Weakness (CWE)
CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Source: MITRE CWE-290
320 results · Clear filters · Feed
-
Medium 5.3
WordPress LionScripts: IP Blocker Lite plugin <= 11.1.1 - Bypass vulnerability
Authentication Bypass by Spoofing vulnerability in LionScripts IP Blocker Lite allows Functionality Bypass.This issue affects IP Blocker Lite: from n/a through 11.1.1.
-
Medium 5.3
WordPress Newsletter plugin <= 8.2.0 - IP Blacklist Bypass vulnerability
Authentication Bypass by Spoofing vulnerability in Stefano Lissa & The Newsletter Team Newsletter allows Functionality Bypass.This issue affects Newsletter: from n/a through 8.2.0.
-
Medium 5.3
WordPress WTI Like Post plugin <= 1.4.6 - IP Restriction Bypass Vulnerability vulnerability
Authentication Bypass by Spoofing vulnerability in webtechideas WTI Like Post allows Functionality Bypass.This issue affects WTI Like Post: from n/a through 1.4.6.
-
Medium 5.2
An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client sub…
-
Medium 6.5
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not re…
KEV Sep 3, 2025 -
Medium 6.5
TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability
TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR902AC routers. Authentication is not requ…
-
Medium 4.3
Authentication Bypass by Spoofing in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be a…
-
Medium 4.6
Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform …
-
Medium 6.1
An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary c…
-
Medium 6.3
HCL DevOps Deploy / HCL Launch does not invalidate all session authentication cookies after logout
HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
-
Medium 5.3
Apache Zeppelin: Replacing other users notebook, bypassing any permissions
Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue.
-
Medium 6.1
A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0…
-
Medium 6.1
A vulnerability has been identified in SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0) (All versions), SCALANCE W721-1 RJ45 (…
-
Medium 6.6
Ollama DNS rebinding vulnerability
Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).
-
Medium 6.5
An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive in…
-
Medium 5.3
In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible
-
Medium 5.3
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ve…
-
Medium 6.5
Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another w…
-
Medium 5.4
Authentication Bypass by Spoofing in github.com/greenpau/caddy-security
All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For header due to improper input sanitization. An attacker can spoof an IP address used in the user identity module (/whoami…
-
Medium 6.0
Impersonate vendor signed Powershell scripts
Authentication Bypass by Spoofing vulnerability in Snow Software Snow Inventory Agent on Windows allows Signature Spoof.This issue affects Snow Inventory Agent: through 6.14.5. Customers advised to upgrade to version 7.0
-
Medium 6.3
A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical acc…
-
Medium 6.8
Grub2: bypass the grub password protection feature
An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external driv…
-
Medium 6.0
Security Vulnerability on Match-on-Chip FPR Architecture
ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which i…
-
Medium 5.5
This issue was addressed by improving Face ID anti-spoofing models. This issue is fixed in iOS 17 and iPadOS 17. A 3D m…
-
Medium 6.7
The logic of get apk path in KernelSU module can be bypassed
KernelSU is a Kernel-based root solution for Android devices. In versions 0.7.1 and prior, the logic of get apk path in KernelSU kernel module can be bypassed, which causes any malicious apk named `me.weishu.kernelsu` get root permission. If a KernelSU module…
-
Medium 6.5
Header spoofing in caddy-geo-ip
The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism (trusted_proxy directive in …
-
Medium 4.6
Microsoft OneNote Spoofing Vulnerability
Microsoft OneNote Spoofing Vulnerability
-
Medium 5.8
Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenti…
-
Medium 5.8
Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco…
-
Medium 5.0
Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco…
-
Medium 5.9
Traffic being bypassed by ZCC by configuring synthetic IP range as local network
An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass. This issue affects Client Connector: before 3.9.
-
Medium 5.3
pretix potential IP address spoofing vulnerability
An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the…
-
Medium 6.5
CVE-2023-30950
The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint
-
Medium 4.7
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
Medium 4.3
Microsoft Edge for Android Spoofing Vulnerability
Microsoft Edge for Android Spoofing Vulnerability
-
Medium 4.3
Microsoft Edge for iOS Spoofing Vulnerability
Microsoft Edge for iOS Spoofing Vulnerability
-
Medium 5.3
Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-pa…
-
Medium 5.3
Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-pa…
-
Medium 5.3
Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-pa…
-
Medium 6.5
Microsoft OneNote Spoofing Vulnerability
Microsoft OneNote Spoofing Vulnerability