65 matches found
CVE-2025-22445 Misleading UI for undefined admin console settings in Calls causes security confusion
Mattermost versions 10.x = 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting...
PT-2024-5570 · Juniper Networks · Junos
Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 21.2R3-S7 Junos OS versions 21.4 prior to 21.4R3-S6 Junos OS versions 22.1 prior to 22.1R3-S5 Junos OS versions 22.2 prior to 22.2R3-S3 Junos OS versions 22.3 prior to 22.3R3-S2 Junos OS versions 22.4 prior to 22.4R...
CVE-2023-5512
CVE-2023-5512 affects GitLab CE/EE and concerns file integrity being compromised when specific HTML encoding is used for file names, causing incorrect UI representations. Affected versions: 16.3–16.4.3, 16.5–16.5.3, and 16.6–16.6.1. Root cause is a UI/filename encoding issue; no exploit details a...
PT-2023-3712 · Google +2 · Google Chrome +2
Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 115.0.5790.98 Description: The issue is related to an inappropriate implementation in Web API Permission Prompts in Google Chrome, which may allow a remote attacker to obfuscate security UI via a crafted HTML...
CVE-2023-21237
CVE-2023-21237 affects Android Framework UI logic in NotificationContentInflater.java (applyRemoteView) that can hide a foreground service notification due to misleading or insufficient UI, enabling local information disclosure without extra privileges. Public sources confirm impact on Android 13...
SUSE CVE-2019-5812
Inadequate security UI in iOS UI in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to perform domain spoofing via a crafted HTML page...
Google Chrome 安全漏洞
Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome, which stems from an improper implementation of the full-screen API that allows remote attackers to execute an incorrect security UI via a crafted HTML page, and affects the following products and...
PT-2022-22162 · Dell · Dell Hybrid Client
Name of the Vulnerable Software and Affected Versions: Dell Hybrid Client versions prior to 1.8 Description: The issue is related to a Regular Expression Denial of Service in the UI. An adversary with WMS group admin access could potentially exploit this, leading to temporary denial-of-service...
in kcal-app/kcal
Description Sensitive Data can be exposed even after logouting the application due to ui wrong action Proof of Concept 1 login to the application dashboard http://demo.kcal.cooking/ 2 Goto Any pages recipes,foods 3 Click logout 4 Click browser back button Application structure exposed we can stil...
Code injection
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Drop link to a federated share. This causes an issue on the UI side of the sharing user. When the sharing user opens the sharing panel and...
CVE-2021-32655 Files Drop public link can be added as federated share
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Drop link to a federated share. This causes an issue on the UI side of the sharing user. When the sharing user opens the sharing panel and...
CVE-2021-32655
The CVE-2021-32655 entry concerns Nextcloud Server: in versions prior to 19.0.11, 20.0.10, and 21.0.2 an attacker could convert a Files Drop link into a federated share. When the sharing user opens the panel and removes the Create privileges from this unexpected share, the system silently grants ...
Files Drop public link can be added as federated share
None...
CVE-2020-9942
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, Safari 13.1.2. Visiting a malicious website may lead to address bar spoofing...
CVE-2020-9987
CVE-2020-9987 is an Apple Safari vulnerability describing an inconsistent UI issue that allowed address bar spoofing when visiting a malicious site. Connected sources confirm the root cause as a state-management/UI handling problem and indicate Safari 14.0 (Big Sur era) patching the flaw; exploit...
CVE-2018-4391
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan, watchOS 4.3, iOS 12.1. Processing a maliciously crafted text message may lead to UI spoofi...
CVE-2018-4390
The CVE affects Apple devices via Message handling: an inconsistent UI state (UI spoofing) when processing a maliciously crafted text message. Root cause cited as improved state management in related Apple advisories. Affected products/versions include iOS 12.1 and earlier iOS 12.x, watchOS 4.3, ...
About the security content of Safari 13.0.5
About the security content of Safari 13.0.5 This document describes the security content of Safari 13.0.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...
Design/Logic Flaw
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.6, Safari 12.1.2. Visiting a malicious website may lead to address bar spoofing...
