CWE-290 · Authentication Bypass by Spoofing (page 8)
Page 8 of 8 — CVEs classified under CWE-290, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-18259 | Critical | 9.8 | 2019-12-16 | In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands. |
CVE-2019-16766 | High | 8.7 | 2019-11-29 | When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by chan… |
CVE-2019-13715 | Medium | 4.3 | 2019-11-25 | Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to perform domain spoofing via IDN homog… |
CVE-2019-13709 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in downloads in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass download restrictions via a crafted HTM… |
CVE-2019-13708 | Medium | 4.3 | 2019-11-25 | Inappropriate implementation in navigation in Google Chrome on iOS prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox (URL ba… |
CVE-2019-13704 | Medium | 4.3 | 2019-11-25 | Insufficient policy enforcement in navigation in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass content security policy via a crafted… |
CVE-2019-13703 | Medium | 4.3 | 2019-11-25 | Insufficient policy enforcement in the Omnibox in Google Chrome on Android prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox… |
CVE-2019-13701 | Medium | 4.3 | 2019-11-25 | Incorrect implementation in navigation in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a cr… |
CVE-2019-0388 | Medium | 5.3 | 2019-11-13 | SAP UI5 HTTP Handler (corrected in SAP_UI versions 7.5, 7.51, 7.52, 7.53, 7.54 and SAP UI_700 version 2.0) allows an attacker to manipulate content due to insu… |
CVE-2019-1234 | High | 7.5 | 2019-11-12 | A spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure Stack Spoofing Vulnerability'. |
CVE-2013-5661 | Medium | 5.9 | 2019-11-05 | Cache Poisoning issue exists in DNS Response Rate Limiting. |
CVE-2019-18659 | Medium | 5.3 | 2019-11-02 | The Wireless Emergency Alerts (WEA) protocol allows remote attackers to spoof a Presidential Alert because cryptographic authentication is not used, as demonst… |
CVE-2019-1357 | Medium | 4.3 | 2019-10-10 | A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies, aka 'Microsoft Browser Spoofing Vulnerability'. This CVE ID is uniqu… |
CVE-2019-1318 | Medium | 5.9 | 2019-10-10 | A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions, aka 'Microsoft Windows Transport Layer… |
CVE-2019-0608 | Medium | 4.3 | 2019-10-10 | A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content, aka 'Microsoft Browser Spoofing Vulnerability'. This CVE ID is un… |
CVE-2019-15022 | High | 7.5 | 2019-10-09 | A security vulnerability exists in Zingbox Inspector versions 1.294 and earlier, that allows for the Inspector to be susceptible to ARP spoofing. |
CVE-2019-16378 | Critical | 9.8 | 2019-09-17 | OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applicatio… |
CVE-2019-3884 | Medium | 5.4 | 2019-08-01 | A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from another namespace is abl… |
CVE-2018-7842 | Critical | 9.8 | 2019-05-22 | A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which… |
CVE-2019-0283 | High | 7.1 | 2019-04-10 | SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is… |
CVE-2019-10875 | Medium | 6.5 | 2019-04-05 | A URL spoofing vulnerability was found in all international versions of Xiaomi Mi browser 10.5.6-g (aka the MIUI native browser) and Mint Browser 1.5.3 due to… |
CVE-2019-3775 | High | 7.1 | 2019-03-07 | Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by ch… |
CVE-2018-15588 | High | 7.5 | 2019-02-11 | MailMate before 1.11.3 mishandles a suspicious HTML/MIME structure in a signed/encrypted email. |
CVE-2018-16483 | High | 8.8 | 2019-02-01 | A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators. |
CVE-2018-15715 | Critical | 9.8 | 2018-11-30 | Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are vulnerable to unauth… |
CVE-2018-3829 | Medium | 5.3 | 2018-09-19 | In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on new hosts with an invalid roles token. An… |
CVE-2018-8425 | Medium | 4.3 | 2018-09-13 | A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microso… |
CVE-2018-1695 | High | 7.3 | 2018-09-06 | IBM WebSphere Application Server 7.0, 8.0, and 8.5.5 installations using Form Login could allow a remote attacker to conduct spoofing attacks. IBM X-Force ID… |
CVE-2018-8388 | Medium | 4.3 | 2018-08-15 | A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microso… |
CVE-2018-8383 | Medium | 4.3 | 2018-08-15 | A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microsoft E… |
CVE-2018-8278 | Medium | 6.1 | 2018-07-11 | A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microso… |
CVE-2018-12331 | High | 7.4 | 2018-06-17 | Authentication Bypass by Spoofing vulnerability in ECOS System Management Appliance (aka SMA) 5.2.68 allows a man-in-the-middle attacker to compromise authenti… |
CVE-2018-7160 | High | 8.8 | 2018-05-17 | The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possibl… |
CVE-2018-8153 | Medium | 5.4 | 2018-05-09 | A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Spoof… |
CVE-2017-12095 | Medium | 6.5 | 2018-04-05 | An exploitable vulnerability exists in the WiFi Access Point feature of Circle with Disney running firmware 2.0.1. A series of WiFi packets can force Circle to… |
CVE-2017-18190 | High | 7.5 | 2018-02-16 | A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by… |
CVE-2017-16897 | High | 8.1 | 2017-12-27 | A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate… |
CVE-2017-14487 | Critical | 9.1 | 2017-12-01 | The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API s… |
CVE-2017-12096 | Medium | 6.5 | 2017-11-07 | An exploitable vulnerability exists in the WiFi management of Circle with Disney. A crafted Access Point with the same name as the legitimate one can be used t… |
CVE-2017-14375 | Critical | 9.8 | 2017-11-01 | EMC Unisphere for VMAX Virtual Appliance (vApp) versions prior to 8.4.0.15, EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.15, EMC VASA Virtua… |
CVE-2017-14003 | Critical | 9.8 | 2017-10-11 | An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01.00/29.03.2007 and prior versions. An i… |
CVE-2017-11717 | High | 7.5 | 2017-07-28 | MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements… |
CVE-2017-8422 | High | 7.8 | 2017-05-17 | KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privileged helper app. |
CVE-2017-6405 | High | 7.5 | 2017-03-02 | An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. Hostname-based security is open to DNS spoofing. |
CVE-2009-1048 | Critical | 9.8 | 2009-08-14 | The web interface on the snom VoIP phones snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 6.5 before 6.5.20, 7.1 before 7.1.39, and 7.3 befo… |
CVE-1999-0012 | High | 7.0 | 1998-02-06 | Some web servers under Microsoft Windows allow remote attackers to bypass access restrictions for files with long file names. |