Skip to content
OpenAdvisories

Weakness (CWE)

CWE-356: Missing User Interaction for Potentially Unsafe Action

Base Incomplete

The product encounters a situation in which some
of its behavior is security-critical and should be authorized
by a human before progressing, but it does not properly
consult with the human user or its proxy (such as UI approval
dialogues or pre-set policies) to determine whether it is
allowed to perform the potentially dangerous
behavior.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Product systems should warn users that a potentially dangerous action may occur if the user proceeds. For example, if the user downloads a file from an unknown source and attempts to execute the file on their machine, then the application's GUI can indicate that the file is unsafe.

Source: MITRE CWE-356

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-25805

    Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning.

    Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does not show after the tool was being invoked, which parameters were used. Thus, maybe unwanted or even…

    zed-industries zed
  • Medium 5.5
    CVE-2025-58335

    In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.5…

    JetBrains Junie
  • Medium 6.5
    CVE-2025-0092

    In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficie…

    Google Android Android
  • Medium 6.8
    CVE-2025-31334

    Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points …

    RARLAB WinRAR
  • Medium 5.4
    CVE-2024-30057

    Microsoft Edge for iOS Spoofing Vulnerability

    Microsoft Edge for iOS Spoofing Vulnerability

    Microsoft Microsoft Edge for iOS iOS Browsers
  • Medium 6.5
    CVE-2024-3044

    Graphic on-click binding allows unchecked script execution

    Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine
  • Medium 6.1
    CVE-2024-2609

    The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacki…

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  • Medium 4.3
    CVE-2019-17151

    This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent …

    Tencent WeChat