CWE-451 · User Interface (UI) Misrepresentation of Critical Information (page 4)
Page 4 of 4 — CVEs classified under CWE-451, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6595 | Low | 3.0 | 2024-07-17 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2023-7011 | Medium | 6.5 | 2024-07-16 | Inappropriate implementation in Picture in Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to spoof the contents of the Omnibox (URL… |
CVE-2024-38112 | High | 7.5 | 2024-07-09 | Windows MSHTML Platform Spoofing Vulnerability |
CVE-2024-6610 | Medium | 4.3 | 2024-07-09 | Form validation popups could capture escape key presses. Therefore, spamming form validation messages could be used to prevent users from exiting full-screen m… |
CVE-2024-38093 | Medium | 4.3 | 2024-06-20 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-38082 | Medium | 4.7 | 2024-06-20 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-38313 | Medium | 4.3 | 2024-06-13 | In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This vulne… |
CVE-2024-5698 | Medium | 6.1 | 2024-06-11 | By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user… |
CVE-2024-4950 | Medium | 6.5 | 2024-05-15 | Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2024-30055 | Medium | 5.4 | 2024-05-14 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-23708 | High | 7.8 | 2024-05-07 | In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has been accessed. This… |
CVE-2024-2631 | Medium | 4.3 | 2024-03-20 | Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium… |
CVE-2023-50938 | Medium | 6.5 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site… |
CVE-2024-0805 | Medium | 4.3 | 2024-01-24 | Inappropriate implementation in Downloads in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to perform domain spoofing via a crafted domain nam… |
CVE-2024-0750 | High | 8.8 | 2024-01-23 | A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affect… |
CVE-2023-2941 | Medium | 4.3 | 2023-05-30 | Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extensio… |
CVE-2023-2938 | Medium | 4.3 | 2023-05-30 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process t… |
CVE-2023-2937 | Medium | 4.3 | 2023-05-30 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process t… |
CVE-2023-0700 | Medium | 6.5 | 2023-02-07 | Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contents of the Omnibox (UR… |
CVE-2023-0130 | Medium | 6.5 | 2023-01-10 | Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to spoof the contents of the Omn… |
CVE-2022-45404 | Medium | 6.5 | 2022-12-22 | Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification promp… |
CVE-2022-34479 | Medium | 6.5 | 2022-12-22 | A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusi… |
CVE-2022-26383 | Medium | 4.3 | 2022-12-22 | When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affects Firefox < 98, Fir… |
CVE-2022-22762 | Medium | 4.3 | 2022-12-22 | Under certain circumstances, a JavaScript alert (or prompt) could have been shown while another website was displayed underneath it. This could have been abuse… |
CVE-2022-20530 | Medium | 5.3 | 2022-12-16 | In strings.xml, there is a possible permission bypass due to a misleading string. This could lead to remote information disclosure of call logs with no additio… |
CVE-2022-38163 | Low | 3.5 | 2022-11-07 | A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. Drag and drop operation by user on addr… |
CVE-2022-3313 | Medium | 6.5 | 2022-11-01 | Incorrect security UI in full screen in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium… |
CVE-2022-39258 | High | 8.1 | 2022-09-27 | mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links… |
CVE-2022-32816 | Medium | 6.5 | 2022-09-23 | The issue was addressed with improved UI handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. Visiting a web… |
CVE-2022-2800 | Medium | 4.3 | 2022-08-12 | A vulnerability, which was classified as problematic, has been found in SourceCodester Gym Management System. Affected by this issue is some unknown functional… |
CVE-2021-27773 | Medium | 4.2 | 2022-05-12 | This vulnerability allows users to execute a clickjacking attack in the meeting's chat. |
CVE-2021-27414 | Medium | 5.5 | 2022-03-11 | An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 into visiting a mali… |
CVE-2022-23646 | Medium | 5.9 | 2022-02-17 | Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Criti… |
CVE-2021-41598 | High | 8.8 | 2022-01-25 | A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authoriz… |
CVE-2021-33593 | Medium | 5.3 | 2021-11-02 | Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar… |
CVE-2021-22866 | High | 8.8 | 2021-05-14 | A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authoriz… |
CVE-2020-7371 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true s… |
CVE-2020-7370 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfusca… |
CVE-2020-7369 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true s… |
CVE-2020-7364 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true s… |
CVE-2020-7363 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true s… |
CVE-2020-10775 | Medium | 5.3 | 2020-08-24 | An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites an… |
CVE-2017-0888 | Medium | 4.3 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app. The top navigation bar displayed in the files list… |
CVE-2016-9473 | Medium | 4.7 | 2017-03-28 | Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by dis… |
CVE-2016-9468 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed… |
CVE-2016-9467 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files… |
CVE-2016-9460 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app w… |