Missing User Interaction for Potentially Unsafe Action
CWE-356
The product encounters a situation in which some of its behavior is security-critical and should be authorized by a human before progressing, but it does not properly consult with the human user or its proxy (such as UI approval dialogues or pre-set policies) to determine whether it is allowed to perform the potentially dangerous behavior.
We track 19 vulnerabilities of this type. 95% are rated high or critical, and the average CVSS score is 7.7. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Product systems should warn users that a potentially dangerous action may occur if the user proceeds. For example, if the user downloads a file from an unknown source and attempts to execute the file on their machine, then the application's GUI can indicate that the file is unsafe.
Latest Missing User Interaction for Potentially Unsafe Action vulnerabilities
- 6.5 Medium severity
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Exploited
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- 7.8 High severity
Android: Missing User Interaction for Potentially Unsafe Action
In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for explo
- 7.8 High severity
Xmind: Missing User Interaction for Potentially Unsafe Action
Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xmind. User interaction is required to exploit this vulnerability in that the target
- 8.0 High severity
zed: Missing User Interaction for Potentially Unsafe Action
Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does not show after the tool was being invoked, which parameters were used. Thus, maybe unwanted or even
- 7.0 High severity
PDF Architect: Missing User Interaction for Potentially Unsafe Action
pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this
- 7.8 High severity
PDF Architect: Missing User Interaction for Potentially Unsafe Action
pdfforge PDF Architect Launch Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vu
- 7.0 High severity
PDF Architect: Missing User Interaction for Potentially Unsafe Action
pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this
- 7.8 High severity
Desktop: Missing User Interaction for Potentially Unsafe Action
Soda PDF Desktop Launch Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability
- 7.8 High severity
Desktop: Missing User Interaction for Potentially Unsafe Action
Soda PDF Desktop Word File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerabili
- 7.8 High severity
Desktop: Missing User Interaction for Potentially Unsafe Action
Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerabilit
- 7.0 High severity
Enhanced: Missing User Interaction for Potentially Unsafe Action
PDFsam Enhanced XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability
- 7.8 High severity
Enhanced: Missing User Interaction for Potentially Unsafe Action
PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in
- 7.0 High severity
Enhanced: Missing User Interaction for Potentially Unsafe Action
PDFsam Enhanced DOC File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability
- 7.5 High severity
Junie: Missing User Interaction for Potentially Unsafe Action
In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 information disclosure was possible via search_project function
- 8.1 High severity
Thunderbird: Missing User Interaction for Potentially Unsafe Action
Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incor
- 8.8 High severity
Vision Builder AI: Missing User Interaction for Potentially Unsafe Action
NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI Vision Builder AI. User interaction is required to exploit this
- 7.8 High severity
Edge: Missing User Interaction for Potentially Unsafe Action
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 20.0 Build: 4201.2111.1802.0000 Service Pack 2. User interaction is required to exploit this vulnerability in that the target must visit a malicious pa
- 8.8 High severity
metabase: Missing User Interaction for Potentially Unsafe Action
Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, 0
- 7.8 High severity
Ignition: Missing User Interaction for Potentially Unsafe Action
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or o