cve.bz

CWE-451: User Interface (UI) Misrepresentation of Critical Information, page 10

Filter

The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

What the weakness is: CWE-451 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 5
  • CAPEC-98 Phishing Likelihood: High · Severity: Very High
  • CAPEC-154 Resource Location Spoofing Likelihood: Medium · Severity: Medium
  • CAPEC-163 Spear Phishing Likelihood: High · Severity: High
  • CAPEC-164 Mobile Phishing Likelihood: High · Severity: High
  • CAPEC-173 Action Spoofing Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-451, as MITRE names them. Credits.

Ask an AI about CWE-451

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-451: User Interface (UI) Misrepresentation of Critical Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/451.html and https://cve.bz/cve/cwe/451?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2024-38197EPSS 17%

    Microsoft Teams for iOS Spoofing Vulnerability

  2. 4.3CVE-2024-6999EPSS 0.5%

    Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Med…

  3. 6.5CVE-2024-7529EPSS 0.5%

    The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < …

  4. 5.3CVE-2024-6595EPSS 0.5%

    An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting …

  5. 6.5CVE-2023-7011EPSS 0.4%

    Inappropriate implementation in Picture in Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)

  6. 7.5CVE-2024-38112KEVEPSS 84%

    Windows MSHTML Platform Spoofing Vulnerability

  7. 4.3CVE-2024-6610EPSS 0.3%

    Form validation popups could capture escape key presses. Therefore, spamming form validation messages could be used to prevent users from exiting full-screen mode. This vulnerability affects Firefox < 128 and Thunderbird < 128.

  8. 4.3CVE-2024-38093EPSS 0.5%

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

  9. 4.7CVE-2024-38082EPSS 0.5%

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

  10. 4.3CVE-2024-38313EPSS 0.2%

    In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This vulnerability affects Firefox for iOS < 127.

  11. 6.1CVE-2024-5698EPSS 0.4%

    By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 12…

  12. 6.5CVE-2024-4950EPSS 0.9%

    Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity:…

  13. 5.4CVE-2024-30055EPSS 0.6%

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

  14. 7.8CVE-2024-23708EPSS 0.3%

    In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has been accessed. This could lead to local escalation of privilege with no additional execution privile…

  15. 4.3CVE-2024-2631EPSS 0.7%

    Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  16. 4.3CVE-2023-50938EPSS 0.4%

    IBM PowerSC 1.3, 2.0, and 2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click …

  17. 4.3CVE-2024-0805EPSS 0.4%

    Inappropriate implementation in Downloads in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Medium)

  18. 8.8CVE-2024-0750EPSS 0.8%

    A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.

  19. 4.3CVE-2023-2941EPSS 0.6%

    Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to spoof the contents of the UI via a crafted Chrome Extension. (Chromium secu…

  20. 4.3CVE-2023-2938EPSS 0.9%

    Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium…

  21. 4.3CVE-2023-2937EPSS 0.9%

    Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium…

  22. 6.5CVE-2023-0700EPSS 0.7%

    Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)

  23. 6.5CVE-2023-0130EPSS 0.6%

    Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)

  24. 6.5CVE-2022-45404EPSS 0.7%

    Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability…

  25. 6.5CVE-2022-34479EPSS 0.8%

    A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks. <br>*This bug only affects Thunderbird for Linux. Other …

  26. 4.3CVE-2022-26383EPSS 0.7%

    When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

  27. 4.3CVE-2022-22762EPSS 0.4%

    Under certain circumstances, a JavaScript alert (or prompt) could have been shown while another website was displayed underneath it. This could have been abused to trick the user. <br>*This bug only affects Firefox for Android. Other opera…

  28. 5.3CVE-2022-20530EPSS 0.5%

    In strings.xml, there is a possible permission bypass due to a misleading string. This could lead to remote information disclosure of call logs with no additional execution privileges needed. User interaction is not needed for exploitation…

  29. 3.5CVE-2022-38163EPSS 0.7%

    A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. Drag and drop operation by user on address bar could lead to a spoofing of the address bar.

  30. 6.5CVE-2022-3313EPSS 0.8%

    Incorrect security UI in full screen in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium)

  31. 8.2CVE-2022-39258ExploitEPSS 1.8%

    mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger a…

  32. 6.5CVE-2022-32816EPSS 8.2%

    The issue was addressed with improved UI handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. Visiting a website that frames malicious content may lead to UI spoofing.

  33. 6.1CVE-2022-2800EPSS 0.6%

    A vulnerability, which was classified as problematic, has been found in SourceCodester Gym Management System. Affected by this issue is some unknown functionality. The manipulation leads to clickjacking. The attack may be launched remotely…

  34. 4.3CVE-2021-27773EPSS 0.5%

    This vulnerability allows users to execute a clickjacking attack in the meeting's chat.

  35. 6.1CVE-2021-27414EPSS 0.6%

    An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 into visiting a malicious website posing as a login page for the Ellipse application and gather auth…

  36. 7.5CVE-2022-23646EPSS 1.8%

    Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the `next.config.js` file must have an…

  37. 8.8CVE-2021-41598EPSS 1.2%

    A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this v…

  38. 5.3CVE-2021-33593EPSS 0.7%

    Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar spoofing.

  39. 8.8CVE-2021-22866EPSS 1.0%

    A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this v…

  40. 4.3CVE-2020-7371EPSS 1.0%

    User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the RITS Browser v…

  41. 4.3CVE-2020-7370EPSS 1.0%

    User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the B…

  42. 4.3CVE-2020-7369EPSS 1.0%

    User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Yandex Browser…

  43. 4.3CVE-2020-7364EPSS 0.7%

    User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser…

  44. 4.3CVE-2020-7363EPSS 0.7%

    User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser…

  45. 5.3CVE-2020-10775EPSS 1.8%

    An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing attacks. Once the target has opened the malicious URL in thei…

  46. 4.3CVE-2017-0888EPSS 1.5%

    Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app. The top navigation bar displayed in the files list contained partially user-controllable input leading to a potential misrepresenta…

  47. 4.7CVE-2016-9473EPSS 1.9%

    Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by displaying a malicious page for legitimate domain names.

  48. 5.3CVE-2016-9468EPSS 2.1%

    Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a p…

  49. 5.3CVE-2016-9467EPSS 3.0%

    Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid…

  50. 5.3CVE-2016-9460EPSS 1.7%

    Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link …