CWE-290 · Authentication Bypass by Spoofing (page 5)
Page 5 of 7 — CVEs classified under CWE-290, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-31784 | Medium | 6.1 | 2024-04-16 | An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the src com… |
CVE-2024-23558 | Medium | 6.3 | 2024-04-15 | HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. |
CVE-2024-31863 | Medium | 5.3 | 2024-04-09 | Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0… |
CVE-2024-30191 | High | 8.4 | 2024-04-09 | A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0), SCALANCE W1788-1 M12 (6GK5788-1GY0… |
CVE-2024-30190 | Medium | 6.1 | 2024-04-09 | A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0), SCALANCE W1788-1 M12 (6GK5788-1GY0… |
CVE-2024-30189 | Medium | 6.1 | 2024-04-09 | A vulnerability has been identified in SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0) (All versions), SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0) (All versions), SCAL… |
CVE-2024-29006 | Critical | 9.8 | 2024-04-04 | By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request. This could lead to authenti… |
CVE-2024-31008 | Medium | 6.5 | 2024-04-03 | An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive information via the index.php file. |
CVE-2024-22092 | High | 7.7 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a remote attacker bypass permission verification to install apps, although these require user action. |
CVE-2024-28228 | Medium | 5.3 | 2024-03-07 | In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible |
CVE-2024-22457 | High | 7.1 | 2024-03-01 | Dell Secure Connect Gateway 5.20 contains an improper authentication vulnerability during the SRS to SCG update path. A remote low privileged attacker could po… |
CVE-2023-51747 | High | 7.1 | 2024-02-27 | Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of in… |
CVE-2023-42889 | Medium | 5.5 | 2024-02-21 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to bypa… |
CVE-2023-42843 | Medium | 4.3 | 2024-02-21 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17… |
CVE-2024-1555 | High | 8.3 | 2024-02-20 | When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected. This vulnerability affects Firefox < 123. |
CVE-2024-1547 | Medium | 6.5 | 2024-02-20 | Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the victim website's URL sh… |
CVE-2024-21494 | Medium | 5.4 | 2024-02-17 | All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For header due to improp… |
CVE-2024-23674 | Critical | 9.6 | 2024-02-15 | The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. A man-in-the-middle at… |
CVE-2023-7169 | Medium | 6.0 | 2024-02-08 | Authentication Bypass by Spoofing vulnerability in Snow Software Snow Inventory Agent on Windows allows Signature Spoof.This issue affects Snow Inventory Agent… |
CVE-2024-22520 | High | 8.2 | 2024-02-06 | An issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers to impersonate other drones via transmission of crafted data packets. |
CVE-2024-22519 | High | 8.2 | 2024-02-06 | An issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via transmission of crafted data packets. |
CVE-2024-23832 | Critical | 9.4 | 2024-02-01 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin… |
CVE-2023-6044 | Medium | 6.3 | 2024-01-19 | A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate Lenovo Vantage Servic… |
CVE-2023-4566 | High | 7.5 | 2024-01-16 | Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentialit… |
CVE-2023-44117 | High | 7.5 | 2024-01-16 | Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentialit… |
CVE-2023-4001 | Medium | 6.8 | 2024-01-15 | An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the passw… |
CVE-2024-0454 | Medium | 6.0 | 2024-01-12 | ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows… |
CVE-2023-51350 | Critical | 9.8 | 2024-01-11 | A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the X-Forwarded-… |
CVE-2023-41069 | Medium | 5.5 | 2024-01-10 | This issue was addressed by improving Face ID anti-spoofing models. This issue is fixed in iOS 17 and iPadOS 17. A 3D model constructed to look like the enroll… |
CVE-2024-20674 | High | 8.8 | 2024-01-09 | Windows Kerberos Security Feature Bypass Vulnerability |
CVE-2023-49794 | Medium | 6.7 | 2024-01-02 | KernelSU is a Kernel-based root solution for Android devices. In versions 0.7.1 and prior, the logic of get apk path in KernelSU kernel module can be bypassed… |
CVE-2023-35622 | High | 7.5 | 2023-12-12 | Windows DNS Spoofing Vulnerability |
CVE-2023-50463 | Medium | 6.5 | 2023-12-10 | The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address… |
CVE-2023-43304 | High | 8.2 | 2023-12-07 | An issue in PARK DANDAN mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-6263 | High | 8.3 | 2023-11-22 | An issue was discovered by IPVM team in Network Optix NxCloud before 23.1.0.40440. It was possible to add a fake VMS server to NxCloud by using the exact ident… |
CVE-2023-3103 | High | 8.0 | 2023-11-22 | Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera… |
CVE-2023-5801 | Critical | 9.1 | 2023-11-08 | Vulnerability of identity verification being bypassed in the face unlock module. Successful exploitation of this vulnerability will affect integrity and confid… |
CVE-2023-36769 | Medium | 4.6 | 2023-11-06 | Microsoft OneNote Spoofing Vulnerability |
CVE-2023-20246 | Medium | 5.8 | 2023-11-01 | Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the con… |
CVE-2023-20256 | Medium | 5.0 | 2023-11-01 | Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software… |
CVE-2023-20245 | Medium | 5.8 | 2023-11-01 | Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software… |
CVE-2023-28803 | Medium | 5.9 | 2023-10-23 | An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypas… |
CVE-2023-30803 | Critical | 9.8 | 2023-10-10 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can… |
CVE-2023-44463 | Medium | 5.3 | 2023-10-02 | An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers e… |
CVE-2023-41329 | Low | 3.9 | 2023-09-06 | WireMock is a tool for mocking HTTP services. The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventi… |
CVE-2023-4178 | Critical | 9.8 | 2023-09-05 | Authentication Bypass by Spoofing vulnerability in Neutron Neutron Smart VMS allows Authentication Bypass. This issue affects Neutron Smart VMS: before b1130… |
CVE-2023-31424 | High | 8.1 | 2023-08-31 | Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization. |
CVE-2023-30950 | Medium | 6.5 | 2023-08-03 | The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint |
CVE-2023-38173 | Medium | 4.3 | 2023-07-21 | Microsoft Edge for Android Spoofing Vulnerability |
CVE-2023-35392 | Medium | 4.7 | 2023-07-21 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2023-34329 | Critical | 9.1 | 2023-07-18 | AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vul… |
CVE-2023-36883 | Medium | 4.3 | 2023-07-14 | Microsoft Edge for iOS Spoofing Vulnerability |
CVE-2022-48513 | Critical | 9.8 | 2023-07-06 | Vulnerability of identity verification being bypassed in the Gallery module. Successful exploitation of this vulnerability may cause out-of-bounds access. |
CVE-2023-27199 | Medium | 6.7 | 2023-07-05 | PAX Technology A930 PayDroid_7.1.1_Virgo_V04.5.02_20220722 allows attackers to compile a malicious shared library and use LD_PRELOAD to bypass authorization ch… |
CVE-2023-22814 | Critical | 10.0 | 2023-07-01 | An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonati… |
CVE-2023-29147 | Medium | 5.5 | 2023-06-30 | In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when… |
CVE-2023-3243 | High | 8.3 | 2023-06-28 | ** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 ha… |
CVE-2021-25827 | Critical | 9.8 | 2023-06-28 | Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address. |
CVE-2023-27964 | Medium | 5.4 | 2023-06-23 | An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 5E133. When your headphones are seeking a… |
CVE-2023-3128 | Critical | 9.4 | 2023-06-22 | Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads… |
CVE-2023-34167 | Medium | 5.3 | 2023-06-19 | Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the deskto… |
CVE-2023-34160 | Medium | 5.3 | 2023-06-19 | Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the deskto… |
CVE-2023-34158 | Medium | 5.3 | 2023-06-19 | Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the deskto… |
CVE-2022-48469 | Medium | 6.5 | 2023-06-16 | There is a traffic hijacking vulnerability in Huawei routers. Successful exploitation of this vulnerability can cause packets to be hijacked by attackers. |
CVE-2023-34157 | Critical | 10.0 | 2023-06-16 | Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app. |
CVE-2023-33140 | Medium | 6.5 | 2023-06-14 | Microsoft OneNote Spoofing Vulnerability |
CVE-2023-2807 | Medium | 6.4 | 2023-06-13 | Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset pr… |
CVE-2022-36331 | Critical | 10.0 | 2023-06-12 | Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthentica… |
CVE-2023-2001 | Medium | 4.3 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from… |
CVE-2023-32207 | High | 8.8 | 2023-06-02 | A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefo… |
CVE-2023-25743 | High | 7.5 | 2023-06-02 | A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only affects Firefox Fo… |
CVE-2023-2887 | Critical | 9.8 | 2023-05-25 | Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3… |
CVE-2023-29334 | Medium | 4.3 | 2023-04-28 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2022-47522 | High | 7.5 | 2023-04-15 | The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a tar… |
CVE-2023-24935 | Medium | 6.1 | 2023-04-11 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2022-48349 | Critical | 9.1 | 2023-03-27 | The control component has a spoofing vulnerability. Successful exploitation of this vulnerability may affect confidentiality and availability. |
CVE-2023-0816 | Medium | 6.5 | 2023-03-27 | The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address sp… |
CVE-2023-24892 | High | 8.2 | 2023-03-14 | Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability |
CVE-2023-23398 | High | 7.1 | 2023-03-14 | Microsoft Excel Spoofing Vulnerability |
CVE-2022-4550 | High | 7.5 | 2023-02-27 | The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP s… |
CVE-2023-21794 | Medium | 4.3 | 2023-02-14 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2022-47648 | High | 7.6 | 2023-02-08 | An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authenticati… |
CVE-2023-22474 | High | 8.7 | 2023-02-03 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for`… |
CVE-2022-40269 | Medium | 6.8 | 2023-02-02 | Authentication Bypass by Spoofing vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000, Mitsubishi Electr… |
CVE-2022-32747 | High | 8.0 | 2023-01-30 | A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account… |
CVE-2022-3820 | Medium | 6.5 | 2023-01-26 | An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct a… |
CVE-2022-4746 | High | 7.5 | 2023-01-23 | The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possib… |
CVE-2022-4303 | High | 7.5 | 2023-01-23 | The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it… |
CVE-2020-22660 | High | 7.5 | 2023-01-20 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199… |
CVE-2023-20025 | Critical | 9.0 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 Routers could allow an unauthenticated, remote at… |
CVE-2022-31738 | Medium | 6.5 | 2022-12-22 | When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofin… |
CVE-2022-44713 | High | 7.5 | 2022-12-13 | Microsoft Outlook for Mac Spoofing Vulnerability |
CVE-2022-44636 | Medium | 4.6 | 2022-12-13 | The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is activating remote… |
CVE-2022-4098 | High | 8.0 | 2022-12-13 | Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the C… |
CVE-2022-41798 | Medium | 6.5 | 2022-12-05 | Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to log i… |
CVE-2021-45036 | High | 8.7 | 2022-11-28 | Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the… |
CVE-2022-38164 | Medium | 6.5 | 2022-11-07 | A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website could make a phishing attack with URL spoofin… |
CVE-2022-38712 | Medium | 5.9 | 2022-11-03 | "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwant… |
CVE-2022-3337 | Medium | 6.7 | 2022-10-28 | It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/clou… |
CVE-2022-42983 | High | 8.8 | 2022-10-17 | anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens. |