Weakness (CWE)
CWE-451: User Interface (UI) Misrepresentation of Critical Information
Class Draft
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
How to prevent it (2 mitigations)
-
Implementation
Perform data validation (e.g. syntax, length, etc.) before interpreting the data.
-
Architecture and Design
Create a strategy for presenting information, and plan for how to display unusual characters.
Source: MITRE CWE-451
507 results · Feed
-
Medium 4.7
Foxit PDF Editor/Reader's signature-validation pop-up reports modified certified documents as valid
Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication. This may mislead users into trusting tampered documents, since the UI cannot accurately …
-
Medium 5.4
Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()
A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:80@attacker.com/](…
-
Medium 4.0
Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to …
-
Medium 4.3
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker…
-
Medium 4.3
Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform …
-
Medium 4.3
Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attack…
-
Medium 4.3
Inappropriate implementation in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform U…
-
Medium 4.3
Inappropriate implementation in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had c…
-
Medium 4.3
Inappropriate implementation in Input in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to p…
-
Medium 4.3
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker…
-
Medium 4.3
Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to…
-
Medium 4.3
Inappropriate implementation in Global Media Controls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker…
-
Low 3.1
Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who con…
-
Medium 4.3
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker…
-
Medium 4.3
Incorrect security UI in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform dom…
-
Medium 4.3
Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to per…
-
Medium 4.3
Inappropriate implementation in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI s…
-
Medium 4.3
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attac…
-
Medium 4.3
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker…
-
Medium 4.3
Inappropriate implementation in FullScreen in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker…
-
Medium 5.4
Inappropriate implementation in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to…
-
Medium 5.4
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker…
-
Medium 5.4
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker…
-
Medium 4.3
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker…
-
Medium 6.5
Incorrect security UI in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform domain …
-
Medium 6.5
Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to per…
-
Medium 6.5
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker…
-
Medium 6.5
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker…
-
Medium 6.5
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker…
-
Medium 6.5
Inappropriate implementation in WebAppInstalls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to per…
-
Medium 5.4
Inappropriate implementation in DigitalCredentials in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to…
-
Medium 6.5
Inappropriate implementation in Credential Management in Google Chrome prior to 151.0.7922.72 allowed a remote attacker…
-
Medium 6.5
Inappropriate implementation in Messages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker t…
-
Medium 4.3
Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spo…
-
Medium 4.3
Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to…
-
Medium 4.2
Insufficient validation of untrusted input in Payments in Google Chrome on Android prior to 151.0.7922.72 allowed a rem…
-
Medium 6.5
The issue was addressed with improved UI. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.…
-
Medium 6.5
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 a…
-
High 7.5
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte…
-
Low 2.7
Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server.
Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server.