CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote...6.5 Medium
- juniper paragon active assurance control center, juniper networks paragon active assurance, fedoraproject fedora +2 moreParagon Active Assurance: Authentication bypass vulnerability in Control Center7.4 High
- sap netweaver application server java, sap se netweaver as for java (http service) +1 moreSAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7...4.3 Medium
- haxx libcurl, broadcom fabric operating system, debian linux +11 more +13 morecurl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to...3.7 Low
- mozilla firefox, firefox esr, thunderbird +2 moreA malicious extension could have opened a popup window lacking an address bar. The title of the...6.5 Medium
@solid/identity-token-verifiernpmVerification flaw in Solid identity-token-verifierNo score- scytl secure voteAn issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header...6.5 Medium
- nextauth.js next-authToken verification bug in next-auth6.1 Medium
- apache cassandraAuthentication Bypass in Apache Cassandra7.5 High
- google chrome, microsoft edge chromium +1 moreIncorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote...6.5 Medium
- sooil anydana-a firmware, anydana-i firmware, diabecare rs firmware +2 moreSOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the...5.7 Medium
- dnsmasq, arista eos, debian linux +1 more +3 moreA flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check...3.7 Low
- microsoft azure kubernetes serviceAzure Active Directory Pod Identity Spoofing Vulnerability5.5 Medium
- linuxfoundation dexAuthentication Bypass in dex9.8 Critical
- dexidp dexCritical security issues in XML encoding in Dex9.3 Critical
- fleetdm fleetSAML authentication vulnerability in Fleet10.0 Critical
- openasset digital asset managementOpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly determine the HTTP...7.5 High
- nhosoya omniauth-appleomniauth-apple allows attacker to fake their email address during authentication7.7 High
datasette-indieauthPyPIImplementation trusts the "me" field returned by the authorization server without verifying itNo score- ibm resilient onprem, resilient security orchestration automation and response +1 moreIBM Resilient SOAR V38.0 could allow an attacker on the internal net work to provide the server...4.3 Medium
- free freebox server, freebox v5 firmware +1 moreA DNS rebinding vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3.6.5 Medium
- mcafee mvision endpoint detection and response, mcafee,llc mcafee mvision endpoint detection and response +1 moreMcAfee MVEDR - Improperly implemented security check6.0 Medium
- mcafee active response, mcafee,llc mcafee active response +1 moreMcAfee MAR - Improperly implemented security check6.0 Medium
- qualcomm atheros ar9132 firmware, atheros ar9283 firmware, atheros ar9285 firmware +2 moreA partial authentication bypass vulnerability exists on Atheros AR9132 3.60(AMX.8), AR9283 1.85,...6.1 Medium
- realtek rtl8192er firmware, rtl8196d firmware, rtl8812ar firmware +1 more +3 moreA partial authentication bypass vulnerability exists on Realtek RTL8812AR 1.21WW, RTL8196D 1.0.0,...6.1 Medium
- mediatek mt7620n firmwareA partial authentication bypass vulnerability exists on Mediatek MT7620N 1.06 devices. The...6.1 Medium
- zohocorp manageengine adselfservice plusThe custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows...9.8 Critical
- anixis password reset clientThe custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote...8.8 High
- hashicorp vaultAuthentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault8.2 High
- pivotal software concourseConcourse's GitLab auth allows impersonation10.0 Critical
- palo alto networks globalprotect app, paloaltonetworks globalprotect +1 moreGlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookie5.3 Medium
- microsoft system center operations manager, system center 2016 operations manager +1 moreA spoofing vulnerability exists when System Center Operations Manager (SCOM) does not properly...5.4 Medium
- microsoft bing, bing search for android +1 moreA spoofing vulnerability exists when Microsoft Bing Search for Android improperly handles...6.5 Medium
- cisco nx-os, ucs manager, unified computing system +4 more +6 moreIP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic5.3 Medium
- bluetooth core, br/edr, opensuse leap +2 moreBluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks5.4 Medium
- palo alto networks pan-osPAN-OS: Spoofed Kerberos key distribution center authentication bypass8.1 High
- ibm websphere application server liberty, websphere application server +1 moreIBM WebSphere Application Liberty 19.0.0.5 through 20.0.0.4 could allow an authenticated user...5.0 Medium
- suculent thinx-device-apiDevice Authentication Vulnerability in thinx-device-api IoT Device Management Server7.5 High
- pypolicyd-spf project pypolicyd-spf, trusteddomain opendmarc, fedoraproject fedora +2 moreOpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass...9.8 Critical
- trusteddomain opendmarc, fedoraproject fedora +1 moreOpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide...5.3 Medium
- ibm security information queueIBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow...4.2 Medium
- mitre calderaauth_svc in Caldera before 2.6.5 allows authentication bypass (for REST API requests) via a...5.3 Medium
- onap open network automation platformAn issue was detected in ONAP APPC through Dublin and SDC through Dublin. By setting a USER_ID...9.1 Critical
- mozilla firefoxAfter a website had entered fullscreen mode, it could have used a previously opened popup to...4.3 Medium
- mozilla firefoxWhen a JavaScript URL (javascript:) is evaluated and the result is a string, this string is...6.5 Medium
- opennetworking onosAuthentication Bypass by Spoofing in org.onosproject.acl (access control) and org.onosproject...7.5 High
- postieplugin postieThe Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote...5.3 Medium
- beckhoff twincatBeckhoff Embedded Windows PLCs through 3.1.4024.0, and Beckhoff Twincat on Windows Engineering...9.8 Critical
- omron plc cj firmware, plc cs firmware +1 moreIn Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could...9.8 Critical
- Show moreLoading…