CWE-451 · User Interface (UI) Misrepresentation of Critical Information (page 4)
Page 4 of 5 — CVEs classified under CWE-451, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8364 | Medium | 4.3 | 2025-08-19 | A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. *Note: This issue only affected Androi… |
CVE-2025-8041 | Medium | 5.3 | 2025-08-19 | In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox… |
CVE-2025-49755 | Medium | 4.3 | 2025-08-12 | User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-8583 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-43228 | Medium | 4.3 | 2025-07-30 | The issue was addressed with improved UI. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6. Visiting a malicious website may lead to address bar sp… |
CVE-2025-43712 | Low | 2.9 | 2025-07-25 | JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard… |
CVE-2025-8043 | Critical | 9.8 | 2025-07-22 | Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141. |
CVE-2025-47964 | Medium | 5.4 | 2025-07-11 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2025-47963 | Medium | 6.3 | 2025-07-11 | No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-7021 | Medium | 6.5 | 2025-07-10 | Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture… |
CVE-2024-39730 | Medium | 5.4 | 2025-06-28 | IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a mali… |
CVE-2025-5986 | Medium | 6.5 | 2025-06-11 | A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompti… |
CVE-2025-5066 | Medium | 6.5 | 2025-05-27 | Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2025-5065 | Medium | 6.5 | 2025-05-27 | Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTM… |
CVE-2024-9163 | Low | 3.5 | 2025-05-23 | A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an att… |
CVE-2025-29825 | Medium | 6.5 | 2025-05-02 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2025-3859 | Medium | 6.1 | 2025-04-30 | Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into… |
CVE-2025-4086 | Medium | 6.5 | 2025-04-29 | A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. … |
CVE-2025-46394 | Low | 3.2 | 2025-04-23 | In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences. |
CVE-2025-3523 | Medium | 6.4 | 2025-04-15 | When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering ove… |
CVE-2025-32371 | Medium | 4.3 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to… |
CVE-2025-29796 | Medium | 4.7 | 2025-04-04 | User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-3074 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2025-3073 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-3072 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI ges… |
CVE-2025-30467 | Medium | 4.3 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4. Visiting a malici… |
CVE-2024-54558 | Low | 2.8 | 2025-03-10 | A clickjacking issue was addressed with improved out-of-process view handling. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be abl… |
CVE-2025-1922 | Medium | 4.3 | 2025-03-05 | Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specif… |
CVE-2025-21259 | Medium | 5.3 | 2025-02-11 | Microsoft Outlook Spoofing Vulnerability |
CVE-2025-21404 | Medium | 4.3 | 2025-02-06 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2025-21253 | Medium | 5.3 | 2025-02-06 | Microsoft Edge for IOS and Android Spoofing Vulnerability |
CVE-2025-0451 | Medium | 6.3 | 2025-02-04 | Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engage in specific UI… |
CVE-2025-0729 | Medium | 4.3 | 2025-01-27 | A vulnerability was found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. It has been rated as problematic. This issue affects some unknown processing. T… |
CVE-2025-21262 | Medium | 5.4 | 2025-01-24 | User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2025-0446 | Medium | 4.3 | 2025-01-15 | Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-0435 | Medium | 6.5 | 2025-01-15 | Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2025-21314 | Medium | 6.5 | 2025-01-14 | Windows SmartScreen Spoofing Vulnerability |
CVE-2024-55896 | Medium | 5.4 | 2025-01-03 | IBM PowerHA SystemMirror for i 7.4 and 7.5 contains improper restrictions when rendering content via iFrames. This vulnerability could allow an attacker to ga… |
CVE-2020-9236 | High | 8.8 | 2024-12-27 | There is an improper interface design vulnerability in Huawei product. A module interface of the impated product does not deal with some operations properly. A… |
CVE-2024-55889 | Medium | 4.9 | 2024-12-13 | phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can tri… |
CVE-2024-52271 | | 2024-12-05 | User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flat… | |
CVE-2024-52270 | | 2024-12-05 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing. Displayed version does not show… | |
CVE-2024-52269 | High | 8.1 | 2024-12-04 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. The SaaS AI assistant ignores hidden content t… |
CVE-2024-52277 | | 2024-12-04 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSeal allows Content Spoofing.Displayed version does not show the layer flatt… | |
CVE-2024-52276 | High | 7.5 | 2024-12-04 | User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. 1. Displayed version does not show the layer f… |
CVE-2024-49040 | High | 7.5 | 2024-11-12 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2024-51749 | Low | 3.5 | 2024-11-12 | Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attach… |
CVE-2024-47044 | Medium | 5.3 | 2024-09-26 | Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access restrictions for D… |
CVE-2024-7020 | Medium | 4.3 | 2024-09-23 | Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chr… |
CVE-2024-7019 | Medium | 4.3 | 2024-09-23 | Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2023-7282 | Medium | 4.3 | 2024-09-23 | Inappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2023-7281 | Medium | 4.3 | 2024-09-23 | Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform UI spoofing via a crafted HTML page… |
CVE-2024-8909 | Medium | 4.3 | 2024-09-17 | Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2024-43461 | High | 8.8 | 2024-09-10 | Windows MSHTML Platform Spoofing Vulnerability |
CVE-2024-38197 | Medium | 6.5 | 2024-08-13 | Microsoft Teams for iOS Spoofing Vulnerability |
CVE-2024-6999 | Medium | 4.3 | 2024-08-06 | Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2024-7529 | Medium | 6.5 | 2024-08-06 | The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This vulnerability… |
CVE-2024-6595 | Low | 3.0 | 2024-07-17 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2023-7011 | Medium | 6.5 | 2024-07-16 | Inappropriate implementation in Picture in Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to spoof the contents of the Omnibox (URL… |
CVE-2024-38112 | High | 7.5 | 2024-07-09 | Windows MSHTML Platform Spoofing Vulnerability |
CVE-2024-6610 | Medium | 4.3 | 2024-07-09 | Form validation popups could capture escape key presses. Therefore, spamming form validation messages could be used to prevent users from exiting full-screen m… |
CVE-2024-38093 | Medium | 4.3 | 2024-06-20 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-38082 | Medium | 4.7 | 2024-06-20 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-38313 | Medium | 4.3 | 2024-06-13 | In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This vulne… |
CVE-2024-5698 | Medium | 6.1 | 2024-06-11 | By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user… |
CVE-2024-4950 | Medium | 6.5 | 2024-05-15 | Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2024-30055 | Medium | 5.4 | 2024-05-14 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-23708 | High | 7.8 | 2024-05-07 | In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has been accessed. This… |
CVE-2024-2631 | Medium | 4.3 | 2024-03-20 | Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium… |
CVE-2023-50938 | Medium | 6.5 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site… |
CVE-2024-0805 | Medium | 4.3 | 2024-01-24 | Inappropriate implementation in Downloads in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to perform domain spoofing via a crafted domain nam… |
CVE-2024-0750 | High | 8.8 | 2024-01-23 | A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affect… |
CVE-2023-2941 | Medium | 4.3 | 2023-05-30 | Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extensio… |
CVE-2023-2938 | Medium | 4.3 | 2023-05-30 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process t… |
CVE-2023-2937 | Medium | 4.3 | 2023-05-30 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process t… |
CVE-2023-0700 | Medium | 6.5 | 2023-02-07 | Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contents of the Omnibox (UR… |
CVE-2023-0130 | Medium | 6.5 | 2023-01-10 | Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to spoof the contents of the Omn… |
CVE-2022-45404 | Medium | 6.5 | 2022-12-22 | Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification promp… |
CVE-2022-34479 | Medium | 6.5 | 2022-12-22 | A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusi… |
CVE-2022-26383 | Medium | 4.3 | 2022-12-22 | When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affects Firefox < 98, Fir… |
CVE-2022-22762 | Medium | 4.3 | 2022-12-22 | Under certain circumstances, a JavaScript alert (or prompt) could have been shown while another website was displayed underneath it. This could have been abuse… |
CVE-2022-20530 | Medium | 5.3 | 2022-12-16 | In strings.xml, there is a possible permission bypass due to a misleading string. This could lead to remote information disclosure of call logs with no additio… |
CVE-2022-38163 | Low | 3.5 | 2022-11-07 | A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. Drag and drop operation by user on addr… |
CVE-2022-3313 | Medium | 6.5 | 2022-11-01 | Incorrect security UI in full screen in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium… |
CVE-2022-39258 | High | 8.1 | 2022-09-27 | mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links… |
CVE-2022-32816 | Medium | 6.5 | 2022-09-23 | The issue was addressed with improved UI handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. Visiting a web… |
CVE-2022-2800 | Medium | 4.3 | 2022-08-12 | A vulnerability, which was classified as problematic, has been found in SourceCodester Gym Management System. Affected by this issue is some unknown functional… |
CVE-2021-27773 | Medium | 4.2 | 2022-05-12 | This vulnerability allows users to execute a clickjacking attack in the meeting's chat. |
CVE-2021-27414 | Medium | 5.5 | 2022-03-11 | An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 into visiting a mali… |
CVE-2022-23646 | Medium | 5.9 | 2022-02-17 | Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Criti… |
CVE-2021-41598 | High | 8.8 | 2022-01-25 | A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authoriz… |
CVE-2021-33593 | Medium | 5.3 | 2021-11-02 | Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar… |
CVE-2021-22866 | High | 8.8 | 2021-05-14 | A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authoriz… |
CVE-2020-7371 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true s… |
CVE-2020-7370 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfusca… |
CVE-2020-7369 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true s… |
CVE-2020-7364 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true s… |
CVE-2020-7363 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true s… |
CVE-2020-10775 | Medium | 5.3 | 2020-08-24 | An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites an… |
CVE-2017-0888 | Medium | 4.3 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app. The top navigation bar displayed in the files list… |