Weakness (CWE)
CWE-451: User Interface (UI) Misrepresentation of Critical Information
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
How to prevent it (2 mitigations)
-
Implementation
Perform data validation (e.g. syntax, length, etc.) before interpreting the data.
-
Architecture and Design
Create a strategy for presenting information, and plan for how to display unusual characters.
Source: MITRE CWE-451
507 results · Feed
-
High 7.0
Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability
Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerabilit…
-
Medium 4.3
Address bar spoofing using an blob URI on Firefox for Android
A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.*. This vulnerability was fixed in Firef…
-
Medium 5.3
Incorrect URL truncation in Firefox for Android
In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox 141.
-
Medium 6.5
Spoofing issue in the Address Bar component
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 142 and Firefox ESR 140.2.
-
Medium 6.5
Spoofing issue in the Address Bar component of Firefox Focus for Android
Spoofing issue in the Address Bar component of Firefox Focus for Android. This vulnerability was fixed in Firefox 142.
-
Medium 4.3
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
-
Medium 4.3
Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perfor…
-
Medium 4.3
The issue was addressed with improved UI. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6. Visiting a mali…
-
Low 2.9
JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHips…
-
Critical 9.8
Incorrect URL truncation
Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.
-
Medium 6.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
-
Medium 5.4
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
Medium 6.9
OpenAI Operator - API Spoofing through Locking Operator on FullScreen
Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture sensitive user input (e.g., login credentials, email addresses) via displaying a deceptive fullscre…
-
Medium 5.4
IBM Datacap clickjacking
IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click acti…
-
Medium 6.5
Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links
A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data …
-
Medium 6.5
Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker w…
-
Medium 6.5
Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker …
-
Low 3.5
User Interface (UI) Misrepresentation of Critical Information in GitLab
A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an attacker can cause a branch name confusion in confidential MRs.
-
Medium 6.5
Microsoft Edge (Chromium-based) Spoofing Vulnerability
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
-
Medium 4.3
Firefox Focus elide URL allows address bar spoofing
Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into thinking they were on a different webpage. This vulnerability was fixed in Focus 138.
-
Medium 6.5
Specially crafted filename could be used to obscure download type
A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. *This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected.*. This…
-
Low 3.2
In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal es…
-
Medium 6.4
User Interface (UI) Misrepresentation of attachment URL
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick …
-
Medium 4.3
Unexpected external content may be displayed in DNN ImageHandler
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to render text from a querystring parameter. This text would display in the resulting image and a user…
-
Medium 4.7
Microsoft Edge for iOS Spoofing Vulnerability
User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
-
Medium 5.4
Inappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform …
-
Medium 5.4
Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convince…
-
Medium 5.4
Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convi…
-
Medium 4.3
The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequo…
-
Low 2.8
A clickjacking issue was addressed with improved out-of-process view handling. This issue is fixed in iOS 18 and iPadOS…
-
Medium 4.3
Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker …
-
Medium 5.3
Microsoft Outlook Spoofing Vulnerability
Microsoft Outlook Spoofing Vulnerability
-
Medium 5.3
Microsoft Edge for IOS and Android Spoofing Vulnerability
Microsoft Edge for IOS and Android Spoofing Vulnerability
-
Medium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
Medium 6.3
Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who co…
-
Medium 4.3
TP-Link TL-SG108E clickjacking
A vulnerability was found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to clickjacking. The attack may be initiated remotely. Upgrading to version 1.…
-
Medium 5.4
Microsoft Edge (Chromium-based) Spoofing Vulnerability
User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network
-
Medium 4.3
Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convin…
-
Medium 6.5
Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker…
-
Medium 6.5
Windows SmartScreen Spoofing Vulnerability
Windows SmartScreen Spoofing Vulnerability