Skip to content
Noroxi

CWE-290 · 759 records

Authentication Bypass by Spoofing

CVEs in this class

759 records

  • CVE-2024-4358
    98Now

    Registration Authentication Bypass Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    telerik · report server 2024May 29, 2024

  • CVE-2022-24112
    98Now

    apisix/batch-requests plugin allows overwriting the X-REAL-IP header

    CriticalCVSS 9.8KEVWeaponizedEPSS 96%

    apache · apisixFeb 11, 2022

  • CVE-2022-23131
    98Now

    Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

    CriticalCVSS 9.8KEVWeaponizedEPSS 96%

    zabbix · zabbixJan 13, 2022

  • CVE-2024-54085
    88Now

    Redfish Authentication Bypass

    CriticalCVSS 10.0KEVWeaponizedEPSS 61%

    ami · megarac sp-xMar 11, 2025

  • CVE-2021-29441
    64This week

    Authentication bypass

    CriticalCVSS 9.8Proof of conceptEPSS 83%

    alibaba · nacosApr 27, 2021

  • CVE-2026-104935
    64This week

    Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.

    HighCVSS 8.6KEVWeaponized

    ivanti · connect secure1 day ago

  • CVE-2023-50224
    61This week

    TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability

    MediumCVSS 6.5KEVWeaponizedEPSS 17%

    tp-link · tl-wr841n firmwareMay 2, 2024

  • CVE-2020-7388
    60This week

    Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by Spoofing

    CriticalCVSS 9.8WeaponizedEPSS 69%

    sage · adxadminJul 22, 2021

  • CVE-2021-34646
    54Plan

    Booster for WooCommerce <= 5.4.3 Authentication Bypass

    CriticalCVSS 9.8Proof of conceptEPSS 51%

    booster · booster for woocommerceAug 30, 2021

  • CVE-2019-1234
    53Plan

    A spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure Stack Spoofing Vulnerability'.

    HighCVSS 7.5No exploitEPSS 75%

    microsoft · azure stackNov 12, 2019

  • CVE-2018-7842
    50Plan

    A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Mo

    CriticalCVSS 9.8Proof of conceptEPSS 35%

    schneider-electric · modicon m580 firmwareMay 22, 2019

  • CVE-2021-31195
    48Plan

    Microsoft Exchange Server Remote Code Execution Vulnerability

    MediumCVSS 6.5Proof of conceptEPSS 74%

    microsoft · exchange serverMay 11, 2021

  • CVE-2025-49002
    47Plan

    Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability

    HighCVSS 8.2Proof of conceptEPSS 50%

    dataease · dataeaseJun 3, 2025

  • CVE-2023-30803
    45Plan

    Sangfor Next-Gen Application Firewall Authentication Bypass

    CriticalCVSS 9.8No exploitEPSS 21%

    sangfor · next-gen application firewallOct 10, 2023

  • CVE-2018-5353
    42Plan

    The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    zohocorp · manageengine adselfservice plusSep 30, 2020

  • CVE-2022-3180
    42Plan

    WPGateway <= 3.5 - Unauthenticated Privilege Escalation

    CriticalCVSS 9.8No exploitEPSS 9%

    wpgateway · wpgatewayFeb 11, 2025

  • CVE-2022-34689
    41Plan

    Windows CryptoAPI Spoofing Vulnerability

    HighCVSS 7.5No exploitEPSS 38%

    microsoft · windows 10Oct 11, 2022

  • CVE-2009-1048
    41Plan

    The web interface on the snom VoIP phones snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 6.5 before 6.5.20, 7.1 before 7

    CriticalCVSS 9.8No exploitEPSS 6%

    snom · snom 300 firmwareAug 14, 2009

  • CVE-2019-16871
    41Plan

    Beckhoff Embedded Windows PLCs through 3.1.4024.0, and Beckhoff Twincat on Windows Engineering stations, allow an attacker to achieve Remote

    CriticalCVSS 9.8No exploitEPSS 5%

    beckhoff · twincatDec 19, 2019

  • CVE-2024-12108
    40Plan

    WhatsUp Gold - Public API signing key rotation issue

    CriticalCVSS 9.6No exploitEPSS 8%

    progress · whatsup goldDec 31, 2024

  • CVE-2017-14375
    40Plan

    EMC Unisphere for VMAX Virtual Appliance (vApp) versions prior to 8.4.0.15, EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.

    CriticalCVSS 9.8No exploitEPSS 5%

    emc · solutions enablerOct 31, 2017

  • CVE-2023-3128
    40Plan

    Grafana is validating Azure AD accounts based on the email claim.

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    grafana · grafanaJun 22, 2023

  • CVE-2018-15715
    40Plan

    Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are v

    CriticalCVSS 9.8No exploitEPSS 3%

    zoom · zoomNov 30, 2018

  • CVE-2020-22001
    40Plan

    HomeAutomation 3.3.2 suffers from an authentication bypass vulnerability when spoofing client IP address using the X-Forwarded-For header wi

    CriticalCVSS 9.8No exploitEPSS 3%

    homeautomation project · homeautomationApr 27, 2021

  • CVE-2019-20790
    40Plan

    OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations

    CriticalCVSS 9.8No exploitEPSS 3%

    trusteddomain · opendmarcApr 27, 2020

All vulnerability classes