Weaknesses of type CWE-451

506 results

Representação enganosa de informação crítica na interface

A aplicação apresenta informações de segurança ou críticas de forma enganosa, confusa ou oculta na interface. Um usuário não consegue identificar claramente riscos, avisos de segurança ou status autêntico da aplicação, levando a decisões incorretas. Exemplos comuns: cadeado falso em phishing, avisos de segurança com estilo igual a anúncios legítimos, ou status de autenticação não evidente.

Example

Um site de phishing usa CSS para desenhar um ícone de cadeado genuíno na barra de endereço, ou oculta avisos críticos de certificado inválido em texto pequeno e cor opaca. Outro caso: app mobile que não deixa claro quando uma conexão está criptografada versus em texto plano.

How to mitigate

Garanta que informações críticas (status de autenticação, certificados válidos, avisos de segurança) sejam apresentadas de forma proeminente, inambígua e não-adulterável pela aplicação. Use padrões do SO para indicadores de segurança, testes de usabilidade para validar clareza de avisos, e desconfie de interfaces que ocultam ou disfarçam estado de segurança.

CVE-2025-43327MEDIUMThe issue was addressed by adding additional logic. This issue is fixed in Safari 26, macOS Tahoe 26. Visiting a malicious website may lead EPSS 0.5%CVE-2024-38093MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.5%CVE-2024-38082MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.5%CVE-2026-35429MEDIUMMicrosoft Edge (Chromium-based) for Android Spoofing VulnerabilityEPSS 0.5%CVE-2024-6999MEDIUMInappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in spEPSS 0.5%CVE-2026-26320HIGHOpenClaw macOS deep link confirmation truncation can conceal executed agent messageEPSS 0.5%CVE-2026-64730MEDIUMThe issue was addressed with improved UI. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOEPSS 0.5%CVE-2025-47964MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.5%CVE-2025-46287CRITICALAn inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS EPSS 0.5%CVE-2021-27773MEDIUMHCL Sametime is vulnerable to clickjackingEPSS 0.5%CVE-2025-62223MEDIUMMicrosoft Edge (Chromium-based) for Mac Spoofing VulnerabilityEPSS 0.5%CVE-2025-8043CRITICALIncorrect URL truncationEPSS 0.4%CVE-2025-0729MEDIUMTP-Link TL-SG108E clickjackingEPSS 0.4%CVE-2020-9236HIGHThere is an improper interface design vulnerability in Huawei product. A module interface of the impated product does not deal with some opeEPSS 0.4%CVE-2024-47044MEDIUMMultiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient accessEPSS 0.4%CVE-2023-7011MEDIUMInappropriate implementation in Picture in Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to spoof the contents EPSS 0.4%CVE-2025-5066MEDIUMInappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user tEPSS 0.4%CVE-2025-5065MEDIUMInappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofinEPSS 0.4%CVE-2024-9163LOWUser Interface (UI) Misrepresentation of Critical Information in GitLabEPSS 0.4%CVE-2023-50938MEDIUMIBM PowerSC clickjackingEPSS 0.4%