CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Webview2 Spoofing Vulnerability8.2 High
- microsoft excel, 365 apps, 365 apps for enterprise +6 more +8 moreMicrosoft Excel Spoofing Vulnerability7.1 High
- unknown user activity, user activity project activity +1 moreUser Activity <= 1.0.1 - IP Spoofing7.5 High
- mozilla firefox, firefox esr, firefox focus +2 moreA lack of in app notification for entering fullscreen mode could have lead to a malicious website...7.5 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability4.3 Medium
- bosch b420, b420 firmware +1 moreBosch Security Systems B420 firmware 02.02.0001 employs IP based authorization in its...7.6 High
- mitsubishi electric got2000 series gt25 model, got2000 series gt27 model, mitsubishi electric corporation gt softgot2000 +2 more +4 moreAuthentication Bypass by Spoofing vulnerability in Mitsubishi Electric Corporation GOT2000 Series...6.8 Medium
- parseplatform parse server, parse-community parse-server +1 moreParse Server is vulnerable to authentication bypass via spoofing8.7 High
- schneider electric ecostruxure™ cybersecurity admin expert (cae), schneider-electric ecostruxure cybersecurity admin expert +1 moreA CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate...8.0 High
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4,...6.5 Medium
- ciphercoin wp limit login attemptsWP Limit Login Attempts <= 2.6.4 - IP Spoofing7.5 High
- unknown fluentauthFluentAuth < 1.0.2 - Bypass blocks by IP Spoofing7.5 High
- ruckuswireless r310 firmware, r500 firmware, r600 firmware +11 more +13 moreIn Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5...7.5 High
- cisco small business rv series router firmware, rv016 firmware, rv042 firmware +2 more +4 moreA vulnerability in the web-based management interface of Cisco Small Business RV042 Series...9.0 Critical
- wiesemann & theis com-server ++, com-server 20ma, com-server highspeed 100basefx +29 more +31 moreWiesemann & Theis: Multiple products prone to missing authentication through spoofing8.0 High
- microsoft office 2019 for mac, office ltsc for mac 2021, office +1 more +3 moreMicrosoft Outlook for Mac Spoofing Vulnerability7.5 High
- samsung t-ksu2eakuc firmware, t-ksu2edeuc firmware, t-ksu2euab firmware +12 more +14 moreThe Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone...4.6 Medium
- kyocera document solutions inc. document solutions mfps and printers, kyocera ecosys m2535dn firmware, ecosys m6526cdn firmware +38 more +40 moreSession information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and...6.5 Medium
- velneo vclientVelneo vClient improper authentication8.7 High
- f-secure safeWithSecure through 2022-08-10 allows attackers to cause a denial of service (issue 3 of 5).6.5 Medium
- ibm websphere application server"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the...5.9 Medium
- cloudflare warp, warp mobile client +1 moreLock WARP switch bypass by removing VPN profile on iOS mobile client6.7 Medium
- anji-plus aj-reportanji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing...8.8 High
- palo alto networks pan-os, cloud ngfw, prisma access +2 morePAN-OS: Authentication Bypass in Web Interface8.1 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +26 more +28 moreWindows NTLM Spoofing Vulnerability6.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +25 more +27 moreWindows CryptoAPI Spoofing Vulnerability7.5 High
- ieee 802.2, ietf draft-ietf-v6ops-ra-guard-08, p802.1q +2 moreL2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with an invalid length during Ethernet to Wifi frame translation4.7 Medium
- ieee 802.2, ietf draft-ietf-v6ops-ra-guard, p802.1q +2 moreL2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengths4.7 Medium
- ieee 802.2, ietf draft-ietf-v6ops-ra-guard, p802.1q +2 moreL2 network filtering bypass using stacked VLAN0, LLC/SNAP headers, and Ethernet to Wifi frame translation4.7 Medium
- cisco catalyst 6503-e firmware, catalyst 6504-e firmware, catalyst 6506-e firmware +94 more +96 moreL2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headers4.7 Medium
- keylimekeylime-agent-6.3.0-1.1 on GA media7.5 High
- keylimekeylime-agent-6.3.0-1.1 on GA media9.8 Critical
- grafana, fedoraproject fedora +1 moreAuthentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin6.6 Medium
- tesla, tesla model 3 firmware +1 moreTesla Model 3 V11.0(2022.4.5.1 6b701552d7a6) Tesla mobile app v4.23 is vulnerable to...5.3 Medium
- activitywatchActivityWatch vulnerable to DNS rebinding attack8.8 High
- davedoesdev python-jwtPython-jwt subject to Authentication Bypass by Spoofing9.1 Critical
- dproxy-nexgen project dproxy-nexgendproxy-nexgen (aka dproxy nexgen) forwards and caches DNS queries with the CD (aka checking...5.3 Medium
- microsoft .net, .net 6.0, .net core 3.1 +9 more +11 more.NET Spoofing Vulnerability5.9 Medium
- sonicwall hosted email security, email security +1 moreImproperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads...7.5 High
- rapid7 velociraptorVelociraptor Client ID Spoofing5.4 Medium
- honeywell saia pg5 controls suiteSaia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass. According to...8.1 High
- skyhigh security secure web gateway (swg), skyhighsecurity secure web gateway +1 moreSkyhigh SWG Authentication bypass vulnerability10.0 Critical
- sambaA flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it....8.8 High
- microweber, microweber microweber/microweber +1 moreAuthentication Bypass by Spoofing in microweber/microweber6.5 Medium
- ibm open liberty, websphere application server liberty, websphere application server +2 moreIBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are...5.0 Medium
- dominionvoting imagecast x, dominion voting systems imagecast x application, imagecast x firmware +2 more2.2.7 AUTHENTICATION BYPASS BY SPOOFING CWE-2906.8 Medium
- nic knot resolverKnot Resolver through 5.5.1 may allow DNS cache poisoning when there is an attempt to limit...5.3 Medium
- unknown iq block countryiQ Block Country < 1.2.20 - Protection Bypass due to IP Spoofing7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen exiting fullscreen mode, an iframe could have confused the browser about the current state...6.5 Medium
- argoproj argo cd, argo-cd +1 moreArgo CD will blindly trust JWT claims if anonymous access is enabled10.0 Critical
- Show moreLoading…