Vulnerabilities (CVE)

Filtered by CWE-294
Total 175 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-38766 1 Renault 2 Zoe E-tech, Zoe E-tech Firmware 2025-04-10 N/A 8.1 HIGH
The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open request, which allows for a replay attack.
CVE-2002-0054 1 Microsoft 2 Exchange Server, Windows 2000 2025-04-03 7.5 HIGH N/A
SMTP service in (1) Microsoft Windows 2000 and (2) Internet Mail Connector (IMC) in Exchange Server 5.5 does not properly handle responses to NTLM authentication, which allows remote attackers to perform mail relaying via an SMTP AUTH command using null session credentials.
CVE-2022-43704 1 Sinilink 2 Xy-wft1, Xy-wft1 Firmware 2025-04-02 N/A 5.9 MEDIUM
The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT. It is possible to replay Sinilink aka SINILINK521 protocol (udp/1024) commands interfacing directly with the target device. This, in turn, allows for an attack to control the onboard relay without requiring authentication via the mobile application. This might result in an unacceptable temperature within the target device's physical environment.
CVE-2024-4009 1 Abb 10 2tma310010b0001, 2tma310010b0001 Firmware, 2tma310010b0003 and 7 more 2025-03-27 N/A 9.2 CRITICAL
Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-System
CVE-2024-39081 1 Jktyre 1 Smart Tyre Car \& Bike 2025-03-17 N/A 4.2 MEDIUM
An issue in SMART TYRE CAR & BIKE v4.2.0 allows attackers to perform a man-in-the-middle attack via Bluetooth communications.
CVE-2023-23397 1 Microsoft 4 365 Apps, Office, Office Long Term Servicing Channel and 1 more 2025-03-13 N/A 9.8 CRITICAL
Microsoft Outlook Elevation of Privilege Vulnerability
CVE-2025-1887 2025-03-07 N/A N/A
SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges to obtain NTLMv2-SSP Hash by changing any of the paths to a UNC path pointing to a server controlled by the attacker.
CVE-2025-26201 2025-02-24 N/A 9.1 CRITICAL
Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attackers to bypass authentication and escalate privileges.
CVE-2022-47930 1 Iofinnet 1 Tss-lib 2025-02-05 N/A 6.8 MEDIUM
An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session id, context, or random nonce in the generation of the challenge. This could allow a malicious user or an eavesdropper to replay a valid proof sent in the past.
CVE-2024-49595 1 Dell 1 Wyse Management Suite 2025-02-04 N/A 7.6 HIGH
Dell Wyse Management Suite, version WMS 4.4 and before, contain an Authentication Bypass by Capture-replay vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
CVE-2024-52534 1 Dell 1 Elastic Cloud Storage 2025-01-21 N/A 5.4 MEDIUM
Dell ECS, version(s) prior to ECS 3.8.1.3, contain(s) an Authentication Bypass by Capture-replay vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Session theft.
CVE-2023-31762 1 Mydigoo 2 Dg-hamb, Dg-hamb Firmware 2025-01-17 N/A 7.5 HIGH
Weak security in the transmitter of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to gain full access to the system via a code replay attack.
CVE-2023-31761 1 Blitzwolf 2 Bw-is22, Bw-is22 Firmware 2025-01-17 N/A 7.5 HIGH
Weak security in the transmitter of Blitzwolf BW-IS22 Smart Home Security Alarm v1.0 allows attackers to gain full access to the system via a code replay attack.
CVE-2023-31759 1 Keruistore 2 Kerui W18, Kerui W18 Firmware 2025-01-17 N/A 7.5 HIGH
Weak Security in the 433MHz keyfob of Kerui W18 Alarm System v1.0 allows attackers to gain full access via a code replay attack.
CVE-2023-31763 1 Agshome Smart Alarm Project 2 Agshome Smart Alarm, Agshome Smart Alarm Firmware 2025-01-17 N/A 7.5 HIGH
Weak security in the transmitter of AGShome Smart Alarm v1.0 allows attackers to gain full access to the system via a code replay attack.
CVE-2024-12839 2024-12-31 N/A 8.8 HIGH
The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this signature can use it to log into the system with any device.
CVE-2018-9477 1 Google 1 Android 2024-12-18 N/A 7.8 HIGH
In the development options section of the Settings app, there is a possible authentication bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2024-5249 1 Perforce 1 Akana Api 2024-11-21 N/A 5.4 MEDIUM
In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed.
CVE-2024-38438 1 Dlink 2 Dsl-225, Dsl-225 Firmware 2024-11-21 N/A 9.8 CRITICAL
D-Link - CWE-294: Authentication Bypass by Capture-replay
CVE-2024-38284 2024-11-21 N/A N/A
Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicate calls.