CWE-451: User Interface (UI) Misrepresentation of Critical Information
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
A kind of CWE-684 Incorrect Provision of Specified Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- docusignPDF Document Spoofing in DocuSign8.2 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 13 +1 more +3 moreMicrosoft Exchange Server Spoofing Vulnerability7.5 High
- element-hq element-webElement's thumbnails can be abused to misrepresent the content of an attachment3.5 Low
- nippon telegraph and telephone east corporation hikari denwa router pr-400mi, hikari denwa router rt-400mi, hikari denwa router rv-440mi +5 more +7 moreMultiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST...5.3 Medium
- e-tax.nta e-tax, national tax agency the installer of e-tax software(common program) +1 moreUser interface (UI) misrepresentation of critical information issue exists in multiple Home...7.8 High
- google chromeInappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a...4.3 Medium
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +34 more +36 moreWindows MSHTML Platform Spoofing Vulnerability8.8 High
- google chromeInappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a...4.3 Medium
- microsoft teams for ios, teams +1 moreMicrosoft Teams for iOS Spoofing Vulnerability6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe date picker could partially obscure security prompts. This could be used by a malicious site...6.5 Medium
- google chromeInappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote...4.3 Medium
- gitlabUncontrolled Search Path Element in GitLab3.0 Low
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +29 more +31 moreWindows MSHTML Platform Spoofing Vulnerability7.5 High
- mozilla firefox, thunderbird +1 moreForm validation popups could block exiting full-screen mode4.3 Medium
- microsoft edge, edge (chromium-based) +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability4.7 Medium
- microsoft edge, edge (chromium-based) +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability4.3 Medium
- mozilla firefox for ios, firefox mobile +1 moreIn certain scenarios a malicious website could attempt to display a fake location URL bar which...4.3 Medium
- mozilla firefoxBy manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid...6.1 Medium
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a...6.5 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability5.4 Medium
- google androidIn multiple functions of NotificationManagerService.java, there is a possible way to not show a...7.8 High
- google chromeInappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed a remote...4.3 Medium
- google chromeInappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote...4.3 Medium
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote...4.3 Medium
- dell e-lab navigator, mobility - e-lab navigator +1 moreDell E-Lab Navigator, [3.1.9, 3.2.0], contains an Insecure Direct Object Reference Vulnerability...4.4 Medium
- ibm powerscIBM PowerSC clickjacking6.5 Medium
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Downloads in Google Chrome prior to 121.0.6167.85 allowed a...4.3 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA bug in popup notifications delay calculation could have made it possible for an attacker to...8.8 High
- redhat quay, red hat quay 3 +1 moreQuay: clickjacking on config-editor page severity6.5 Medium
- google chromeInappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a...4.3 Medium
- google chromeInappropriate implementation in Picture in Picture in Google Chrome prior to 119.0.6045.105...6.5 Medium
- google chromeInappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an...4.3 Medium
- google chromeInappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90...4.3 Medium
- google chromeInappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90...4.3 Medium
- google chromeInappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.63 allowed a...4.3 Medium
- google chromeInappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414...6.5 Medium
- mozilla firefoxUnder certain circumstances, a JavaScript alert (or prompt) could have been shown while another...4.3 Medium
- google androidIn strings.xml, there is a possible permission bypass due to a misleading string. This could lead...5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThrough a series of popup and <code>window.print()</code> calls, an attacker can cause a window...6.5 Medium
- f-secure safeWithSecure through 2022-08-10 allows attackers to cause a denial of service (issue 2 of 5).3.5 Low
- google chromeIncorrect security UI in full screen in Google Chrome prior to 106.0.5249.62 allowed a remote...6.5 Medium
- mailcow mailcow-dockerized, mailcow\ +1 moremailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI8.1 High
- code-projects gym management system, gym management system project management system +1 moreSourceCodester Gym Management System clickjacking4.3 Medium
- apple ipados, macos, tvos +2 more +4 moreThe issue was addressed with improved UI handling. This issue is fixed in watchOS 8.7, tvOS 15.6,...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA malicious website that could create a popup could have resized the popup to overlay the address...6.5 Medium
- hcl sametimeHCL Sametime is vulnerable to clickjacking4.2 Medium
- hitachi abb power grids ellipse enterprise asset management (eam), hitachienergy ellipse enterprise asset management +1 moreUser interface misrepresentation of critical information in Hitachi ABB Power Grids Ellipse EAM5.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen resizing a popup after requesting fullscreen access, the popup would not display the...4.3 Medium
- vercel next.jsImproper CSP in Image Optimization API for Next.js5.9 Medium
- Show moreLoading…