cve.bz

CWE-451: User Interface (UI) Misrepresentation of Critical Information, page 9

Filter

The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

What the weakness is: CWE-451 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 5
  • CAPEC-98 Phishing Likelihood: High · Severity: Very High
  • CAPEC-154 Resource Location Spoofing Likelihood: Medium · Severity: Medium
  • CAPEC-163 Spear Phishing Likelihood: High · Severity: High
  • CAPEC-164 Mobile Phishing Likelihood: High · Severity: High
  • CAPEC-173 Action Spoofing Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-451, as MITRE names them. Credits.

Ask an AI about CWE-451

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-451: User Interface (UI) Misrepresentation of Critical Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/451.html and https://cve.bz/cve/cwe/451?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2025-43228EPSS 0.9%

    The issue was addressed with improved UI. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6. Visiting a malicious website may lead to address bar spoofing.

  2. 2.9CVE-2025-43712EPSS 0.3%

    JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard user, the authorities parameter in the response from the api/account endpoint co…

  3. 9.8CVE-2025-8043EPSS 0.4%

    Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.

  4. 4.3CVE-2025-47964EPSS 0.5%

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

  5. 6.5CVE-2025-47963EPSS 0.6%

    No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

  6. 6.9CVE-2025-7021EPSS 0.4%

    Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture sensitive user input (e.g., login credentials, email addresses) via displaying …

  7. 5.4CVE-2024-39730EPSS 0.2%

    IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the…

  8. 6.5CVE-2025-5986EPSS 0.6%

    A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the dis…

  9. 6.5CVE-2025-5066EPSS 0.4%

    Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security…

  10. 6.5CVE-2025-5065EPSS 0.4%

    Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  11. 7.5CVE-2024-9163EPSS 0.4%

    A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an attacker can cause a branch name confusion in confidential MRs.

  12. 6.5CVE-2025-29825EPSS 0.9%

    User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

  13. 6.1CVE-2025-3859EPSS 0.2%

    Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into thinking they were on a different webpage. This vulnerability was fixed in Focus…

  14. 6.5CVE-2025-4086EPSS 0.3%

    A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. *This bug only affects Thunderbird for Android. Other versions of Thunderbird ar…

  15. 3.3CVE-2025-46394EPSS 0.2%

    In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

  16. 6.4CVE-2025-3523EPSS 0.3%

    When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hov…

  17. 4.3CVE-2025-32371EPSS 0.3%

    DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to render text from a querystring parameter. This text would display in the result…

  18. 4.7CVE-2025-29796EPSS 0.6%

    User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.

  19. 5.4CVE-2025-3074EPSS 0.3%

    Inappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  20. 5.4CVE-2025-3073EPSS 0.3%

    Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: …

  21. 5.4CVE-2025-3072EPSS 0.3%

    Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severit…

  22. 4.3CVE-2025-30467EPSS 0.5%

    The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4. Visiting a malicious website may lead to address bar spoofing.

  23. 2.8CVE-2024-54558EPSS 0.2%

    A clickjacking issue was addressed with improved out-of-process view handling. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to trick a user into granting access to photos from the user's photo library.

  24. 4.3CVE-2025-1922EPSS 0.3%

    Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium securit…

  25. 5.3CVE-2025-21259EPSS 1.2%

    Microsoft Outlook Spoofing Vulnerability

  26. 4.3CVE-2025-21404EPSS 1.1%

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

  27. 5.3CVE-2025-21253EPSS 1.2%

    Microsoft Edge for IOS and Android Spoofing Vulnerability

  28. 6.3CVE-2025-0451EPSS 0.4%

    Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. (Chromium securi…

  29. 6.9CVE-2025-0729EPSS 0.4%

    A vulnerability was found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to clickjacking. The attack may be initiated remotely. Upg…

  30. 5.4CVE-2025-21262EPSS 0.4%

    User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network

  31. 4.3CVE-2025-0446EPSS 0.3%

    Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. (Chromium security s…

  32. 6.5CVE-2025-0435EPSS 0.3%

    Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)

  33. 6.5CVE-2025-21314EPSS 1.4%

    Windows SmartScreen Spoofing Vulnerability

  34. 5.4CVE-2024-55896EPSS 0.2%

    IBM PowerHA SystemMirror for i 7.4 and 7.5 contains improper restrictions when rendering content via iFrames.  This vulnerability could allow an attacker to gain improper access and perform unauthorized actions on the system.

  35. 8.8CVE-2020-9236EPSS 0.4%

    There is an improper interface design vulnerability in Huawei product. A module interface of the impated product does not deal with some operations properly. Attackers can exploit this vulnerability to perform malicious operatation to comp…

  36. 7.2CVE-2024-55889ExploitEPSS 2.2%

    phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an…

  37. 8.2CVE-2024-52271EPSS 0.2%

    User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the …

  38. 8.2CVE-2024-52270EPSS 0.2%

    User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing. Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome …

  39. 8.2CVE-2024-52269EPSS 0.3%

    User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. The SaaS AI assistant ignores hidden content that is rendered after signing, misleading the user. For reference see: CVE-2024-…

  40. 8.2CVE-2024-52277EPSS 0.2%

    User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSeal allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the p…

  41. 8.2CVE-2024-52276EPSS 0.4%

    User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. 1. Displayed version does not show the layer flattened version, which is provided when the "Print" option is used. 2. Displaye…

  42. 7.5CVE-2024-49040EPSS 8.5%

    Microsoft Exchange Server Spoofing Vulnerability

  43. 3.5CVE-2024-51749EPSS 0.4%

    Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to eve…

  44. 5.3CVE-2024-47044EPSS 0.4%

    Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access restrictions for Device Setting pages. If this vulnerability is exploited, an attacker who identif…

  45. 4.3CVE-2024-7020EPSS 0.3%

    Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  46. 4.3CVE-2024-7019EPSS 0.3%

    Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  47. 4.3CVE-2023-7282EPSS 0.2%

    Inappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security seve…

  48. 4.3CVE-2023-7281EPSS 0.2%

    Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  49. 4.3CVE-2024-8909EPSS 0.3%

    Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  50. 8.8CVE-2024-43461KEVEPSS 54%

    Windows MSHTML Platform Spoofing Vulnerability