CWE-290: Authentication Bypass by Spoofing, page 11

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

What the weakness is: CWE-290 at MITRE

1. 4.3CVE-2024-8908EPSS 0.4%2024-09-17

   Inappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

2. 8.8CVE-2024-6678EPSS 2.0%2024-09-12

   An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary u…

3. 7.8CVE-2024-44104EPSS 0.2%2024-09-10

   An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privil…

4. 4.7CVE-2024-8399EPSS 0.3%2024-09-03

   Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130.

5. 6.1CVE-2024-8386EPSS 0.4%2024-09-03

   If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird <…

6. 3.7CVE-2024-43944EPSS 0.4%2024-08-29

   Authentication Bypass by Spoofing vulnerability in ilyasine Maintenance & Coming Soon Redirect Animation maintenance-coming-soon-redirect-animation allows Identity Spoofing.This issue affects Maintenance & Coming Soon Redirect Animation: f…

7. 8.1CVE-2024-7745EPSS 0.4%2024-08-28

   In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only.

8. 6.5CVE-2024-42364EPSS 0.3%2024-08-23

   Homepage is a highly customizable homepage with Docker and service API integrations. The default setup of homepage 0.9.1 is vulnerable to DNS rebinding. Homepage is setup without certificate and authentication by default, leaving it to vul…

9. 6.3CVE-2024-38807EPSS 0.1%2024-08-23

   Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed b…

10. 4.3CVE-2024-7981EPSS 0.4%2024-08-21

    Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

11. 6.5CVE-2024-35539ExploitEPSS 1.4%2024-08-19

    Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerability allows attackers to post several comments before the spam protection checks if the comments are posted too frequent…

12. 5.3CVE-2024-35538EPSS 0.6%2024-08-19

    Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as value of X-Forwarded-For or Client-Ip headers while performing HTTP requests.

13. 5.3CVE-2024-41432EPSS 0.4%2024-08-07

    An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' h…

14. 9.1CVE-2023-48396EPSS 0.7%2024-07-30

    Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user. Attacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources…

15. 4.4CVE-2024-27853EPSS 0.2%2024-07-29

    This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4. A maliciously crafted ZIP archive may bypass Gatekeeper checks.

16. 8.1CVE-2024-41107ExploitEPSS 18%2024-07-19

    The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass…

17. 7.7CVE-2023-40702EPSS 0.4%2024-07-09

    PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor mig…

18. 8.7CVE-2023-40356EPSS 0.4%2024-07-09

    PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without req…

19. 5.3CVE-2024-37430EPSS 0.4%2024-07-09

    Authentication Bypass by Spoofing vulnerability in patreon Patreon WordPress patreon-connect.This issue affects Patreon WordPress: from n/a through <= 1.9.0.

20. 5.3CVE-2024-6163EPSS 0.5%2024-07-08

    Certain http endpoints of Checkmk in Checkmk < 2.3.0p10 < 2.2.0p31, < 2.1.0p46, <= 2.0.0p39 allows remote attacker to bypass authentication and access data

21. 9.1CVE-2024-37082EPSS 0.5%2024-07-03

    When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypass mTLS authentication to Cloud Foundry applications.  You are affected if you …

22. 7.5CVE-2024-39350EPSS 0.7%2024-06-28

    A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality. This allows man-in-the-middle attackers to obtain privileges without consent via unspecified vectors. The following models with Synology Camera…

23. 6.3CVE-2024-31802EPSS 0.3%2024-06-27

    DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code.

24. 6.3CVE-2024-4846EPSS 0.4%2024-06-25

    Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without being asked for the 2FA via another browser tab.

25. 6.5CVE-2024-39337EPSS 0.3%2024-06-24

    Click Studios Passwordstate Core before 9.8 build 9858 allows Authentication Bypass.

26. 7.2CVE-2024-21518EPSS 14%2024-06-22

    This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the f…

27. 5.4CVE-2024-30058EPSS 0.4%2024-06-13

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

28. 6.5CVE-2024-36588EPSS 0.4%2024-06-13

    An issue in Annonshop.app DecentralizeJustice/ anonymousLocker commit 2b2b4 allows attackers to send messages erroneously attributed to arbitrary users via a crafted HTTP request.

29. 2.7CVE-2024-5812EPSS 0.3%2024-06-11

    A low severity vulnerability in BIPS has been identified where an attacker with high privileges or a compromised high privilege account can overwrite Read-Only smart rules via a specially crafted API request.

30. 5.3CVE-2024-35749EPSS 0.3%2024-06-10

    Authentication Bypass by Spoofing vulnerability in Acurax Under Construction / Maintenance Mode from Acurax allows Authentication Bypass.This issue affects Under Construction / Maintenance Mode from Acurax: from n/a through 2.6.

31. 7.5CVE-2024-5037EPSS 0.8%2024-06-05

    A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue ("iss") check during JSON web token (JWT) authentication.

32. 5.3CVE-2023-52176EPSS 0.4%2024-06-04

    Authentication Bypass by Spoofing vulnerability in miniorange Malware Scanner allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Malware Scanner: from n/a through 4.7.1.

33. 8.2CVE-2023-51667EPSS 0.4%2024-06-04

    Authentication Bypass by Spoofing vulnerability in FeedbackWP Rate my Post – WP Rating System allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.2.

34. 7.5CVE-2023-51543EPSS 0.4%2024-06-04

    Authentication Bypass by Spoofing vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.2.5.0.

35. 5.3CVE-2023-51542EPSS 0.4%2024-06-04

    Authentication Bypass by Spoofing vulnerability in WPMU DEV Branda allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Branda: from n/a through 3.4.14.

36. 3.7CVE-2023-49741EPSS 0.3%2024-06-04

    Authentication Bypass by Spoofing vulnerability in wpdevart Coming soon and Maintenance mode allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming soon and Maintenance mode: from n/a through 3.7.3.

37. 5.3CVE-2023-48753EPSS 0.4%2024-06-04

    Authentication Bypass by Spoofing vulnerability in 10up Restricted Site Access allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Restricted Site Access: from n/a through 7.4.1.

38. 5.3CVE-2023-48271EPSS 0.4%2024-06-04

    Authentication Bypass by Spoofing vulnerability in yonifre Maspik – Spam blacklist allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maspik – Spam blacklist: from n/a through 0.10.3.

39. 3.7CVE-2023-47769EPSS 0.3%2024-06-04

    Authentication Bypass by Spoofing vulnerability in WP Maintenance allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Maintenance: from n/a through 6.1.3.

40. 5.3CVE-2023-41134EPSS 0.4%2024-06-04

    Authentication Bypass by Spoofing vulnerability in pluginkollektiv Antispam Bee allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Antispam Bee: from n/a through 2.11.3.

41. 9.8CVE-2023-40332EPSS 0.4%2024-06-04

    Improper Control of Interaction Frequency vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Functionality Misuse.This issue affects WP-PostRatings: from n/a through 1.91.

42. 5.3CVE-2023-37865EPSS 0.4%2024-06-04

    Authentication Bypass by Spoofing vulnerability in IP2Location Download IP2Location Country Blocker allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Download IP2Location Country Blocker: from n/a through 2…

43. 9.8CVE-2024-4358KEVExploitEPSS 97%2024-05-29

    In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

44. 5.8CVE-2024-20363EPSS 0.4%2024-05-22

    Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unauthenticated, remote attacker to bypass the configured rules on an affected system. This vulnerabilit…

45. 5.3CVE-2024-32827EPSS 0.4%2024-05-17

    Authentication Bypass by Spoofing vulnerability in RafflePress Giveaways and Contests allows Functionality Bypass.This issue affects Giveaways and Contests: from n/a through 1.12.7.

46. 9.8CVE-2024-32786EPSS 0.5%2024-05-17

    Authentication Bypass by Spoofing vulnerability in WP Royal Royal Elementor Addons allows Functionality Bypass.This issue affects Royal Elementor Addons: from n/a through 1.3.93.

47. 3.7CVE-2024-32708EPSS 0.4%2024-05-17

    Authentication Bypass by Spoofing vulnerability in helderk Maintenance Mode allows Functionality Bypass.This issue affects Maintenance Mode: from n/a through 3.0.1.

48. 5.3CVE-2024-33917EPSS 0.4%2024-05-17

    Authentication Bypass by Spoofing vulnerability in webtechideas WTI Like Post allows Functionality Bypass.This issue affects WTI Like Post: from n/a through 1.4.6.

49. 5.3CVE-2024-30522EPSS 0.5%2024-05-17

    Authentication Bypass by Spoofing vulnerability in Stefano Lissa & The Newsletter Team Newsletter allows Functionality Bypass.This issue affects Newsletter: from n/a through 8.2.0.

50. 3.7CVE-2024-30480EPSS 0.5%2024-05-17

    Authentication Bypass by Spoofing vulnerability in Pippin Williamson CGC Maintenance Mode allows Functionality Bypass.This issue affects CGC Maintenance Mode: from n/a through 1.2.