Weakness (CWE)
CWE-451: User Interface (UI) Misrepresentation of Critical Information
Class Draft
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
How to prevent it (2 mitigations)
-
Implementation
Perform data validation (e.g. syntax, length, etc.) before interpreting the data.
-
Architecture and Design
Create a strategy for presenting information, and plan for how to display unusual characters.
Source: MITRE CWE-451
84 results · Clear filters · Feed
-
High 8.8
Visual Studio Code Security Feature Bypass Vulnerability
User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
-
High 7.8
An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when …
-
High 7.8
In updateInputWindows of InputMonitor.java, there is a possible tapjacking issue due to a logic error in the code. This…
-
High 8.4
In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account…
-
High 8.4
In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent action…
-
High 8.4
In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This…
-
High 8.4
In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in th…
-
High 8.4
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay …
-
High 8.4
In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/ov…
-
High 8.8
Spoofing issue in the Downloads component in Firefox for Android
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159.
-
High 8.8
Frame poisoning in the CSS Parsing and Computation component
Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
-
High 8.8
UI misrepresentation in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof…
-
High 8.8
UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI element…
-
High 8.8
UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social e…
-
High 8.8
UI misrepresentation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social …
-
High 8.8
UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social eng…
-
High 8.8
UI misrepresentation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging s…
-
High 8.8
UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spo…
-
High 8.8
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoo…
-
High 8.8
UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spo…
-
High 8.8
UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof addre…
-
High 8.8
UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the…
-
High 8.8
UI misrepresentation in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engin…
-
High 8.8
UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elemen…
-
High 8.8
UI misrepresentation in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoo…
-
High 8.8
UI misrepresentation in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to s…
-
High 8.8
UI misrepresentation in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof U…
-
High 8.8
UI misrepresentation in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had co…
-
High 8.8
UI misrepresentation in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spo…
-
High 8.8
UI misrepresentation in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging soci…
-
High 8.8
UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social eng…
-
High 8.8
UI misrepresentation in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote att…
-
High 8.8
UI misrepresentation in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements …
-
High 8.8
UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address b…
-
High 8.8
UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social …
-
High 8.8
UI misrepresentation in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leverag…
-
High 8.8
UI misrepresentation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker leveraging socia…
-
High 8.8
UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elemen…
-
High 8.8
UI misrepresentation in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had comprom…
-
High 8.8
UI misrepresentation in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof …