CVE-2022-2310

CRITICAL Year: 2022
CVSS v3 Score
9.8
Critical
Weakness Type
CWE-290
View all →

Vulnerability Description

An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User Interface. This is possible because of SWG incorrectly whitelisting authentication bypass methods and using a weak crypto password. This can lead to the attacker logging into the SWG admin interface, without valid credentials, as the super user with complete control over the SWG.

Related Vulnerabilities

CVE-2009-1048

CRITICAL
CVSS:9.8(Critical)

The web interface on the snom VoIP phones snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 6.5 before 6.5.20, 7.1 before 7.1.39, and 7.3 before 7.3.14 allows remote attackers to bypa...

CWE-2902009

CVE-2017-14003

CRITICAL
CVSS:9.8(Critical)

An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01.00/29.03.2007 and prior versions. An improper authentication vulnerability has ...

CWE-2902017

CVE-2017-14375

CRITICAL
CVSS:9.8(Critical)

EMC Unisphere for VMAX Virtual Appliance (vApp) versions prior to 8.4.0.15, EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.15, EMC VASA Virtual Appliance versions prior to 8.4.0.512, ...

CWE-2902017

CVE-2018-15715

CRITICAL
CVSS:9.8(Critical)

Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are vulnerable to unauthorized message processing. A remote unaut...

CWE-2902018

CVE-2018-5353

CRITICAL
CVSS:9.8(Critical)

The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the inten...

CWE-2902018

CVE-2018-7842

CRITICAL
CVSS:9.8(Critical)

A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an elevation of privilege by...

CWE-2902018