CWE-290 · Authentication Bypass by Spoofing (page 6)
Page 6 of 8 — CVEs classified under CWE-290, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21494 | Medium | 5.4 | 2024-02-17 | All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For header due to improp… |
CVE-2024-23674 | Critical | 9.6 | 2024-02-15 | The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. A man-in-the-middle at… |
CVE-2023-7169 | Medium | 6.0 | 2024-02-08 | Authentication Bypass by Spoofing vulnerability in Snow Software Snow Inventory Agent on Windows allows Signature Spoof.This issue affects Snow Inventory Agent… |
CVE-2024-22520 | High | 8.2 | 2024-02-06 | An issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers to impersonate other drones via transmission of crafted data packets. |
CVE-2024-22519 | High | 8.2 | 2024-02-06 | An issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via transmission of crafted data packets. |
CVE-2024-23832 | Critical | 9.4 | 2024-02-01 | Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin… |
CVE-2023-6044 | Medium | 6.3 | 2024-01-19 | A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate Lenovo Vantage Servic… |
CVE-2023-4566 | High | 7.5 | 2024-01-16 | Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentialit… |
CVE-2023-44117 | High | 7.5 | 2024-01-16 | Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentialit… |
CVE-2023-4001 | Medium | 6.8 | 2024-01-15 | An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the passw… |
CVE-2024-0454 | Medium | 6.0 | 2024-01-12 | ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows… |
CVE-2023-51350 | Critical | 9.8 | 2024-01-11 | A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the X-Forwarded-… |
CVE-2023-41069 | Medium | 5.5 | 2024-01-10 | This issue was addressed by improving Face ID anti-spoofing models. This issue is fixed in iOS 17 and iPadOS 17. A 3D model constructed to look like the enroll… |
CVE-2024-20674 | High | 8.8 | 2024-01-09 | Windows Kerberos Security Feature Bypass Vulnerability |
CVE-2023-49794 | Medium | 6.7 | 2024-01-02 | KernelSU is a Kernel-based root solution for Android devices. In versions 0.7.1 and prior, the logic of get apk path in KernelSU kernel module can be bypassed… |
CVE-2023-35622 | High | 7.5 | 2023-12-12 | Windows DNS Spoofing Vulnerability |
CVE-2023-50463 | Medium | 6.5 | 2023-12-10 | The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address… |
CVE-2023-43304 | High | 8.2 | 2023-12-07 | An issue in PARK DANDAN mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-6263 | High | 8.3 | 2023-11-22 | An issue was discovered by IPVM team in Network Optix NxCloud before 23.1.0.40440. It was possible to add a fake VMS server to NxCloud by using the exact ident… |
CVE-2023-3103 | High | 8.0 | 2023-11-22 | Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera… |
CVE-2023-5801 | Critical | 9.1 | 2023-11-08 | Vulnerability of identity verification being bypassed in the face unlock module. Successful exploitation of this vulnerability will affect integrity and confid… |
CVE-2023-36769 | Medium | 4.6 | 2023-11-06 | Microsoft OneNote Spoofing Vulnerability |
CVE-2023-20246 | Medium | 5.8 | 2023-11-01 | Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the con… |
CVE-2023-20256 | Medium | 5.0 | 2023-11-01 | Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software… |
CVE-2023-20245 | Medium | 5.8 | 2023-11-01 | Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software… |
CVE-2023-28803 | Medium | 5.9 | 2023-10-23 | An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypas… |
CVE-2023-30803 | Critical | 9.8 | 2023-10-10 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can… |
CVE-2023-44463 | Medium | 5.3 | 2023-10-02 | An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers e… |
CVE-2023-41329 | Low | 3.9 | 2023-09-06 | WireMock is a tool for mocking HTTP services. The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventi… |
CVE-2023-4178 | Critical | 9.8 | 2023-09-05 | Authentication Bypass by Spoofing vulnerability in Neutron Neutron Smart VMS allows Authentication Bypass. This issue affects Neutron Smart VMS: before b1130… |
CVE-2023-31424 | High | 8.1 | 2023-08-31 | Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization. |
CVE-2023-30950 | Medium | 6.5 | 2023-08-03 | The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint |
CVE-2023-38173 | Medium | 4.3 | 2023-07-21 | Microsoft Edge for Android Spoofing Vulnerability |
CVE-2023-35392 | Medium | 4.7 | 2023-07-21 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2023-34329 | Critical | 9.1 | 2023-07-18 | AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vul… |
CVE-2023-36883 | Medium | 4.3 | 2023-07-14 | Microsoft Edge for iOS Spoofing Vulnerability |
CVE-2022-48513 | Critical | 9.8 | 2023-07-06 | Vulnerability of identity verification being bypassed in the Gallery module. Successful exploitation of this vulnerability may cause out-of-bounds access. |
CVE-2023-27199 | Medium | 6.7 | 2023-07-05 | PAX Technology A930 PayDroid_7.1.1_Virgo_V04.5.02_20220722 allows attackers to compile a malicious shared library and use LD_PRELOAD to bypass authorization ch… |
CVE-2023-22814 | Critical | 10.0 | 2023-07-01 | An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonati… |
CVE-2023-29147 | Medium | 5.5 | 2023-06-30 | In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when… |
CVE-2023-3243 | High | 8.3 | 2023-06-28 | ** UNSUPPORTED WHEN ASSIGNED ** [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 ha… |
CVE-2021-25827 | Critical | 9.8 | 2023-06-28 | Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address. |
CVE-2023-27964 | Medium | 5.4 | 2023-06-23 | An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 5E133. When your headphones are seeking a… |
CVE-2023-3128 | Critical | 9.4 | 2023-06-22 | Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads… |
CVE-2023-34167 | Medium | 5.3 | 2023-06-19 | Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the deskto… |
CVE-2023-34160 | Medium | 5.3 | 2023-06-19 | Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the deskto… |
CVE-2023-34158 | Medium | 5.3 | 2023-06-19 | Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the deskto… |
CVE-2022-48469 | Medium | 6.5 | 2023-06-16 | There is a traffic hijacking vulnerability in Huawei routers. Successful exploitation of this vulnerability can cause packets to be hijacked by attackers. |
CVE-2023-34157 | Critical | 10.0 | 2023-06-16 | Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app. |
CVE-2023-33140 | Medium | 6.5 | 2023-06-14 | Microsoft OneNote Spoofing Vulnerability |
CVE-2023-2807 | Medium | 6.4 | 2023-06-13 | Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset pr… |
CVE-2022-36331 | Critical | 10.0 | 2023-06-12 | Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthentica… |
CVE-2023-2001 | Medium | 4.3 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from… |
CVE-2023-32207 | High | 8.8 | 2023-06-02 | A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefo… |
CVE-2023-25743 | High | 7.5 | 2023-06-02 | A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only affects Firefox Fo… |
CVE-2023-2887 | Critical | 9.8 | 2023-05-25 | Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3… |
CVE-2023-29334 | Medium | 4.3 | 2023-04-28 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2022-47522 | High | 7.5 | 2023-04-15 | The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a tar… |
CVE-2023-24935 | Medium | 6.1 | 2023-04-11 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2022-48349 | Critical | 9.1 | 2023-03-27 | The control component has a spoofing vulnerability. Successful exploitation of this vulnerability may affect confidentiality and availability. |
CVE-2023-0816 | Medium | 6.5 | 2023-03-27 | The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address sp… |
CVE-2023-24892 | High | 8.2 | 2023-03-14 | Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability |
CVE-2023-23398 | High | 7.1 | 2023-03-14 | Microsoft Excel Spoofing Vulnerability |
CVE-2022-4550 | High | 7.5 | 2023-02-27 | The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP s… |
CVE-2023-21794 | Medium | 4.3 | 2023-02-14 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2022-47648 | High | 7.6 | 2023-02-08 | An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authenticati… |
CVE-2023-22474 | High | 8.7 | 2023-02-03 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for`… |
CVE-2022-40269 | Medium | 6.8 | 2023-02-02 | Authentication Bypass by Spoofing vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000, Mitsubishi Electr… |
CVE-2022-32747 | High | 8.0 | 2023-01-30 | A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account… |
CVE-2022-3820 | Medium | 6.5 | 2023-01-26 | An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct a… |
CVE-2022-4746 | High | 7.5 | 2023-01-23 | The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possib… |
CVE-2022-4303 | High | 7.5 | 2023-01-23 | The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it… |
CVE-2020-22660 | High | 7.5 | 2023-01-20 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199… |
CVE-2023-20025 | Critical | 9.0 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 Routers could allow an unauthenticated, remote at… |
CVE-2022-31738 | Medium | 6.5 | 2022-12-22 | When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofin… |
CVE-2022-44713 | High | 7.5 | 2022-12-13 | Microsoft Outlook for Mac Spoofing Vulnerability |
CVE-2022-44636 | Medium | 4.6 | 2022-12-13 | The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is activating remote… |
CVE-2022-4098 | High | 8.0 | 2022-12-13 | Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the C… |
CVE-2022-41798 | Medium | 6.5 | 2022-12-05 | Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to log i… |
CVE-2021-45036 | High | 8.7 | 2022-11-28 | Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the… |
CVE-2022-38164 | Medium | 6.5 | 2022-11-07 | A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website could make a phishing attack with URL spoofin… |
CVE-2022-38712 | Medium | 5.9 | 2022-11-03 | "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwant… |
CVE-2022-3337 | Medium | 6.7 | 2022-10-28 | It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/clou… |
CVE-2022-42983 | High | 8.8 | 2022-10-17 | anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens. |
CVE-2022-0030 | High | 8.1 | 2022-10-12 | An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target… |
CVE-2022-35770 | Medium | 6.5 | 2022-10-11 | Windows NTLM Spoofing Vulnerability |
CVE-2022-34689 | High | 7.5 | 2022-10-11 | Windows CryptoAPI Spoofing Vulnerability |
CVE-2021-27862 | Medium | 4.7 | 2022-09-27 | Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (… |
CVE-2021-27861 | Medium | 4.7 | 2022-09-27 | Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers) |
CVE-2021-27854 | Medium | 4.7 | 2022-09-27 | Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using combinations of VLAN 0 headers, LLC/SNAP headers, and converting frames from… |
CVE-2021-27853 | Medium | 4.7 | 2022-09-27 | Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers. |
CVE-2022-39227 | Critical | 9.1 | 2022-09-23 | python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in ide… |
CVE-2022-23949 | High | 7.5 | 2022-09-21 | In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar. |
CVE-2021-43310 | Critical | 9.8 | 2022-09-21 | A vulnerability in Keylime before 6.3.0 allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to… |
CVE-2022-35957 | Medium | 6.6 | 2022-09-20 | Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server ad… |
CVE-2022-37709 | Medium | 5.3 | 2022-09-16 | Tesla Model 3 V11.0(2022.4.5.1 6b701552d7a6) Tesla mobile app v4.23 is vulnerable to Authentication Bypass by spoofing. Tesla Model 3's Phone Key authenticatio… |
CVE-2022-31149 | High | 8.8 | 2022-09-07 | ActivityWatch open-source automated time tracker. Versions prior to 0.12.0b2 are vulnerable to DNS rebinding attacks. This vulnerability impacts everyone runni… |
CVE-2022-32744 | High | 8.8 | 2022-08-25 | A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user… |
CVE-2022-33991 | Medium | 5.3 | 2022-08-15 | dproxy-nexgen (aka dproxy nexgen) forwards and caches DNS queries with the CD (aka checking disabled) bit set to 1. This leads to disabling of DNSSEC protectio… |
CVE-2022-34716 | Medium | 5.9 | 2022-08-09 | .NET Spoofing Vulnerability |