CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- one identity onelogin active directory connector (adc)OneLogin AD Connector JWT Authentication Bypass via Exposed Signing Key10.0 Critical
- avtech ip camera, dvr, and nvr devicesAVTECH IP camera, DVR, and NVR Devices Authentication Bypass via /nobody URL Path6.9 Medium
- avtech ip camera, dvr, and nvr devicesAVTECH IP camera, DVR, and NVR Devices Authentication Bypass via .cab Path Manipulation6.9 Medium
- versa director, versa-networks versa director +1 moreThe Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using...6.3 Medium
- matrix-org matrix-rust-sdkmatrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator4.9 Medium
- caidoHijacking Caido instance during the initial setup via DNS Rebinding to achieve RCE7.5 High
- huawei harmonyosAuthentication bypass vulnerability in the DSoftBus module Impact: Successful exploitation of...8.8 High
- dataeaseDataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability8.2 High
- opennetworking onosAn issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses...9.8 Critical
- google chromeInappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a...5.4 Medium
github.com/babylonlabs-io/babylonGoBabylon Finality Provider `MsgCommitPubRandList` replay attack8.9 High- mutonufoai pgina.forkThe HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary...5.4 Medium
- mozilla thunderbirdJavaScript Execution via Spoofed PDF Attachment and file:/// Link8.1 High
- mozilla thunderbirdSender Spoofing via Malformed From Header in Thunderbird7.5 High
- dell wyse management suiteDell Wyse Management Suite, versions prior to WMS 5.1 contain an Authentication Bypass by...4.9 Medium
- auth0 passport-wsfed-saml2passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smuggling8.6 High
- auth0-extensions auth0-account-link-extensionAuth0 Account Link Extension JWT Invalid Signature Validation6.9 Medium
- google androidIn startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a...3.2 Low
- google androidIn multiple locations, there is a possible lock screen bypass due to a logic error in the code....4.0 Medium
- apple ipados, ios and ipados, iphone os +2 moreAn app could impersonate system notifications. Sensitive notifications now require restricted...5.5 Medium
- mytel telecom online account systemAn issue in Mytel Telecom Online Account System v1.0 allows attackers to bypass the OTP...7.0 High
- dataeaseDataease H2 JDBC Connection Remote Code Execution8.2 High
- octoprintOctoPrint Authenticated Reverse Proxy Page Authentication Bypass4.3 Medium
- No product listedFrancois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in...7.3 High
- honor gamecenter, com.hihonor.gamecenter +1 moreWhitelist bypass Vulnerability in GameCenter8.1 High
- jellyfinJellyfin Vulnerable to Denial of Service (DoS) via IP Spoofing4.6 Medium
- ays pro survey makerWordPress Survey Maker plugin <= 5.1.6.3 - Bypass vulnerability4.3 Medium
- asgaros forumWordPress Asgaros Forum plugin <= 3.0.0 - File Upload Numbers Bypass vulnerability4.3 Medium
- totvs framework \(linha protheus\)An issue in TOTVS Framework (Linha Protheus) 12.1.2310 allows attackers to bypass multi-factor...9.8 Critical
- huawei emui, harmonyos +1 moreAccess control vulnerability in the security verification module Impact: Successful exploitation...8.4 High
- huawei emui, harmonyos +1 moreAccess control vulnerability in the security verification module Impact: Successful exploitation...8.4 High
- huawei emui, harmonyos +1 moreAccess control vulnerability in the security verification module Impact: Successful exploitation...8.4 High
- huawei emui, harmonyos +1 moreAccess control vulnerability in the security verification module Impact: Successful exploitation...8.4 High
- huawei emui, harmonyos +1 moreAccess control vulnerability in the security verification module Impact: Successful exploitation...8.4 High
- mozilla firefox, thunderbird +1 moreURL Bar Spoofing via non-BMP Unicode characters7.3 High
- scratch-coding-hutscratch-coding-hut.github.io Login Links Generation vulnerability9.0 Critical
- spring securitySpring Security Vulnerable to Authorization Bypass via Security Annotations5.3 Medium
- nearform fast-jwtFast-JWT Improperly Validates iss Claims6.5 Medium
- gnetsystem g-onx firmwareAn issue was discovered on G-Net Dashcam BB GONX devices. Bypassing of Device Pairing can occur....8.1 High
- No product listedOn IROAD X5 devices, a Bypass of Device Pairing can occur via MAC Address Spoofing. The dashcam's...6.5 Medium
- ami megarac spx, megarac-spx, megarac sp-x +9 more +11 moreRedfish Authentication Bypass10.0 Critical
- devolutions serverVela Server has Insufficient Webhook Payload Data Verification8.6 High
- mozilla thunderbirdCrafted email message incorrectly shown as being encrypted7.0 High
- printerlogic vasion print, virtual appliance +1 moreVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923...9.8 Critical
- bowo admin and site enhancements (ase), wpase admin and site enhancements +1 moreAdmin and Site Enhancements (ASE) < 7.6.10 - Limit Login Attempt Bypass via IP Spoofing5.3 Medium
- cyberark endpoint privilege managerIP Spoofing in CyberArk Endpoint Privilege Manager6.9 Medium
- No product listedOpera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The...4.7 Medium
- phpjabbers cleaning business softwareA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software...6.5 Medium
- phpjabbers cleaning business softwareA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software...6.5 Medium
- phpjabbers shared asset booking systemA lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Shared Asset Booking...6.5 Medium
- Show moreLoading…