CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- phpjabbers night club booking softwareA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Night Club Booking...6.5 Medium
- italia cie-aspnetcoreSAML Response Signature Verification Bypass in CIE.AspNetCore.Authentication9.1 Critical
- italia spid-aspnetcoreSAML Response Signature Verification Bypass in SPID.AspNetCore.Authentication9.1 Critical
- jip infobridge co., ltd. filemeganeAuthentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4...5.3 Medium
- tecno com.transsion.carlcareLogic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of...9.8 Critical
- gchq stroomStroom Authentication/Authorization Bypass when using AWS ALB9.4 Critical
- jack hopman wpgatewayWPGateway <= 3.5 - Unauthenticated Privilege Escalation9.8 Critical
- opcfoundation ua .net standard stack, siemens industrial edge for machine tools (formerly known as "sinumerik edge"), simatic braumat +9 more +11 moreSecurity Update for the OPC UA .NET Standard Stack5.3 Medium
- d-link dhp-w310av, dlink dhp-w310av firmware +1 moreD-Link DHP-W310AV authentication spoofing6.9 Medium
- No product listedThe device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1...6.6 Medium
- microsoft azure ai face serviceAzure AI Face Service Elevation of Privilege Vulnerability9.9 Critical
- apache hiveApache Hive: Timing Attack Against Signature in LLAP util6.5 Medium
- bestwebsoft google captchaWordPress reCaptcha by BestWebSoft Plugin <= 1.78 - Captcha Bypass vulnerability5.3 Medium
- xerox workplace suiteAPI Security bypass through header manipulation7.5 High
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and...7.1 High
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a...4.3 Medium
- google chromeInappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote...6.5 Medium
- google chromeInappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83...6.5 Medium
- google chromeRace in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a...6.5 Medium
- google chromeInappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83...6.5 Medium
- 2100 technology official document management system2100 Technology Electronic Official Document Management System - Authentication Bypass9.8 Critical
- progress whatsup goldWhatsUp Gold - Public API signing key rotation issue9.6 Critical
- No product listedAn issue was discovered in Kurmi Provisioning Suite 7.9.0.33. If an X-Forwarded-For header is...9.4 Critical
Oqtane.FrameworkNuGet,Oqtane.ServerNuGet +1 moreOqtane Framework Incorrect Access Control vulnerability7.5 High- phpgurukul online notes sharing management systemAn IDOR vulnerability in the manage-notes.php module in PHPGurukul Online Notes Sharing...5.4 Medium
- michal novák secure admin ipWordPress Secure Admin IP plugin <= 2.0 - IP Spoofing vulnerability5.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of...3.5 Low
- snap one ovrc cloud, snapone orvc +1 moreAuthentication Bypass by Spoofing in Snap One OVRC cloud8.7 High
- argoproj argo workflows, argo-workflows +1 moreArgo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode6.3 Medium
- zabbixUnauthenticated Zabbix frontend takeover when SSO is being used8.8 High
- mozilla firefox, thunderbird +1 moreThe incorrect domain may have been displayed in the address bar during an interrupted navigation...4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could cause a select dropdown to be shown over another tab; this could have led to...4.3 Medium
- schneider electric modicon m340 cpu (part numbers bmxp34*), modicon mc80 (part numbers bmkc80), modicon momentum unity m1e processor (171cbu*) +3 more +5 moreCWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of...7.7 High
- apache zookeeperApache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server9.1 Critical
- projectfloodlight floodlight, open sdn controller +1 moreFloodlight SDN Open Flow Controller v.1.2 has an issue that allows local hosts to build fake LLDP...6.2 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA clipboard "paste" button could persist across tabs which allowed a spoofing attack. This...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreTruncation of a long URL could have allowed origin spoofing in a permission prompt. This...6.5 Medium
- cisco adaptive security appliance, adaptive security appliance (asa) software, adaptive security appliance software +2 more +4 moreA vulnerability in the Network Service Group (NSG) feature of Cisco Adaptive Security Appliance ...5.8 Medium
- cisco adaptive security appliance (asa) software, adaptive security appliance software, firepower threat defense software +1 more +3 moreCisco Adaptive Security Appliance and Firepower Threat Defense AnyConnect Access Control List Bypass Vulnerability5.8 Medium
- cisco adaptive security appliance (asa) software, adaptive security appliance software, firepower threat defense software +1 more +3 moreCisco Adaptive Security Appliance and Firepower Threat Defense AnyConnect Access Control List Bypass Vulnerability5.8 Medium
- amazon amazon.applicationloadbalancer.identity.aspnetcore middlewareLack of JWT issuer and signer validation6.9 Medium
- amazon aws alb route directive adapter for istioLack of JWT issuer and signer validation6.9 Medium
haproxyAzure LinuxQUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening...5.3 Medium- zendeskZendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing,...7.5 High
- dena h2oH2O alllows bypassing address-based access control with 0-RTT5.9 Medium
- mozilla firefoxA user who enables full-screen mode on a specially crafted web page could potentially be...6.5 Medium
- mellium xmppMellium allows Authentication Bypass by Spoofing9.8 Critical
- peter hardy-vandoorn maintenance redirectWordPress Maintenance Redirect plugin <= 2.0.1 - IP Bypass vulnerability3.7 Low
- No product listedEntrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) 6.10.0, 6...5.9 Medium
- coredns.io corednsCoreDNS Cache Poisoning via a birthday attack7.5 High
- Show moreLoading…