Fallos del tipo CWE-451

387 resultados

Representação enganosa de informações críticas na interface

A aplicação apresenta informações de segurança ou avisos críticos de forma desorientadora, oculta ou disfarçada na UI, levando o usuário a tomar decisões perigosas sem compreender as consequências reais. O atacante explora isso para contornar decisões conscientes do usuário, como consentir a execução de código malicioso ou compartilhar dados sensíveis.

Ejemplo

Um navegador que exibe um aviso de certificado inválido em texto pequeno e cinzento no rodapé da página, enquanto mantém o resto do site completamente funcional e destacado, fazendo o usuário ignorar o risco e prosseguir. Ou um app que solicita permissão de câmera com a frase 'Necessário para melhor experiência' escondida em letras minúsculas, sem deixar claro que gravará vídeo.

Cómo mitigar

Deixe avisos e informações críticas de segurança visíveis, legíveis e sem ambiguidade: use cores de contraste alto, fonte adequada, posicionamento central, e linguagem clara. Exija confirmação explícita do usuário antes de ações perigosas e mostre exatamente o que será feito — nunca ocultando ou minimizando os riscos na apresentação.

CVE-2022-26383MEDIUMWhen resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affectEPSS 0.7%CVE-2024-30055MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.6%CVE-2023-2941MEDIUMInappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install aEPSS 0.6%CVE-2026-45650MEDIUMMicrosoft Bing Search Spoofing VulnerabilityEPSS 0.6%CVE-2026-0391MEDIUMMicrosoft Edge (Chromium-based) for Android Spoofing VulnerabilityEPSS 0.6%CVE-2022-45404MEDIUMThrough a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing theEPSS 0.6%CVE-2022-2800MEDIUMSourceCodester Gym Management System clickjackingEPSS 0.6%CVE-2022-38163LOWA Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. Drag and drop operatEPSS 0.6%CVE-2025-29796MEDIUMMicrosoft Edge for iOS Spoofing VulnerabilityEPSS 0.6%CVE-2025-5986MEDIUMUnsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// LinksEPSS 0.6%CVE-2021-27414MEDIUMUser interface misrepresentation of critical information in Hitachi ABB Power Grids Ellipse EAMEPSS 0.6%CVE-2023-0130MEDIUMInappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to spoof the EPSS 0.6%CVE-2026-33118MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.6%CVE-2026-64735MEDIUMAn inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOEPSS 0.5%CVE-2024-7529HIGHThe date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. EPSS 0.5%CVE-2025-30467MEDIUMThe issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4EPSS 0.5%CVE-2025-47963MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.5%CVE-2026-35429MEDIUMMicrosoft Edge (Chromium-based) for Android Spoofing VulnerabilityEPSS 0.5%CVE-2024-38093MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.5%CVE-2024-38082MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.5%