CWE-294 · Authentication Bypass by Capture-replay (page 3)
Page 3 of 3 — CVEs classified under CWE-294, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45914 | Medium | 6.5 | 2022-11-27 | The ESL (Electronic Shelf Label) protocol, as implemented by (for example) the OV80e934802 RF transceiver on the ETAG-2130-V4.3 20190629 board, does not use au… |
CVE-2021-38827 | High | 7.5 | 2022-11-14 | Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to account takeover. |
CVE-2022-44555 | High | 7.5 | 2022-11-09 | The DDMP/ODMF module has a service hijacking vulnerability. Successful exploit of this vulnerability may cause services to be unavailable. |
CVE-2022-44457 | Critical | 9.8 | 2022-11-08 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.0 <… |
CVE-2020-35473 | Medium | 4.3 | 2022-11-08 | An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended sca… |
CVE-2022-29475 | High | 8.1 | 2022-10-25 | An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-craf… |
CVE-2022-41541 | High | 8.1 | 2022-10-18 | TP-Link AX10v1 V1_211117 allows attackers to execute a replay attack by using a previously transmitted encrypted authentication message and valid authenticatio… |
CVE-2022-2780 | High | 8.1 | 2022-10-14 | In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the… |
CVE-2022-42731 | High | 7.5 | 2022-10-11 | mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device reg… |
CVE-2021-46835 | Medium | 4.3 | 2022-09-20 | There is a traffic hijacking vulnerability in WS7200-10 11.0.2.13. Successful exploitation of this vulnerability can cause packets to be hijacked by attackers. |
CVE-2022-40621 | High | 7.5 | 2022-09-13 | Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing… |
CVE-2022-37011 | Critical | 9.8 | 2022-09-13 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), M… |
CVE-2022-36089 | High | 8.2 | 2022-09-07 | KubeVela is an application delivery platform Users using KubeVela's VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela p… |
CVE-2022-37418 | Medium | 6.4 | 2022-08-24 | The Remote Keyless Entry (RKE) receiving unit on certain Nissan, Kia, and Hyundai vehicles through 2017 allows remote attackers to perform unlock operations an… |
CVE-2022-37305 | Medium | 6.4 | 2022-08-24 | The Remote Keyless Entry (RKE) receiving unit on certain Honda vehicles through 2018 allows remote attackers to perform unlock operations and force a resynchro… |
CVE-2022-36945 | Medium | 6.4 | 2022-08-24 | The Remote Keyless Entry (RKE) receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchro… |
CVE-2021-22640 | High | 7.5 | 2022-07-28 | An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks. |
CVE-2022-31158 | High | 7.5 | 2022-07-15 | LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being vali… |
CVE-2022-29593 | Medium | 5.9 | 2022-07-14 | relay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post requests without the need for authentication… |
CVE-2022-33971 | High | 7.5 | 2022-07-04 | Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation contr… |
CVE-2022-33208 | High | 8.1 | 2022-07-04 | Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation contr… |
CVE-2022-30467 | Medium | 6.8 | 2022-06-29 | Joy ebike Wolf Manufacturing year 2022 is vulnerable to Denial of service, which allows remote attackers to jam the key fob request via RF. |
CVE-2022-31277 | High | 8.8 | 2022-06-16 | Xiaomi Lamp 1 v2.0.4_0066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain contr… |
CVE-2022-30466 | Medium | 6.5 | 2022-06-07 | joyebike Joy ebike Wolf Manufacturing year 2022 is vulnerable to Authentication Bypass by Capture-replay. |
CVE-2022-31265 | High | 8.8 | 2022-05-26 | The replay feature in the client in Wargaming World of Warships 0.11.4 allows remote attackers to execute code when a user launches a replay from an untrusted… |
CVE-2022-29334 | Critical | 9.8 | 2022-05-24 | An issue in H v1.0 allows attackers to bypass authentication via a session replay attack. |
CVE-2022-29878 | High | 7.5 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challenges that are sent during the unencrypted… |
CVE-2020-27374 | High | 7.5 | 2022-04-07 | Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to a Replay Attack to BP Monitoring. |
CVE-2022-25159 | High | 8.1 | 2022-04-01 | Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F serie… |
CVE-2022-22936 | High | 8.8 | 2022-03-29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, w… |
CVE-2022-27254 | Medium | 5.3 | 2022-03-23 | The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack, a related issue t… |
CVE-2021-38296 | High | 7.5 | 2022-03-10 | Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it u… |
CVE-2022-22806 | Critical | 9.8 | 2022-03-09 | A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection i… |
CVE-2021-39364 | High | 7.5 | 2022-02-24 | Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow command spoofing (for camera control) after ARP cache poisoning has been achieved. |
CVE-2022-25838 | High | 8.1 | 2022-02-24 | Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept. |
CVE-2021-46145 | Medium | 5.3 | 2022-01-06 | The keyfob subsystem in Honda Civic 2012 vehicles allows a replay attack for unlocking. This is related to a non-expiring rolling code and counter resynchroniz… |
CVE-2021-40170 | Medium | 6.8 | 2021-12-15 | An RF replay attack vulnerability in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181117, allows an attacker to trigge… |
CVE-2021-41030 | Medium | 5.4 | 2021-12-08 | An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.4 and below may allow an unauthenticated… |
CVE-2021-38459 | High | 8.1 | 2021-10-22 | The data of a network capture of the initial handshake phase can be used to authenticate at a SYSDBA level. If a specific .exe is not restarted often, it is po… |
CVE-2021-35067 | High | 8.1 | 2021-10-07 | Meross MSG100 devices before 3.2.3 allow an attacker to replay the same data or similar data (e.g., an attacker who sniffs a Close message can transmit an acce… |
CVE-2021-25480 | Medium | 4.4 | 2021-10-06 | A lack of replay attack protection in GUTI REALLOCATION COMMAND message process in Qualcomm modem prior to SMR Oct-2021 Release 1 can lead to remote denial of… |
CVE-2021-27662 | High | 8.6 | 2021-09-15 | The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson… |
CVE-2021-26824 | High | 7.1 | 2021-07-26 | DM FingerTool v1.19 in the DM PD065 Secure USB is susceptible to improper authentication by a replay attack, allowing local attackers to bypass user authentica… |
CVE-2020-23178 | Medium | 5.4 | 2021-07-02 | An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack a… |
CVE-2021-31958 | High | 7.5 | 2021-06-08 | Windows NTLM Elevation of Privilege Vulnerability |
CVE-2020-28713 | Medium | 6.5 | 2021-06-08 | Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote users to send push notification events via… |
CVE-2021-27572 | High | 8.1 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 4.0.0.0. Authentication Bypass can occur via Packet Replay. Remote unauthenticated users can execute arbi… |
CVE-2021-22267 | Medium | 5.9 | 2021-02-09 | Idelji Web ViewPoint Suite, as used in conjunction with HPE NonStop, allows a remote replay attack for T0320L01^ABP through T0320L01^ABZ, T0952L01^AAH through… |
CVE-2021-25835 | High | 7.5 | 2021-02-08 | Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch… |
CVE-2021-25834 | High | 7.5 | 2021-02-08 | Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the… |
CVE-2020-27269 | Medium | 5.7 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile app… |
CVE-2020-26172 | Medium | 4.2 | 2020-12-18 | Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The J… |
CVE-2020-35551 | Critical | 9.8 | 2020-12-18 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. They allow attackers to conduct RPMB state-chang… |
CVE-2020-14302 | Medium | 4.9 | 2020-12-15 | A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts… |
CVE-2020-25660 | High | 8.8 | 2020-11-23 | A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then… |
CVE-2020-13799 | Medium | 6.8 | 2020-11-18 | Western Digital has identified a security vulnerability in the Replay Protected Memory Block (RPMB) protocol as specified in multiple standards for storage dev… |
CVE-2020-12355 | Medium | 6.8 | 2020-11-12 | Authentication bypass by capture-replay in RPMB protocol message authentication subsystem in Intel(R) TXE versions before 4.0.30 may allow an unauthenticated u… |
CVE-2018-19025 | Critical | 9.8 | 2020-11-02 | In JUUKO K-808, an attacker could specially craft a packet that encodes an arbitrary command, which could be executed on the K-808 (Firmware versions prior to… |
CVE-2018-17932 | Critical | 9.8 | 2020-11-02 | JUUKO K-800 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.) is vulnerable to a replay attack and command forgery, which could allow attac… |
CVE-2020-27157 | High | 8.1 | 2020-10-15 | Veritas APTARE versions prior to 10.5 included code that bypassed the normal login process when specific authentication credentials were provided to the server… |
CVE-2020-24722 | Medium | 5.9 | 2020-10-07 | An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in COVID-19 applications on Android and iOS… |
CVE-2019-11856 | Low | 3.3 | 2020-08-21 | A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView ser… |
CVE-2020-15688 | High | 8.8 | 2020-07-23 | The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote… |
CVE-2020-10045 | High | 8.8 | 2020-07-14 | A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An error in the challenge-re… |
CVE-2020-4042 | Medium | 6.8 | 2020-07-10 | Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allo… |
CVE-2020-9438 | Medium | 5.9 | 2020-06-23 | Tinxy Door Lock with firmware before 3.2 allow attackers to unlock a door by replaying an Unlock request that occurred when the attacker was previously authori… |
CVE-2020-12692 | Medium | 5.4 | 2020-05-07 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can s… |
CVE-2020-5300 | Medium | 5.8 | 2020-04-06 | In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method… |
CVE-2020-5261 | High | 8.2 | 2020-03-25 | Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token… |
CVE-2020-6972 | Critical | 9.1 | 2020-03-24 | In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed by a capture-replay attack from a web bro… |
CVE-2019-20626 | Medium | 6.5 | 2020-03-23 | The remote keyless system on Honda HR-V 2017 vehicles sends the same RF signal for each door-open request, which might allow a replay attack. |
CVE-2020-10185 | High | 8.6 | 2020-03-05 | The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outsid… |
CVE-2013-1351 | Medium | 5.9 | 2020-01-30 | Verax NMS prior to 2.10 allows authentication via the encrypted password without knowing the cleartext password. |
CVE-2019-13533 | High | 8.1 | 2019-12-16 | In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the controller and replay re… |
CVE-2019-12393 | High | 7.5 | 2019-12-02 | Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open door requests. |
CVE-2019-18226 | Critical | 9.8 | 2019-10-31 | Honeywell equIP series and Performance series IP cameras and recorders, A vulnerability exists in the affected products where IP cameras and recorders have a p… |
CVE-2019-12887 | High | 8.1 | 2019-06-27 | KeyIdentity LinOTP before 2.10.5.3 has Incorrect Access Control (issue 1 of 2). |
CVE-2019-11334 | Low | 3.7 | 2019-06-11 | An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources… |
CVE-2019-9158 | Medium | 5.7 | 2019-06-05 | Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control. |
CVE-2019-5307 | Medium | 4.2 | 2019-06-04 | Some Huawei 4G LTE devices, P30 versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) and P30 Pro versions before VOG-AL00 9.1.0.162(C01E160R1P12/C01E16… |
CVE-2019-3915 | High | 7.5 | 2019-04-11 | Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an unauthenticated attacker w… |
CVE-2018-15498 | High | 8.1 | 2019-03-21 | YSoft SafeQ Server 6 allows a replay attack. |
CVE-2019-9659 | Critical | 9.1 | 2019-03-11 | The Chuango 433 MHz burglar-alarm product line uses static codes in the RF remote control, allowing an attacker to arm, disarm, or trigger the alarm remotely v… |
CVE-2018-19023 | High | 8.8 | 2019-01-25 | Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command… |
CVE-2018-7356 | Medium | 5.6 | 2018-11-01 | All versions up to V3.03.10.B23P2 of ZTE ZXR10 8905E product are impacted by TCP Initial Sequence Number (ISN) reuse vulnerability, which can generate easily p… |
CVE-2018-17903 | Critical | 9.1 | 2018-10-24 | SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to a replay attack and command forgery. |
CVE-2018-17935 | High | 8.1 | 2018-10-24 | All versions of Telecrane F25 Series Radio Controls before 00.0A use fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauth… |
CVE-2018-13789 | High | 7.5 | 2018-10-10 | An issue was discovered in Descor Infocad FM before 3.1.0.0. An unauthenticated web service allows the retrieval of files on the web server and on reachable SM… |
CVE-2018-17176 | High | 7.5 | 2018-09-18 | A replay issue was discovered on Neato Botvac Connected 2.2.0 devices. Manual control mode requires authentication, but once recorded, the authentication (alwa… |
CVE-2018-16242 | Medium | 5.3 | 2018-09-14 | oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy (BLE) to r… |
CVE-2018-7790 | Critical | 9.8 | 2018-08-29 | An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). Th… |
CVE-2018-14781 | Medium | 5.3 | 2018-08-13 | Medtronic MiniMed MMT devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerab… |
CVE-2018-1128 | High | 7.5 | 2018-07-10 | It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph c… |
CVE-2017-5251 | High | 8.1 | 2018-02-22 | In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and connected devices are not encrypted. |
CVE-2017-3191 | Critical | 9.8 | 2017-12-16 | D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that… |
CVE-2017-11786 | High | 8.8 | 2017-10-13 | Skype for Business in Microsoft Lync 2013 SP1 and Skype for Business 2016 allows an attacker to steal an authentication hash that can be reused elsewhere, due… |
CVE-2017-6034 | Critical | 9.8 | 2017-06-30 | An authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartex… |
CVE-2017-6823 | High | 8.8 | 2017-03-12 | Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter to dapur/ in an app=user&act=edit action. |
CVE-2002-0054 | | 2002-03-08 | SMTP service in (1) Microsoft Windows 2000 and (2) Internet Mail Connector (IMC) in Exchange Server 5.5 does not properly handle responses to NTLM authenticati… |