CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- lab digital wagtail-2fa2FA bypass in Wagtail through new device path8.7 High
- sap ui, sap se ui 700 +1 moreSAP UI5 HTTP Handler (corrected in SAP_UI versions 7.5, 7.51, 7.52, 7.53, 7.54 and SAP UI_700...5.3 Medium
- microsoft azure stackA spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure...7.5 High
- isc bind, nic knot resolver, nlnetlabs nsd +1 more +3 moreCache Poisoning issue exists in DNS Response Rate Limiting.5.9 Medium
- ready wireless emergency alertsThe Wireless Emergency Alerts (WEA) protocol allows remote attackers to spoof a Presidential...5.3 Medium
- google chrome, opensuse backports sle +1 moreInsufficient validation of untrusted input in Omnibox in Google Chrome prior to 78.0.3904.70...4.3 Medium
- google chrome, opensuse backports sle +1 moreInsufficient policy enforcement in downloads in Google Chrome prior to 78.0.3904.70 allowed a...6.5 Medium
- google chrome, opensuse backports sle +1 moreInappropriate implementation in navigation in Google Chrome on iOS prior to 78.0.3904.70 allowed...4.3 Medium
- google chrome, opensuse backports sle +1 moreInsufficient policy enforcement in navigation in Google Chrome prior to 78.0.3904.70 allowed a...4.3 Medium
- google chrome, opensuse backports sle +1 moreInsufficient policy enforcement in the Omnibox in Google Chrome on Android prior to 78.0.3904.70...4.3 Medium
- google chrome, opensuse backports sle +1 moreIncorrect implementation in navigation in Google Chrome prior to 78.0.3904.70 allowed a remote...4.3 Medium
- microsoft edge, internet explorer 10, internet explorer 11 +15 more +17 moreA spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies, aka ...4.3 Medium
- microsoft windows, windows 10 version 1903 for 32-bit systems, windows 10 version 1903 for arm64-based systems +11 more +13 moreA spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master...5.9 Medium
- microsoft edge, internet explorer 10, internet explorer 11 +26 more +28 moreA spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content, aka...4.3 Medium
- zingbox inspectorA security vulnerability exists in Zingbox Inspector versions 1.294 and earlier, that allows for...7.5 High
- trusteddomain opendmarc, canonical ubuntu linux, debian linux +1 more +3 moreOpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass...9.8 Critical
libp2p-secionpmIdentity Spoofing in libp2p-secio9.1 Critical- red hat atomic-openshift, redhat openshift +1 moreA vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able...3.6 Low
- schneider-electric modicon m340 firmware, modicon m580 firmware, modicon premium firmware +1 more +3 moreA CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon...9.8 Critical
- sap netweaver process integration, sap se netweaver process integration (adapter engine) +1 moreSAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7...7.1 High
- mi browser, mint browser +1 moreA URL spoofing vulnerability was found in all international versions of Xiaomi Mi browser 10.5.6...6.5 Medium
- cloud foundry uaa release (oss), cloudfoundry uaa release +1 moreUAA allows users to modify their own email address7.1 High
- freron mailmateMailMate before 1.11.3 mishandles a suspicious HTML/MIME structure in a signed/encrypted email.7.5 High
- express-cart project express-cartAuthentication Bypass by Spoofing in express-cart8.8 High
- zoomZoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116),...9.8 Critical
- elastic cloud enterpriseIn Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could...5.3 Medium
- microsoft edgeA spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka...4.3 Medium
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, and 8.5.5 installations using Form Login could allow a...7.3 High
- microsoft edgeA spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka...4.3 Medium
- microsoft edgeA spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content, aka ...4.3 Medium
- microsoft edgeA spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka...6.1 Medium
- ecos system management applianceAuthentication Bypass by Spoofing vulnerability in ECOS System Management Appliance (aka SMA) 5.2...7.4 High
- microsoft exchange serverA spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails...5.4 Medium
- node.jsWithdrawn Advisory: Node.js Inspector RCE via DNS Rebinding8.8 High
- circle media circle, meetcircle circle with disney firmware +1 moreAn exploitable vulnerability exists in the WiFi Access Point feature of Circle with Disney...6.5 Medium
- apple cups, canonical ubuntu linux, debian linux +2 moreA localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2...7.5 High
- atom electronElectron vulnerable to URL spoofing via PDFium4.3 Medium
- auth0 passport-wsfed-saml2passport-wsfed-saml2 vulnerable to Signature Bypass in SAML2 token8.1 High
- ohmibod remoteThe OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by...9.1 Critical
- circle media circle, meetcircle circle with disney firmware +1 moreAn exploitable vulnerability exists in the WiFi management of Circle with Disney. A crafted...6.5 Medium
- dell emc unisphere, emc solutions enabler, vasa +1 more +3 moreEMC Unisphere for VMAX Virtual Appliance (vApp) versions prior to 8.4.0.15, EMC Solutions Enabler...9.8 Critical
- lavalink ether-serial link firmwareAn Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running...9.8 Critical
- metinfo project metinfoMetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier...7.5 High
- kde kauth, kdelibs +1 moreKDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by...7.8 High
- veritas netbackup, netbackup appliance +1 moreAn issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and...7.5 High
- djangoproject djangoDjango WSGI Header Spoofing Vulnerability5.0 Medium
- snom 300 firmware, 320 firmware, 360 firmware +2 more +4 moreThe web interface on the snom VoIP phones snom 300, snom 320, snom 360, snom 370, and snom 820...9.8 Critical
- microsoft frontpage, internet information server, personal web server +2 more +4 moreSome web servers under Microsoft Windows allow remote attackers to bypass access restrictions for...5.0 Medium