Base de CVEs

CVE-2025-14023 Média · 4.3 CWE-451 15/12/2025

LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the…

LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could create confusion about the trust context of displayed pages or interactive elements under specific conditions.

CVE-2025-14021 Média · 4.3 CWE-451 15/12/2025

The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to…

The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaScript within iframes while displaying trusted URLs, enabling phishing attacks through overlaid malicious content.

CVE-2025-14020 Média · 4.3 CWE-451 15/12/2025

LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in…

LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security Toast notification is not properly re-displayed when users return from another application, potentially allowing attackers to conduct phishing attacks by impersonating legitimate interfaces.

CVE-2025-14019 Média · 4.7 CWE-451 15/12/2025

LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the…

LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure the full-screen warning prompt, potentially allowing attackers to conduct phishing attacks.

CVE-2025-46287 Média · 6.5 CWE-451 12/12/2025

An inconsistent user interface issue was addressed with improved state management. This…

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An attacker may be able to spoof their FaceTime caller ID.

CVE-2025-64667 Média · 5.3 CWE-451 09/12/2025

Microsoft Exchange Server Spoofing Vulnerability

User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-62223 Média · 4.3 CWE-451 04/12/2025

Microsoft Edge (Chromium-based) for Mac Spoofing Vulnerability

User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-31266 Média · 4.3 CWE-451 21/11/2025

A spoofing issue was addressed with improved truncation when displaying the fully qualified...

A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name. This issue is fixed in Safari 18.5, macOS Sequoia 15.5. A website may be able to spoof the domain name in the title of a pop-up window.

CVE-2025-13082 Média · 4.3 CWE-451 18/11/2025

Drupal core - Moderately critical - Defacement - SA-CORE-2025-007

User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

CVE-2025-13107 Média · 4.3 CWE-451 14/11/2025

Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80…

Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-13102 Média · 4.3 CWE-451 14/11/2025

Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to…

Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2024-7021 Média · 4.3 CWE-451 14/11/2025

Inappropriate implementation in Autofill in Google Chrome on Windows prior to…

Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2024-13178 Média · 4.3 CWE-451 14/11/2025

Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84…

Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2024-11919 Média · 4.3 CWE-451 14/11/2025

Inappropriate implementation in Intents in Google Chrome on Android prior to…

Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-12729 Média · 4.2 CWE-451 10/11/2025

Inappropriate implementation in Omnibox in Google Chrome on Android prior to…

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-12728 Média · 4.2 CWE-451 10/11/2025

Inappropriate implementation in Omnibox in Google Chrome on Android prior to…

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-12446 Média · 4.2 CWE-451 10/11/2025

Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a…

Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. (Chromium security severity: Low)

CVE-2025-12911 Média · 4.3 CWE-451 07/11/2025

Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80…

Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-11213 Média · 6.3 CWE-451 06/11/2025

Inappropriate implementation in Omnibox in Google Chrome on Android prior to…

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-11212 Média · 6.3 CWE-451 06/11/2025

Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54…

Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-11208 Média · 6.3 CWE-451 06/11/2025

Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a…

Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-11720 Alta · 8.1 CWE-451 14/10/2025

Spoofing risk in Android custom tabs

The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability was fixed in Firefox 144.

CVE-2025-11718 Média · 6.5 CWE-451 14/10/2025

Address bar could be spoofed on Android using visibilitychange

When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychange event. This vulnerability was fixed in Firefox 144.

CVE-2025-43327 Média · 6.5 CWE-451 15/09/2025

The issue was addressed by adding additional logic. This issue is fixed in Safari 26, macOS Tahoe...

The issue was addressed by adding additional logic. This issue is fixed in Safari 26, macOS Tahoe 26. Visiting a malicious website may lead to address bar spoofing.

CVE-2024-43461 Alta · 8.8 KEV Alta · 56 CWE-451 10/09/2024

Microsoft Windows MSHTML Platform Spoofing Vulnerability

Windows MSHTML Platform Spoofing Vulnerability