epiphany: insecure external protocol invocation in epiphany 8.0 High - rarlab winrar Issue that bypasses the "Mark of the Web" security warning function for files when opening a... 6.8 Medium
- ni vision builder ai NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution Vulnerability 7.8 High
- google android In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to... 6.5 Medium
- opentext filr Stored XSS vulnerability has been discovered in OpenText™ Filr. The vulnerability could cause users to not be warned when clicking links to external sites. 2.1 Low
- microsoft edge, edge for ios +1 more Microsoft Edge for iOS Spoofing Vulnerability 5.4 Medium
- libreoffice, debian linux, fedoraproject fedora +2 more Graphic on-click binding allows unchecked script execution 6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 more The permission prompt input delay could have expired while the window is not in focus, which made... 6.1 Medium
- aveva edge This vulnerability allows remote attackers to execute arbitrary code on affected installations of... 7.8 High
- metabase Metabase vulnerable to arbitrary SQL execution from queryhash 8.8 High
- inductive automation ignition This vulnerability allows remote attackers to execute arbitrary code on affected installations of... 7.8 High
- lenovo browser This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations... 7.5 High
- tencent wechat This vulnerability allows remote attackers redirect users to an external resource on affected... 4.3 Medium
- bitdefender safepay This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations... 8.8 High
- bitdefender safepay This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations... 8.8 High
- bitdefender safepay This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations... 8.8 High
- [unknown] libreoffice It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory... 7.8 High
- bd reada, database manager, performa +1 more +3 more A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a... 6.3 Medium
- bd performa, database manager, reada +1 more +3 more A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and... 5.6 Medium