CWE-451 User Interface (UI) Misrepresentation of Critical Information
classThe user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (686)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-43461US | —OT critical | KEV | ||
Windows MSHTML Platform Spoofing Vulnerability | ||||
| CVE-2024-38112US | —OT critical | KEV | ||
Windows MSHTML Platform Spoofing Vulnerability | ||||
| CVE-2023-29357US | —OT critical | KEV | ||
Microsoft SharePoint Server Elevation of Privilege Vulnerability | ||||
| CVE-2021-36942US | medium5.0OT critical | KEV | ||
Windows LSA Spoofing Vulnerability | ||||
| CVE-2025-9491US | high7.8 | Exploit | ||
Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations… | ||||
| CVE-2021-41349US | medium4.3 | Exploit | ||
Microsoft Exchange Server Spoofing Vulnerability | ||||
| CVE-2024-21320US | medium6.5 | Exploit | ||
Windows Themes Spoofing Vulnerability | ||||
| CVE-2024-23708US | high7.8 | Exploit | ||
In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has been accessed. This could lead to local e… | ||||
| CVE-2024-55889US | high7.2 | Exploit | ||
phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download… | ||||
| CVE-2023-36018US | critical9.8 | — | ||
Visual Studio Code Jupyter Extension Spoofing Vulnerability | ||||
| CVE-2026-2634US | critical9.8 | — | ||
Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be prese… | ||||
| CVE-2020-35685US | critical9.1OT elevated | — | ||
An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As… | ||||
| CVE-2023-36019US | high7.4 | — | ||
Microsoft Power Platform Connector Spoofing Vulnerability | ||||
| CVE-2020-9236US | high8.8 | — | ||
There is an improper interface design vulnerability in Huawei product. A module interface of the impated product does not deal with some operations properly. Attackers can exploit… | ||||
| CVE-2024-0750US | high8.8 | — | ||
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 122, Fire… | ||||
| CVE-2021-41598US | high8.8 | — | ||
A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than w… | ||||
| CVE-2021-22866US | high8.8 | — | ||
A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than w… | ||||
| CVE-2022-39258US | high8.2 | — | ||
mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect… | ||||
| CVE-2026-109346US | high8.1 | — | ||
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id a… | ||||
| CVE-2026-32971US | high8.0OT elevated | — | ||
OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell payloads instead of the executed argv. Attack… | ||||
04
attack patterns (5)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan