Weakness (CWE)
CWE-451: User Interface (UI) Misrepresentation of Critical Information
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
How to prevent it (2 mitigations)
-
Implementation
Perform data validation (e.g. syntax, length, etc.) before interpreting the data.
-
Architecture and Design
Create a strategy for presenting information, and plan for how to display unusual characters.
Source: MITRE CWE-451
23 results · Clear filters · Feed
-
Low 3.6
MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simul…
-
Low 3.5
HCL MyXalytics is affected by multiple security vulnerabilities.
HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft.
-
Low 3.1
BIG-IP Configuration utility vulnerability
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the v…
-
Low 3.1
Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who con…
-
Low 2.7
Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server.
Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server.
-
Low 2.3
Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse() passes Unicode explicit-direction BiDi formatting characters through into sanitized href…
-
Low 3.1
Incorrect security UI in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromise…
-
Low 3.1
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced…
-
Low 3.1
Insufficient policy enforcement in Extensions in Google Chrome on Linux prior to 150.0.7871.47 allowed an attacker who …
-
Low 3.1
Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convin…
-
Low 3.1
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not …
-
Low 3.3
uutils coreutils id Misleading Identity Reporting in Pretty Print Mode
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the ef…
-
Low 3.1
BIG-IP Configuration utility vulnerability
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Low 3.1
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
Low 3.1
LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-ap…
-
Low 3.4
LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific …
-
Low 2.9
JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHips…
-
Low 3.5
User Interface (UI) Misrepresentation of Critical Information in GitLab
A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an attacker can cause a branch name confusion in confidential MRs.
-
Low 3.2
In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal es…
-
Low 2.8
A clickjacking issue was addressed with improved out-of-process view handling. This issue is fixed in iOS 18 and iPadOS…
-
Low 3.5
Element's thumbnails can be abused to misrepresent the content of an attachment
Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file d…
-
Low 3.0
Uncontrolled Search Path Element in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data.
-
Low 3.5
A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below.…