CWE-290 Authentication Bypass by Spoofing
baseThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (897)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-102764US | critical9.8OT kritisch | KEV | ||
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Unde… | ||||
| CVE-2026-104935US | —OT kritisch | KEV | ||
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14… | ||||
| CVE-2024-54085US | critical9.8OT kritisch | KEV | ||
AMI’s SPx contains
a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation
of this vulnerabili… | ||||
| CVE-2024-4358US | critical9.8OT kritisch | KEV | ||
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality v… | ||||
| CVE-2023-50224US | —OT kritisch | KEV | ||
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information o… | ||||
| CVE-2022-26925US | medium5.9OT kritisch | KEV | ||
Windows LSA Spoofing Vulnerability | ||||
| CVE-2022-24112US | critical9.8OT kritisch | KEV | ||
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulne… | ||||
| CVE-2022-23131US | critical9.8OT kritisch | KEV | ||
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session w… | ||||
| CVE-2021-43890US | high7.1OT kritisch | KEV | ||
We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability… | ||||
| CVE-2021-29441US | critical9.8OT hoch | Exploit | ||
Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.c… | ||||
| CVE-2020-7388US | critical9.8 | Exploit | ||
Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can bypass credential vali… | ||||
| CVE-2021-34646US | critical9.8OT hoch | Exploit | ||
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a r… | ||||
| CVE-2025-49002US | critical9.8 | Exploit | ||
DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to… | ||||
| CVE-2021-29442US | high7.5OT hoch | Exploit | ||
Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform ma… | ||||
| CVE-2018-7842US | critical9.8 | Exploit | ||
A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an eleva… | ||||
| CVE-2019-1234US | high7.5 | — | ||
A spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure Stack Spoofing Vulnerability'. | ||||
| CVE-2021-31195US | medium6.8 | — | ||
Microsoft Exchange Server Remote Code Execution Vulnerability | ||||
| CVE-2018-5353US | critical9.8 | Exploit | ||
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not au… | ||||
| CVE-2026-49468US | critical9.8 | Exploit | ||
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditi… | ||||
| CVE-2026-25938US | critical9.8OT hoch | Exploit | ||
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remot… | ||||
04
Angriffsmuster (10)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan