CWE-449
The UI Performs the Wrong Action
Description
The UI performs the wrong action with respect to the user's request.
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (14)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-43585 | Hig | 0.46 | 7.1 | 0.01 | Dec 13, 2023 | Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access. | ||
| CVE-2023-39215 | Hig | 0.46 | 7.1 | 0.01 | Sep 12, 2023 | Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access. | ||
| CVE-2023-36535 | Hig | 0.46 | 7.1 | 0.01 | Aug 8, 2023 | Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosure via network access. | ||
| CVE-2023-39209 | Med | 0.38 | 5.9 | 0.01 | Aug 8, 2023 | Improper input validation in Zoom Desktop Client for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via network access. | ||
| CVE-2025-26643 | Med | 0.35 | 5.4 | 0.01 | Mar 7, 2025 | The UI performs the wrong action in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | ||
| CVE-2025-56139 | Med | 0.34 | 5.3 | 0.00 | Sep 3, 2025 | LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user replaces the original URL in a post or comment before publishing. As a result, the stale preview remains visible while the clickable link… | ||
| CVE-2024-24698 | Med | 0.32 | 4.9 | 0.01 | Feb 14, 2024 | Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access. | ||
| CVE-2025-13637 | Med | 0.28 | 4.3 | 0.00 | Dec 2, 2025 | Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass download protections via a crafted HTML page. (Chromium security severity: Low) | ||
| CVE-2025-49736 | Med | 0.28 | 4.3 | 0.00 | Aug 12, 2025 | The ui performs the wrong action in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. | ||
| CVE-2025-21404 | Med | 0.28 | 4.3 | 0.01 | Feb 6, 2025 | Microsoft Edge (Chromium-based) Spoofing Vulnerability | ||
| CVE-2024-49041 | Med | 0.28 | 4.3 | 0.01 | Dec 6, 2024 | Microsoft Edge (Chromium-based) Spoofing Vulnerability | ||
| CVE-2024-43577 | Med | 0.28 | 4.3 | 0.00 | Oct 18, 2024 | Microsoft Edge (Chromium-based) Spoofing Vulnerability | ||
| CVE-2024-38083 | Med | 0.28 | 4.3 | 0.00 | Jun 13, 2024 | Microsoft Edge (Chromium-based) Spoofing Vulnerability | ||
| CVE-2023-43588 | Low | 0.23 | 3.5 | 0.01 | Nov 15, 2023 | Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access. |
- risk 0.46cvss 7.1epss 0.01
Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access.
- risk 0.46cvss 7.1epss 0.01
Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access.
- risk 0.46cvss 7.1epss 0.01
Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosure via network access.
- risk 0.38cvss 5.9epss 0.01
Improper input validation in Zoom Desktop Client for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via network access.
- risk 0.35cvss 5.4epss 0.01
The UI performs the wrong action in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- risk 0.34cvss 5.3epss 0.00
LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user replaces the original URL in a post or comment before publishing. As a result, the stale preview remains visible while the clickable link…
- risk 0.32cvss 4.9epss 0.01
Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.
- risk 0.28cvss 4.3epss 0.00
Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass download protections via a crafted HTML page. (Chromium security severity: Low)
- risk 0.28cvss 4.3epss 0.00
The ui performs the wrong action in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
- risk 0.28cvss 4.3epss 0.01
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- risk 0.28cvss 4.3epss 0.01
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- risk 0.28cvss 4.3epss 0.00
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- risk 0.28cvss 4.3epss 0.00
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- risk 0.23cvss 3.5epss 0.01
Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access.