Falhas do tipo CWE-451

387 resultados

Má representação de informações críticas na interface

A aplicação exibe informações de segurança críticas de forma enganosa, confusa ou incompleta na interface do usuário. Isso leva o usuário a tomar decisões perigosas — como confiar em dados falsos, ignorar avisos reais ou autorizar operações maliciosas — porque a UI não comunica o risco com clareza.

Exemplo

Um navegador que mostra um aviso de certificado SSL inválido em letras minúsculas cinzentas no rodapé da página, enquanto a barra de endereço verde continua exibindo cadeado. Ou um aplicativo bancário que não deixa evidente se uma transação é reversível ou definitiva, levando o usuário a confirmar uma transferência irreversível sem entender as consequências.

Como mitigar

Destaque informações críticas (avisos, confirmações, mudanças de estado) com contraste visual alto, ícones claros e mensagens em linguagem simples. Implemente confirmações explícitas para operações irreversíveis e testes de usabilidade com usuários reais para validar se entendem os riscos antes de agir.

CVE-2022-26383MEDIUMWhen resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affectEPSS 0.7%CVE-2024-30055MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.6%CVE-2023-2941MEDIUMInappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install aEPSS 0.6%CVE-2026-45650MEDIUMMicrosoft Bing Search Spoofing VulnerabilityEPSS 0.6%CVE-2026-0391MEDIUMMicrosoft Edge (Chromium-based) for Android Spoofing VulnerabilityEPSS 0.6%CVE-2022-45404MEDIUMThrough a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing theEPSS 0.6%CVE-2022-2800MEDIUMSourceCodester Gym Management System clickjackingEPSS 0.6%CVE-2022-38163LOWA Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. Drag and drop operatEPSS 0.6%CVE-2025-29796MEDIUMMicrosoft Edge for iOS Spoofing VulnerabilityEPSS 0.6%CVE-2025-5986MEDIUMUnsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// LinksEPSS 0.6%CVE-2021-27414MEDIUMUser interface misrepresentation of critical information in Hitachi ABB Power Grids Ellipse EAMEPSS 0.6%CVE-2023-0130MEDIUMInappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to spoof the EPSS 0.6%CVE-2026-33118MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.6%CVE-2026-64735MEDIUMAn inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOEPSS 0.5%CVE-2024-7529HIGHThe date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. EPSS 0.5%CVE-2025-30467MEDIUMThe issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4EPSS 0.5%CVE-2025-47963MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.5%CVE-2026-35429MEDIUMMicrosoft Edge (Chromium-based) for Android Spoofing VulnerabilityEPSS 0.5%CVE-2024-38093MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.5%CVE-2024-38082MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.5%