Weakness (CWE)
CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Source: MITRE CWE-290
761 results · Feed
-
Medium 4.6
Microsoft OneNote Spoofing Vulnerability
Microsoft OneNote Spoofing Vulnerability
-
Medium 5.8
Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenti…
-
Medium 5.8
Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco…
-
Medium 5.0
Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco…
-
Medium 5.9
Traffic being bypassed by ZCC by configuring synthetic IP range as local network
An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass. This issue affects Client Connector: before 3.9.
-
Critical 9.8CVE-2023-30803 EPSS 21%
Sangfor Next-Gen Application Firewall Authentication Bypass
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can bypass authentication and access administrative functionality by sending HTTP requests using a craf…
-
Medium 5.3
pretix potential IP address spoofing vulnerability
An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the…
-
Low 3.9
Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio
WireMock is a tool for mocking HTTP services. The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. These restrictions can be configured us…
-
Critical 9.8
Authentication Bypass in Neutron Smart VMS
Authentication Bypass by Spoofing vulnerability in Neutron Neutron Smart VMS allows Authentication Bypass. This issue affects Neutron Smart VMS: before b1130.1.0.1.
-
High 8.1
Web authentication and authorization bypass
Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization.
-
Medium 6.5
CVE-2023-30950
The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint
-
Medium 4.7
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
Medium 4.3
Microsoft Edge for Android Spoofing Vulnerability
Microsoft Edge for Android Spoofing Vulnerability
-
High 8.4
Authentication Bypass via HTTP Header Spoofing
AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vulnerability may lead to loss of confidentiality, integrity, and availability.
-
Medium 4.3
Microsoft Edge for iOS Spoofing Vulnerability
Microsoft Edge for iOS Spoofing Vulnerability
-
Unscored —
Vulnerability of identity verification being bypassed in the Gallery module. Successful exploitation of this vulnerabil…
-
Unscored —
PAX Technology A930 PayDroid_7.1.1_Virgo_V04.5.02_20220722 allows attackers to compile a malicious shared library and u…
-
Critical 10.0
Authentication Bypass issue in My Cloud OS 5 devices
An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack. This issue affects My Cloud OS 5 devices: before 5.26.202.
-
Unscored —
In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, b…
-
High 8.3
** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions. …
-
Critical 9.4CVE-2023-3128 Public exploit
Grafana vulnerable to Authentication Bypass by Spoofing
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
-
Medium 5.3
Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-pa…
-
Medium 5.3
Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-pa…
-
Medium 5.3
Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-pa…
-
Critical 10.0
Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up w…
-
Medium 6.5
Microsoft OneNote Spoofing Vulnerability
Microsoft OneNote Spoofing Vulnerability
-
Medium 6.4
Authentication bypass in password reset process
Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication. This issue affects PandoraFMS v771 and pri…
-
Critical 10.0
Impersonation attack causing an Authentication Bypass on Western Digital devices
Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data. This issue affects My Cloud OS 5 devices: before 5.25.132;…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 be…
-
High 8.8
A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permis…
-
Critical 9.8
User Authentication Bypass in CBOT's Chatbot
Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.
-
Medium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
High 7.5CVE-2022-47522 Public exploit
The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) …
-
Medium 6.1
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
Critical 9.1
The control component has a spoofing vulnerability. Successful exploitation of this vulnerability may affect confidenti…
-
High 8.2CVE-2023-24892 Public exploit
Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability
Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability
-
High 7.1
Microsoft Excel Spoofing Vulnerability
Microsoft Excel Spoofing Vulnerability
-
Medium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
High 8.7
Parse Server is vulnerable to authentication bypass via spoofing
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client…
-
Medium 6.8
Authentication Bypass by Spoofing vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 0…