CWE-290: Authentication Bypass by Spoofing, page 13

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

What the weakness is: CWE-290 at MITRE

1. 5.9CVE-2023-3103EPSS 0.6%2023-11-22

   Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera video stream. In addition, if a MITM attack is carried out, it is possible to co…

2. 9.1CVE-2023-5801EPSS 0.4%2023-11-08

   Vulnerability of identity verification being bypassed in the face unlock module. Successful exploitation of this vulnerability will affect integrity and confidentiality.

3. 5.4CVE-2023-36769EPSS 0.5%2023-11-06

   Microsoft OneNote Spoofing Vulnerability

4. 5.3CVE-2023-20246EPSS 0.7%2023-11-01

   Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a logic…

5. 5.8CVE-2023-20256EPSS 0.6%2023-11-01

   Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access c…

6. 5.8CVE-2023-20245EPSS 0.6%2023-11-01

   Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access c…

7. 6.5CVE-2023-28803EPSS 0.3%2023-10-23

   An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass. This issue affects Client Connector: before 3.9.

8. 9.8CVE-2023-30803EPSS 21%2023-10-10

   The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can bypass authentication and access administrative functionality by sending HTTP r…

9. 5.3CVE-2023-44463EPSS 0.6%2023-10-02

   An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoo…

10. 6.6CVE-2023-41329EPSS 0.6%2023-09-06

    WireMock is a tool for mocking HTTP services. The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. These restrictions …

11. 9.8CVE-2023-4178EPSS 0.8%2023-09-05

    Authentication Bypass by Spoofing vulnerability in Neutron Neutron Smart VMS allows Authentication Bypass. This issue affects Neutron Smart VMS: before b1130.1.0.1.

12. 9.8CVE-2023-31424EPSS 0.9%2023-08-31

    Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization.

13. 5.9CVE-2023-30950EPSS 0.4%2023-08-03

    The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint

14. 4.3CVE-2023-38173EPSS 0.6%2023-07-21

    Microsoft Edge for Android Spoofing Vulnerability

15. 4.7CVE-2023-35392EPSS 0.8%2023-07-21

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

16. 8.0CVE-2023-34329EPSS 1.2%2023-07-18

    AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vulnerability may lead to loss of confidentiality, integrity, and availability.

17. 4.3CVE-2023-36883EPSS 0.6%2023-07-14

    Microsoft Edge for iOS Spoofing Vulnerability

18. 9.8CVE-2022-48513EPSS 0.5%2023-07-06

    Vulnerability of identity verification being bypassed in the Gallery module. Successful exploitation of this vulnerability may cause out-of-bounds access.

19. 6.7CVE-2023-27199EPSS 0.2%2023-07-05

    PAX Technology A930 PayDroid_7.1.1_Virgo_V04.5.02_20220722 allows attackers to compile a malicious shared library and use LD_PRELOAD to bypass authorization checks.

20. 9.8CVE-2023-22814EPSS 0.7%2023-07-01

    An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack. This issue affects My Cloud OS 5 devices: before 5.26.202.

21. 5.5CVE-2023-29147EPSS 0.3%2023-06-30

    In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when a file is replaced, and because two files on different filesystems can have the …

22. 9.8CVE-2023-3243EPSS 0.6%Unsupported when assigned2023-06-28

    [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Re…

23. 9.8CVE-2021-25827EPSS 1.5%2023-06-28

    Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.

24. 5.4CVE-2023-27964EPSS 8.2%2023-06-23

    An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 5E133. When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Blue…

25. 9.8CVE-2023-3128EPSS 4.0%2023-06-22

    Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured…

26. 5.3CVE-2023-34167EPSS 0.3%2023-06-19

    Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.

27. 5.3CVE-2023-34160EPSS 0.3%2023-06-19

    Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.

28. 5.3CVE-2023-34158EPSS 0.3%2023-06-19

    Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.

29. 6.5CVE-2022-48469EPSS 0.3%2023-06-16

    There is a traffic hijacking vulnerability in Huawei routers. Successful exploitation of this vulnerability can cause packets to be hijacked by attackers.

30. 6.5CVE-2023-34157EPSS 0.4%2023-06-16

    Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app.

31. 6.5CVE-2023-33140EPSS 1.6%2023-06-14

    Microsoft OneNote Spoofing Vulnerability

32. 9.8CVE-2023-2807EPSS 0.6%2023-06-13

    Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication. This issue affects Pan…

33. 7.5CVE-2022-36331EPSS 0.6%2023-06-12

    Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data. This issue affects My Cloud OS 5 devic…

34. 4.3CVE-2023-2001EPSS 0.6%2023-06-07

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could p…

35. 8.8CVE-2023-32207EPSS 0.7%2023-06-02

    A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

36. 7.5CVE-2023-25743EPSS 0.6%2023-06-02

    A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only affects Firefox Focus. Other versions of Firefox are unaffected.*. This vulnerability affects Fire…

37. 9.8CVE-2023-2887EPSS 0.8%2023-05-25

    Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

38. 4.3CVE-2023-29334EPSS 1.1%2023-04-28

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

39. 7.5CVE-2022-47522EPSS 0.9%2023-04-15

    The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sendi…

40. 6.1CVE-2023-24935EPSS 1.0%2023-04-11

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

41. 9.1CVE-2022-48349EPSS 0.5%2023-03-27

    The control component has a spoofing vulnerability. Successful exploitation of this vulnerability may affect confidentiality and availability.

42. 6.5CVE-2023-0816EPSS 0.5%2023-03-27

    The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.

43. 8.2CVE-2023-24892ExploitEPSS 3.5%2023-03-14

    Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability

44. 7.1CVE-2023-23398EPSS 0.6%2023-03-14

    Microsoft Excel Spoofing Vulnerability

45. 7.5CVE-2022-4550EPSS 0.7%2023-02-27

    The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing

46. 4.3CVE-2023-21794EPSS 0.7%2023-02-14

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

47. 8.8CVE-2022-47648EPSS 0.4%2023-02-08

    An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authentication due to the IP based authorization. If an authorized user has accessed a publi…

48. 8.1CVE-2023-22474EPSS 0.7%2023-02-03

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn't run behind a proxy s…

49. 8.1CVE-2022-40269EPSS 0.7%2023-02-02

    Authentication Bypass by Spoofing vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000, Mitsubishi Electric Corporation GOT2000 Series GT25 model versions 01.14.000 to 01.47.000 and Mit…

50. 8.1CVE-2022-32747EPSS 0.3%2023-01-30

    A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local network. Affected Products: EcoStruxu…