CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- rubygems rubygems.orgUnauthorized takeover for new versions of some platform-specific gems7.7 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +35 more +37 moreWindows LSA Spoofing Vulnerability8.1 High
- anker eufy homebase 2, eufy homebase 2 firmware +1 moreAn authentication bypass vulnerability exists in the libxm_av.so getpeermac() functionality of...7.1 High
- google chromeIncorrect security UI in Downloads in Google Chrome on Android prior to 101.0.4951.41 allowed a...4.3 Medium
- nextauth.js next-authDefault redirect callback vulnerable to open redirects6.1 Medium
- microsoft skype for business server 2015 cu12, skype for business server 2019 cu6, skype for business server +2 moreSkype for Business and Lync Spoofing Vulnerability5.3 Medium
- google chromeInappropriate implementation in full screen in Google Chrome on Android prior to 100.0.4896.88...4.3 Medium
- google chromeInappropriate implementation in compositing in Google Chrome prior to 100.0.4896.88 allowed a...4.3 Medium
- google chromeInappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 100.0.4896...6.5 Medium
- readymedia project readymedia, debian linux +1 moreA DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server...7.4 High
- appleple a-blog cmsAuthentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74,...9.8 Critical
- apache apisixapisix/batch-requests plugin allows overwriting the X-REAL-IP header9.8 Critical
- dependencytrack frontend, zabbix +1 moreUnsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML9.1 Critical
- microsoft app installer, windows +1 moreWindows AppX Installer Spoofing Vulnerability7.1 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +2 more +4 moreMicrosoft SharePoint Server Spoofing Vulnerability8.0 High
- apereo opencastHTTP Method Spoofing in Opencast7.5 High
- tp-link archer ax10 firmwareA denial-of-service attack in WPA2, and WPA3-SAE authentication methods in TP-Link AX10v1 before...7.5 High
- microsoft edge for ios, edge ios +1 moreMicrosoft Edge for iOS Spoofing Vulnerability3.1 Low
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability3.1 Low
- cloudendpoints esp, google extensible service proxy +1 moreX-Endpoint-API-UserInfo can be spoofed in cloudendpoints Extensible Service Proxy6.4 Medium
- liftoffsoftware gate oneVerification check bypass in Gate One5.3 Medium
- dlink dir-x1560 firmware, dir-x6060 firmware +1 moreA denial-of-service attack in WPA2, and WPA3-SAE authentication methods in D-Link DIR-X1560, v1...7.5 High
- matrix element, matrix-android-sdk2 +1 moreLogic error in Matrix SDK for Android5.9 Medium
- matrix javascript sdkmatrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver5.9 Medium
- yandex browserYandex Browser before 20.10.0 allows remote attackers to spoof the address bar5.3 Medium
- netgear gc108p firmware, gc108pp firmware, gs108t firmware +17 more +19 moreCertain NETGEAR smart switches are affected by an authentication hijacking race-condition...7.8 High
- fedoraproject fedora, microsoft edge, edge chromium +1 more +3 moreInappropriate implementation in Autofill in Google Chrome prior to 93.0.4577.63 allowed a remote...6.5 Medium
- fedoraproject fedora, microsoft edge, edge chromium +1 more +3 moreInappropriate implementation in Autofill in Google Chrome prior to 93.0.4577.63 allowed a remote...6.5 Medium
- booster for woocommerce, pluggabl llc booster for woocommcerce +1 moreBooster for WooCommerce <= 5.4.3 Authentication Bypass9.8 Critical
- solarwinds web help deskAccess Restriction bypass vulnerability via referrer spoof - Business Logic Bypass5.3 Medium
- openstack neutronOpenStack Neutron vulnerable to hardware address impersonation9.1 Critical
- throughtek kalay p2p software development kitThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek...8.3 High
- microsoft windows, windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation) +15 more +17 moreWindows LSA Spoofing Vulnerability7.5 High
- nimble-platform commonJSON Web Tokens not properly verified6.5 Medium
- sage adxadmin, x3 +1 moreSage X3 AdxAdmin Unauthenticated Command Execution Bypass by Spoofing10.0 Critical
- microsoft windows 10 version 1809, windows 10 version 1909, windows 10 version 2004 +3 more +5 moreWindows Hello Security Feature Bypass Vulnerability5.7 Medium
- schneider-electric ecostruxure control expert, ecostruxure process expert, remoteconnect +29 more +31 moreAuthentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all...9.1 Critical
- torproject torAn issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge...7.5 High
- qnap roon server, roon labs server +1 moreVulnerability in Roon Server7.5 High
- kialiKiali Authentication Bypass vulnerability6.5 Medium
- microsoft exchange server, exchange server 2013 cumulative update 23, exchange server 2016 cumulative update 19 +3 more +5 moreMicrosoft Exchange Server Spoofing Vulnerability6.5 Medium
- microsoft exchange server, exchange server 2013 cumulative update 23, exchange server 2016 cumulative update 19 +3 more +5 moreMicrosoft Exchange Server Remote Code Execution Vulnerability6.5 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint foundation 2013 service pack 1 +2 more +4 moreMicrosoft SharePoint Server Spoofing Vulnerability7.1 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint foundation 2013 service pack 1 +2 more +4 moreMicrosoft SharePoint Server Spoofing Vulnerability7.6 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint foundation 2013 service pack 1 +2 more +4 moreMicrosoft SharePoint Server Spoofing Vulnerability4.6 Medium
- systemd, fedoraproject fedora, netapp active iq unified manager +4 more +6 moreAn exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP...6.1 Medium
- paxtechnology paxstorePax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by a token spoofing...8.2 High
- alibaba nacosAuthentication bypass8.6 High
- alibaba nacosAuthentication bypass8.6 High
- homeautomation project homeautomationHomeAutomation 3.3.2 suffers from an authentication bypass vulnerability when spoofing client IP...9.8 Critical
- Show moreLoading…