Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

CVEs (690)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-48513 1Huawei 2Emui Harmonyos Jun 17, 2026 Jul 6, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Vulnerability of identity verification being bypassed in the Gallery module. Successful exploitation of this vulnerability may cause out-of-bounds access.
CVE-2023-27199 1Paxtechnology 1Pax A930 Firmware Jun 17, 2026 Jul 5, 2023 N/A· v4 6.7 MEDIUM· v3 N/A· v2 PAX Technology A930 PayDroid_7.1.1_Virgo_V04.5.02_20220722 allows attackers to compile a malicious shared library and use LD_PRELOAD to bypass authorization checks.
CVE-2023-22814 1Westerndigital 1My Cloud Os Jun 17, 2026 Jul 1, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack. This issue affects My Cloud OS 5 devices: before...Show more An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack. This issue affects My Cloud OS 5 devices: before 5.26.202. Show less
CVE-2023-29147 1Malwarebytes 2Endpoint Detection And Response Malwarebytes Jun 17, 2026 Jun 30, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when a file is replaced, and because two files on different filesy...Show more In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when a file is replaced, and because two files on different filesystems can have the same identifier.Show less
CVE-2023-3243 1Honeywell 1Alerton Bcm Web Firmware Jun 17, 2026 Jun 28, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 UNSUPPORTED WHEN ASSIGNED [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password a...Show more UNSUPPORTED WHEN ASSIGNED [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Recommended fix: Upgrade to a supported product such as Alerton ACM.] Out of an abundance of caution, this CVE ID is being assigned to better serve our customers and ensure all who are still running this product understand that the product is end of life and should be removed or upgraded. Show less
CVE-2021-25827 1Emby 1Emby Jun 17, 2026 Jun 28, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.
CVE-2023-27964 1Apple 1Airpods Firmware Jun 17, 2026 Jun 23, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 5E133. When your headphones are seeking a connection request to one of your previously paired devices,...Show more An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 5E133. When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source device and gain access to your headphones.Show less
CVE-2023-3128 1Grafana 1Grafana Jun 17, 2026 Jun 22, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD...Show more Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.Show less
CVE-2023-34167 1Huawei 1Emui Jun 17, 2026 Jun 19, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
CVE-2023-34160 1Huawei 1Emui Jun 17, 2026 Jun 19, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
CVE-2023-34158 1Huawei 1Emui Jun 17, 2026 Jun 19, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-party apps to hide app icons on the desktop to prevent them from being uninstalled.
CVE-2022-48469 1Huawei 1B535 232a Firmware Jun 17, 2026 Jun 16, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 There is a traffic hijacking vulnerability in Huawei routers. Successful exploitation of this vulnerability can cause packets to be hijacked by attackers.
CVE-2023-34157 1Huawei 1Harmonyos Jun 17, 2026 Jun 16, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app.
CVE-2023-33140 1Microsoft 1Onenote Jun 17, 2026 Jun 14, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Microsoft OneNote Spoofing Vulnerability
CVE-2023-2807 1Pandorafms 1Pandora Fms Jun 17, 2026 Jun 13, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication. Thi...Show more Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication. This issue affects PandoraFMS v771 and prior versions on all platforms.Show less
CVE-2022-36331 1Westerndigital 12My Cloud Dl2100 Firmware My Cloud Dl4100 FirmwareMy Cloud Ex2100 Firmware+9 more Jun 17, 2026 Jun 12, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data. This issue affects...Show more Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could allow an unauthenticated attacker to gain access to user data. This issue affects My Cloud OS 5 devices: before 5.25.132; My Cloud Home and My Cloud Home Duo: before 8.13.1-102; SanDisk ibi: before 8.13.1-102. Show less
CVE-2023-2001 1Gitlab 1Gitlab Jun 17, 2026 Jun 7, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected...Show more An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code.Show less
CVE-2023-32207 1Mozilla 3Firefox Firefox EsrThunderbird Jun 17, 2026 Jun 2, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
CVE-2023-25743 1Mozilla 1Firefox Focus Jun 17, 2026 Jun 2, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>This bug only affects Firefox Focus. Other versions of Firefox are unaffected.. This vulnera...Show more A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>This bug only affects Firefox Focus. Other versions of Firefox are unaffected.. This vulnerability affects Firefox < 110 and Firefox ESR < 102.8.Show less
CVE-2023-2887 1Cbot 2Cbot Core Cbot Panel Jun 17, 2026 May 25, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

Previous 1...242526...35 Next