Weakness (CWE)
CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Source: MITRE CWE-290
761 results · Feed
-
High 8.1
cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc…
-
Critical 9.1
Apache HugeGraph-Server: Bypass whitelist in Auth mode
Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue.
-
Medium 4.6
Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform …
-
Medium 6.1
An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary c…
-
Medium 6.3
HCL DevOps Deploy / HCL Launch does not invalidate all session authentication cookies after logout
HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
-
Medium 5.3
Apache Zeppelin: Replacing other users notebook, bypassing any permissions
Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue.
-
High 8.4
A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0…
-
Medium 6.1
A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0…
-
Medium 6.1
A vulnerability has been identified in SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0) (All versions), SCALANCE W721-1 RJ45 (…
-
Medium 6.6
Ollama DNS rebinding vulnerability
Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).
-
Critical 9.8
Apache CloudStack: x-forwarded-for HTTP header parsed by default
By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request. This could lead to authentication bypass and other operational problems should an attacker decide to spoof their IP address thi…
-
Medium 6.5
An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive in…
-
High 7.7
Bundlemanager has an authentication bypass vulnerability
in OpenHarmony v3.2.4 and prior versions allow a remote attacker bypass permission verification to install apps, although these require user action.
-
Medium 5.3
In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible
-
High 7.1
Dell Secure Connect Gateway 5.20 contains an improper authentication vulnerability during the SRS to SCG update path. A…
-
High 7.1
SMTP smuggling in Apache James
Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SM…
-
High 7.5
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 an…
-
Medium 5.3
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ve…
-
High 8.3
When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected. This vuln…
-
Medium 6.5
Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another w…
-
Medium 5.4
Authentication Bypass by Spoofing in github.com/greenpau/caddy-security
All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For header due to improper input sanitization. An attacker can spoof an IP address used in the user identity module (/whoami…
-
Critical 9.6
The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication by…
-
Medium 6.0
Impersonate vendor signed Powershell scripts
Authentication Bypass by Spoofing vulnerability in Snow Software Snow Inventory Agent on Windows allows Signature Spoof.This issue affects Snow Inventory Agent: through 6.14.5. Customers advised to upgrade to version 7.0
-
High 8.2
An issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers to impersonate other drones via transmission of cr…
-
High 8.2
An issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via transmission of crafted d…
-
Critical 9.4
Mastodon Remote user impersonation and takeover
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Masto…
-
Medium 6.3
A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical acc…
-
High 7.5
Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnera…
-
High 7.5
Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnera…
-
Medium 6.8
Grub2: bypass the grub password protection feature
An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the password hash for the GRUB password protection feature. An attacker capable of attaching an external driv…
-
Medium 6.0
Security Vulnerability on Match-on-Chip FPR Architecture
ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which i…
-
Critical 9.8
A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code …
-
Medium 5.5
This issue was addressed by improving Face ID anti-spoofing models. This issue is fixed in iOS 17 and iPadOS 17. A 3D m…
-
Medium 6.7
The logic of get apk path in KernelSU module can be bypassed
KernelSU is a Kernel-based root solution for Android devices. In versions 0.7.1 and prior, the logic of get apk path in KernelSU kernel module can be bypassed, which causes any malicious apk named `me.weishu.kernelsu` get root permission. If a KernelSU module…
-
High 7.5
Windows DNS Spoofing Vulnerability
Windows DNS Spoofing Vulnerability
-
Medium 6.5
Header spoofing in caddy-geo-ip
The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism (trusted_proxy directive in …
-
High 8.2
An issue in PARK DANDAN mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage o…
-
High 8.3
Server Spoofing Vulnerability in NxCloud
An issue was discovered by IPVM team in Network Optix NxCloud before 23.1.0.40440. It was possible to add a fake VMS server to NxCloud by using the exact identification of a legitimate VMS server. As result, it was possible to retrieve authorization headers f…
-
High 8.0
Authentication Bypass by Spoofing in Unitree Robotics A1
Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera video stream. In addition, if a MITM attack is carried out, it is possible to consume the robot's re…
-
Unscored —
Vulnerability of identity verification being bypassed in the face unlock module. Successful exploitation of this vulner…