CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- unknown defender security, wpmudev defender +1 moreWordPress Defender Security plugin <= 4.4.1 - IP Restriction Bypass vulnerability5.3 Medium
- wp happy coders comments like dislikeWordPress Comments Like Dislike plugin <= 1.2.2 - IP Restriction Bypass Vulnerability vulnerability4.3 Medium
- lionscripts ip blocker liteWordPress LionScripts: IP Blocker Lite plugin <= 11.1.1 - Bypass vulnerability5.3 Medium
- pippin williamson cgc maintenance modeWordPress CGC Maintenance Mode plugin <= 1.2 - IP Filtering Bypass vulnerability3.7 Low
- stefanno lissa newsletterWordPress Newsletter plugin <= 8.2.0 - IP Blacklist Bypass vulnerability5.3 Medium
- webtechideas wti like postWordPress WTI Like Post plugin <= 1.4.6 - IP Restriction Bypass Vulnerability vulnerability5.3 Medium
- octoprintOctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled7.1 High
- gnome glib, debian linux, fedoraproject fedora +7 more +9 moreAn issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a...5.2 Medium
- ibm cognos controllerIBM Cognos Controller security bypass5.3 Medium
- tp-link tl-wr841n, archer c5, archer c7 +55 more +57 moreTP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability6.5 Medium
- tp-link tl-wr902ac, tl-wr902ac firmware +1 moreTP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability6.5 Medium
- jenkins script security, jenkins project script security plugin +1 moreJenkins Script Security Plugin sandbox bypass vulnerability8.8 High
- gitlabAuthentication Bypass by Spoofing in GitLab4.3 Medium
- cdbattags lua resty jwtcdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by...8.1 High
- apache hugegraph, hugegraph-server +1 moreApache HugeGraph-Server: Bypass whitelist in Auth mode9.1 Critical
- red hat build of keycloak 22, build of keycloak 22.0.10, single sign-on 7 +2 moreKeycloak: impersonation via logout token exchange3.4 Low
- google chrome, fedoraproject fedora +1 moreInsufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a...4.3 Medium
- appmakes.io typoraAn issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information...6.1 Medium
- hcltechsw hcl devops deploy, hcl launch, hcl software devops deploy / launch +2 moreHCL DevOps Deploy / HCL Launch does not invalidate all session authentication cookies after logout6.3 Medium
- apache zeppelinApache Zeppelin: Replacing other users notebook, bypassing any permissions5.3 Medium
- siemens scalance w1748-1 m12, scalance w1788-1 m12, scalance w1788-2 eec m12 +38 more +40 moreA vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748...8.4 High
- siemens scalance w1748-1 m12, scalance w1788-1 m12, scalance w1788-2 eec m12 +33 more +35 moreA vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748...6.1 Medium
- siemens scalance w721-1 rj45, scalance w722-1 rj45, scalance w734-1 rj45 +20 more +22 moreA vulnerability has been identified in SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0) (All versions),...6.1 Medium
- ollamaOllama DNS rebinding vulnerability6.6 Medium
- apache cloudstackApache CloudStack: x-forwarded-for HTTP header parsed by default9.8 Critical
- wuzhicmsAn issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code...6.5 Medium
- openatom openharmonyBundlemanager has an authentication bypass vulnerability7.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in...5.3 Medium
- dell secure connect gateway, secure connect gateway (scg) 5.0 appliance - srs +1 moreDell Secure Connect Gateway 5.20 contains an improper authentication vulnerability during the SRS...7.1 High
- apache james, apache software foundation james server +1 moreSMTP smuggling in Apache James7.1 High
- apple macos, safari, ios and ipados +5 more +7 moreAn inconsistent user interface issue was addressed with improved state management. This issue is...4.3 Medium
- apple macosThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS...5.5 Medium
- mozilla firefoxWhen opening a website using the `firefox://` protocol handler, SameSite cookies were not...8.3 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThrough a series of API calls and redirects, an attacker-controlled alert dialog could have been...6.5 Medium
- greenpau caddy-security, github.com\/greenpau\/caddy-security +1 moreAuthentication Bypass by Spoofing in github.com/greenpau/caddy-security5.4 Medium
- ausweisapp online-ausweis-funktionThe Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15...9.6 Critical
- snow software inventory agent, snowsoftware snow inventory agent +1 moreImpersonate vendor signed Powershell scripts6.0 Medium
- dronetag drone scannerAn issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers to impersonate other drones...8.2 High
- sorenfriis opendroneid osmAn issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via...8.2 High
- joinmastodon mastodonMastodon Remote user impersonation and takeover9.4 Critical
- lenovo vantageA privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local...6.3 Medium
- huawei emui, harmonyos +1 moreVulnerability of trust relationships being inaccurate in distributed scenarios. Successful...7.5 High
- huawei emui, harmonyos +1 moreVulnerability of trust relationships being inaccurate in distributed scenarios. Successful...7.5 High
- elan dell inspiron, emc elan match-on-chip fpr solution firmware +1 moreSecurity Vulnerability on Match-on-Chip FPR Architecture6.0 Medium
- gnu grub2, fedoraproject fedora, red hat enterprise linux 8 +4 more +6 moreGrub2: bypass the grub password protection feature6.8 Medium
- ujcmsA spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and...9.8 Critical
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed by improving Face ID anti-spoofing models. This issue is fixed in iOS 17...5.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +30 more +32 moreWindows Kerberos Security Feature Bypass Vulnerability8.8 High
- kernelsuThe logic of get apk path in KernelSU module can be bypassed6.7 Medium
- canonical ubuntu linux, canonical ltd. ubuntu's gnome-control-center, gnome control center +2 moreIn Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system...4.9 Medium
- Show moreLoading…