CWE-290 · Authentication Bypass by Spoofing (page 5)
Page 5 of 8 — CVEs classified under CWE-290, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8935 | High | 7.5 | 2024-11-13 | CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of confidentiality and integrity of controllers w… |
CVE-2024-51504 | Critical | 9.1 | 2024-11-07 | When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authent… |
CVE-2024-51406 | Medium | 6.2 | 2024-11-01 | Floodlight SDN Open Flow Controller v.1.2 has an issue that allows local hosts to build fake LLDP packets that allow specific clusters to be missed by Floodlig… |
CVE-2024-10465 | Medium | 6.5 | 2024-10-29 | A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbir… |
CVE-2024-10462 | Medium | 6.5 | 2024-10-29 | Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird… |
CVE-2024-20384 | Medium | 5.8 | 2024-10-23 | A vulnerability in the Network Service Group (NSG) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Softwar… |
CVE-2024-20299 | Medium | 5.8 | 2024-10-23 | A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow a… |
CVE-2024-20297 | Medium | 5.8 | 2024-10-23 | A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow a… |
CVE-2024-8901 | High | 7.5 | 2024-10-22 | The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authenti… |
CVE-2024-10125 | High | 7.5 | 2024-10-22 | The Amazon.ApplicationLoadBalancer.Identity.AspNetCore repo https://github.com/awslabs/aws-alb-identity-aspnetcore#validatetokensignature contains Middleware… |
CVE-2024-49214 | Medium | 5.3 | 2024-10-14 | QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass th… |
CVE-2024-49193 | High | 7.5 | 2024-10-12 | Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are extracted from incoming e-mail messages and… |
CVE-2024-45397 | Medium | 5.9 | 2024-10-11 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets… |
CVE-2024-9391 | Medium | 6.5 | 2024-10-01 | A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of o… |
CVE-2024-46957 | Critical | 9.8 | 2024-09-25 | Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is not checked. This i… |
CVE-2024-39341 | Medium | 5.9 | 2024-09-23 | Entrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier leaves behind a conf… |
CVE-2024-45453 | Low | 3.7 | 2024-09-23 | Authentication Bypass by Spoofing vulnerability in Peter Hardy-vanDoorn Maintenance Redirect jf3-maintenance-mode.This issue affects Maintenance Redirect: from… |
CVE-2023-30464 | High | 7.5 | 2024-09-18 | CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack. |
CVE-2023-28452 | High | 7.5 | 2024-09-18 | An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thu… |
CVE-2024-8908 | Medium | 4.3 | 2024-09-17 | Inappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chr… |
CVE-2024-6678 | Critical | 9.9 | 2024-09-12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 p… |
CVE-2024-44104 | High | 8.8 | 2024-09-10 | An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace Control before version 20… |
CVE-2024-8399 | Medium | 4.7 | 2024-09-03 | Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130. |
CVE-2024-8386 | Medium | 6.1 | 2024-09-03 | If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack… |
CVE-2024-43944 | Low | 3.7 | 2024-08-29 | Authentication Bypass by Spoofing vulnerability in ilyasine Maintenance & Coming Soon Redirect Animation maintenance-coming-soon-redirect-animation allows Iden… |
CVE-2024-7745 | Medium | 6.5 | 2024-08-28 | In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the s… |
CVE-2024-42364 | Medium | 6.5 | 2024-08-23 | Homepage is a highly customizable homepage with Docker and service API integrations. The default setup of homepage 0.9.1 is vulnerable to DNS rebinding. Homepa… |
CVE-2024-38807 | Medium | 6.3 | 2024-08-23 | Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be… |
CVE-2024-7981 | Medium | 4.3 | 2024-08-21 | Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromi… |
CVE-2024-35539 | Medium | 6.5 | 2024-08-19 | Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerability allows attackers to post several co… |
CVE-2024-35538 | Medium | 5.3 | 2024-08-19 | Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP… |
CVE-2024-41432 | Medium | 5.3 | 2024-08-07 | An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbi… |
CVE-2023-48396 | Critical | 9.1 | 2024-07-30 | Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user. A… |
CVE-2024-27853 | Medium | 4.4 | 2024-07-29 | This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4. A maliciously crafted ZIP archive may bypass Gatekeeper checks. |
CVE-2024-41107 | High | 8.1 | 2024-07-19 | The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an… |
CVE-2023-40702 | | 2024-07-09 | PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second facto… | |
CVE-2023-40356 | | 2024-07-09 | PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration coul… | |
CVE-2024-37430 | Medium | 5.3 | 2024-07-09 | Authentication Bypass by Spoofing vulnerability in patreon Patreon WordPress patreon-connect.This issue affects Patreon WordPress: from n/a through <= 1.9.0. |
CVE-2024-6163 | Medium | 5.3 | 2024-07-08 | Certain http endpoints of Checkmk in Checkmk < 2.3.0p10 < 2.2.0p31, < 2.1.0p46, <= 2.0.0p39 allows remote attacker to bypass authentication and access data |
CVE-2024-37082 | Critical | 9.1 | 2024-07-03 | When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypa… |
CVE-2024-39350 | High | 7.5 | 2024-06-28 | A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality. This allows man-in-the-middle attackers to obtain privileges wi… |
CVE-2024-31802 | Medium | 6.3 | 2024-06-27 | DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code. |
CVE-2024-4846 | Medium | 6.3 | 2024-06-25 | Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without… |
CVE-2024-39337 | Medium | 6.5 | 2024-06-24 | Click Studios Passwordstate Core before 9.8 build 9858 allows Authentication Bypass. |
CVE-2024-21518 | High | 7.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization… |
CVE-2024-30058 | Medium | 5.4 | 2024-06-13 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-36588 | Medium | 6.5 | 2024-06-13 | An issue in Annonshop.app DecentralizeJustice/ anonymousLocker commit 2b2b4 allows attackers to send messages erroneously attributed to arbitrary users via a c… |
CVE-2024-5812 | Low | 3.3 | 2024-06-11 | A low severity vulnerability in BIPS has been identified where an attacker with high privileges or a compromised high privilege account can overwrite Read-Only… |
CVE-2024-35749 | Low | 3.7 | 2024-06-10 | Authentication Bypass by Spoofing vulnerability in Acurax Under Construction / Maintenance Mode from Acurax allows Authentication Bypass.This issue affects Und… |
CVE-2024-5037 | High | 7.5 | 2024-06-05 | A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue ("iss") check during JSON… |
CVE-2023-52176 | Medium | 5.3 | 2024-06-04 | Authentication Bypass by Spoofing vulnerability in miniorange Malware Scanner allows Accessing Functionality Not Properly Constrained by ACLs.This issue affect… |
CVE-2023-51667 | Medium | 5.3 | 2024-06-04 | Authentication Bypass by Spoofing vulnerability in FeedbackWP Rate my Post – WP Rating System allows Accessing Functionality Not Properly Constrained by ACLs.T… |
CVE-2023-51543 | Medium | 5.3 | 2024-06-04 | Authentication Bypass by Spoofing vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affec… |
CVE-2023-51542 | Medium | 5.3 | 2024-06-04 | Authentication Bypass by Spoofing vulnerability in WPMU DEV Branda allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Branda: f… |
CVE-2023-49741 | Low | 3.7 | 2024-06-04 | Authentication Bypass by Spoofing vulnerability in wpdevart Coming soon and Maintenance mode allows Accessing Functionality Not Properly Constrained by ACLs.Th… |
CVE-2023-48753 | Medium | 5.3 | 2024-06-04 | Authentication Bypass by Spoofing vulnerability in 10up Restricted Site Access allows Accessing Functionality Not Properly Constrained by ACLs.This issue affec… |
CVE-2023-48271 | Medium | 5.3 | 2024-06-04 | Authentication Bypass by Spoofing vulnerability in yonifre Maspik – Spam blacklist allows Accessing Functionality Not Properly Constrained by ACLs.This issue a… |
CVE-2023-47769 | Low | 3.7 | 2024-06-04 | Authentication Bypass by Spoofing vulnerability in WP Maintenance allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Mainten… |
CVE-2023-41134 | Medium | 5.3 | 2024-06-04 | Authentication Bypass by Spoofing vulnerability in pluginkollektiv Antispam Bee allows Accessing Functionality Not Properly Constrained by ACLs.This issue affe… |
CVE-2023-40332 | Medium | 5.3 | 2024-06-04 | Improper Control of Interaction Frequency vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Functionality Misuse.This issue affects WP-PostRatings: f… |
CVE-2023-37865 | Medium | 5.3 | 2024-06-04 | Authentication Bypass by Spoofing vulnerability in IP2Location Download IP2Location Country Blocker allows Accessing Functionality Not Properly Constrained by… |
CVE-2024-4358 | Critical | 9.8 | 2024-05-29 | In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restr… |
CVE-2024-20363 | Medium | 5.8 | 2024-05-22 | Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unauthenticated, remote… |
CVE-2024-32827 | Medium | 5.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in RafflePress Giveaways and Contests allows Functionality Bypass.This issue affects Giveaways and Contests: fr… |
CVE-2024-32786 | Medium | 5.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in WP Royal Royal Elementor Addons allows Functionality Bypass.This issue affects Royal Elementor Addons: from… |
CVE-2024-32708 | Low | 3.7 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in helderk Maintenance Mode allows Functionality Bypass.This issue affects Maintenance Mode: from n/a through 3… |
CVE-2024-33917 | Medium | 5.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in webtechideas WTI Like Post allows Functionality Bypass.This issue affects WTI Like Post: from n/a through 1… |
CVE-2024-30522 | Medium | 5.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in Stefano Lissa & The Newsletter Team Newsletter allows Functionality Bypass.This issue affects Newsletter: fr… |
CVE-2024-30480 | Low | 3.7 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in Pippin Williamson CGC Maintenance Mode allows Functionality Bypass.This issue affects CGC Maintenance Mode… |
CVE-2024-30479 | Medium | 5.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in LionScripts IP Blocker Lite allows Functionality Bypass.This issue affects IP Blocker Lite: from n/a through… |
CVE-2024-25906 | Medium | 4.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in WP Happy Coders Comments Like Dislike allows Functionality Bypass.This issue affects Comments Like Dislike… |
CVE-2024-25595 | Medium | 5.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in WPMU DEV Defender Security allows Functionality Bypass.This issue affects Defender Security: from n/a throug… |
CVE-2024-22139 | Low | 3.7 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in Filipe Seabra WordPress Manutenção allows Functionality Bypass.This issue affects WordPress Manutenção: from… |
CVE-2024-21746 | Medium | 5.3 | 2024-05-17 | Authentication Bypass by Spoofing vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Identity Spoofing.This issue affects Wp Ultimate Review… |
CVE-2024-32977 | High | 7.1 | 2024-05-14 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows a… |
CVE-2024-34397 | Medium | 5.2 | 2024-05-07 | An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system… |
CVE-2022-22364 | Medium | 5.3 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to external service interaction attack, caused by improper validation of user-supplied input. A… |
CVE-2023-50224 | Medium | 6.5 | 2024-05-03 | TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose se… |
CVE-2023-44447 | Medium | 6.5 | 2024-05-03 | TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensi… |
CVE-2024-34145 | High | 8.8 | 2024-05-02 | A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9… |
CVE-2024-1347 | Medium | 4.3 | 2024-04-25 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from… |
CVE-2024-33531 | High | 8.1 | 2024-04-24 | cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM. |
CVE-2024-27349 | Critical | 9.1 | 2024-04-22 | Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are reco… |
CVE-2024-3843 | Medium | 4.3 | 2024-04-17 | Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2024-31784 | Medium | 6.1 | 2024-04-16 | An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the src com… |
CVE-2024-23558 | Medium | 6.3 | 2024-04-15 | HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. |
CVE-2024-31863 | Medium | 5.3 | 2024-04-09 | Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0… |
CVE-2024-30191 | High | 8.4 | 2024-04-09 | A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0), SCALANCE W1788-1 M12 (6GK5788-1GY0… |
CVE-2024-30190 | Medium | 6.1 | 2024-04-09 | A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0), SCALANCE W1788-1 M12 (6GK5788-1GY0… |
CVE-2024-30189 | Medium | 6.1 | 2024-04-09 | A vulnerability has been identified in SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0) (All versions), SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0) (All versions), SCAL… |
CVE-2024-29006 | Critical | 9.8 | 2024-04-04 | By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request. This could lead to authenti… |
CVE-2024-31008 | Medium | 6.5 | 2024-04-03 | An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive information via the index.php file. |
CVE-2024-22092 | High | 7.7 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a remote attacker bypass permission verification to install apps, although these require user action. |
CVE-2024-28228 | Medium | 5.3 | 2024-03-07 | In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible |
CVE-2024-22457 | High | 7.1 | 2024-03-01 | Dell Secure Connect Gateway 5.20 contains an improper authentication vulnerability during the SRS to SCG update path. A remote low privileged attacker could po… |
CVE-2023-51747 | High | 7.1 | 2024-02-27 | Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of in… |
CVE-2023-42889 | Medium | 5.5 | 2024-02-21 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to bypa… |
CVE-2023-42843 | Medium | 4.3 | 2024-02-21 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17… |
CVE-2024-1555 | High | 8.3 | 2024-02-20 | When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected. This vulnerability affects Firefox < 123. |
CVE-2024-1547 | Medium | 6.5 | 2024-02-20 | Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the victim website's URL sh… |