CWE-357 Insufficient UI Warning of Dangerous Operations
baseThe user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (50)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-3863US | critical9.8 | — | ||
The executable file warning was not presented when downloading .xrm-ms files.
*Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*… | ||||
| CVE-2024-0750US | high8.8 | — | ||
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 122, Fire… | ||||
| CVE-2022-34483US | high8.8 | — | ||
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by exten… | ||||
| CVE-2022-34482US | high8.8 | — | ||
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by exten… | ||||
| CVE-2022-22756US | high8.8 | — | ||
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbi… | ||||
| CVE-2019-13521US | high7.8 | — | ||
A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in the limited exposure o… | ||||
| CVE-2025-49587US | high8.0 | — | ||
XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an… | ||||
| CVE-2025-49585US | high8.0 | — | ||
XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right cre… | ||||
| CVE-2025-49582US | high8.0 | — | ||
XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns abo… | ||||
| CVE-2023-2255US | medium5.3 | Exploit | ||
Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without pro… | ||||
| CVE-2021-22645US | high7.8 | — | ||
Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.… | ||||
| CVE-2023-37208US | high7.8 | — | ||
When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbi… | ||||
| CVE-2022-36970US | high7.8 | — | ||
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 20.0 Build: 4201.2111.1802.0000 Service Pack 2. User interaction is req… | ||||
| CVE-2023-25743US | high7.5 | — | ||
A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only affects Firefox Focus. Other versions o… | ||||
| CVE-2023-5727US | medium6.5 | — | ||
The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a user's computer.
*Note: This issue on… | ||||
| CVE-2023-37210US | medium6.5 | — | ||
A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This vulnerability affect… | ||||
| CVE-2023-37204US | medium6.5 | — | ||
A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational function. This could have led to user confusi… | ||||
| CVE-2023-37207US | medium6.5 | — | ||
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion a… | ||||
| CVE-2022-2226US | medium6.5OT erhöht | — | ||
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will b… | ||||
| CVE-2022-29914US | medium6.5 | — | ||
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. This vulnerability affects… | ||||
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan