CWE-288
AllowedAuthentication Bypass Using an Alternate Path or Channel
Abstraction: Base · Status: Incomplete
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
1215 vulnerabilities reference this CWE, most recent first.
GHSA-9VQF-P3V5-QMH2
Vulnerability from github – Published: 2025-05-04 00:30 – Updated: 2025-05-04 00:30Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of service (when an attacker executes a loop calling RestartWeb) or obtaining potentially sensitive information. Exploitation can occur if Anonymous access is enabled, or if there is a successful CSRF attack.
{
"affected": [],
"aliases": [
"CVE-2025-47244"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-03T23:15:48Z",
"severity": "HIGH"
},
"details": "Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of service (when an attacker executes a loop calling RestartWeb) or obtaining potentially sensitive information. Exploitation can occur if Anonymous access is enabled, or if there is a successful CSRF attack.",
"id": "GHSA-9vqf-p3v5-qmh2",
"modified": "2025-05-04T00:30:36Z",
"published": "2025-05-04T00:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47244"
},
{
"type": "WEB",
"url": "https://docs.inedo.com/docs/proget/installation/installation-guide"
},
{
"type": "WEB",
"url": "https://forums.inedo.com"
},
{
"type": "WEB",
"url": "https://my.inedo.com/downloads/installers?product=ProGet"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2025/Apr/30"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9VR5-8J2W-55F6
Vulnerability from github – Published: 2026-02-20 18:31 – Updated: 2026-02-27 18:31Authentication Bypass Using an Alternate Path or Channel vulnerability in ahachat AhaChat Messenger Marketing ahachat-messenger-marketing allows Password Recovery Exploitation.This issue affects AhaChat Messenger Marketing: from n/a through <= 1.1.
{
"affected": [],
"aliases": [
"CVE-2025-68895"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-20T16:22:15Z",
"severity": "MODERATE"
},
"details": "Authentication Bypass Using an Alternate Path or Channel vulnerability in ahachat AhaChat Messenger Marketing ahachat-messenger-marketing allows Password Recovery Exploitation.This issue affects AhaChat Messenger Marketing: from n/a through \u003c= 1.1.",
"id": "GHSA-9vr5-8j2w-55f6",
"modified": "2026-02-27T18:31:01Z",
"published": "2026-02-20T18:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68895"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/ahachat-messenger-marketing/vulnerability/wordpress-ahachat-messenger-marketing-plugin-1-1-broken-authentication-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9W9F-6MG8-JP7W
Vulnerability from github – Published: 2022-06-03 22:17 – Updated: 2025-05-08 16:45Impact
What kind of vulnerability is it? Who is impacted?
Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. (https://github.com/blevesearch/bleve-explorer) These HTTP methods paves way for exploitation of a node’s filesystem where the bleve index resides, if the user has used bleve’s own HTTP (bleve/http) handlers for exposing the access to the indexes. For instance, the CreateIndexHandler (http/index_create.go) and DeleteIndexHandler (http/index_delete.go) enable an attacker to create a bleve index (directory structure) anywhere where the user running the server has the write permissions and to delete recursively any directory owned by the same user account.
Users who have used the bleve/http package for exposing access to bleve index without the explicit handling for the Role Based Access Controls(RBAC) of the index assets would be impacted.
Patches
Has the problem been patched? What versions should users upgrade to?
No. The http package is purely intended to be used for demonstration purposes. And bleve is never designed to be handling the RBACs or it was ever advertised to be used in that way. Hence the collaborators of this project have decided to stay away from adding any authentication or authorization to bleve project at the moment.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
The bleve/http package is mainly for demonstration purposes and it lacks exhaustive validation of the user inputs as well as any authentication and authorization measures. So it is recommended to not use that in production use cases.
For more information
If you have any questions or comments about this advisory: * Open an issue here. * Email us at [mailto:security@couchbase.com, fts-team@couchbase.com].
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/blevesearch/bleve"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.10.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/blevesearch/bleve/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31022"
],
"database_specific": {
"cwe_ids": [
"CWE-288",
"CWE-306"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-03T22:17:51Z",
"nvd_published_at": "2022-06-01T20:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nBleve includes HTTP utilities under bleve/http package, that are used by its sample application. \n(https://github.com/blevesearch/bleve-explorer)\nThese HTTP methods paves way for exploitation of a node\u2019s filesystem where the bleve index resides, \nif the user has used bleve\u2019s own HTTP (bleve/http) handlers for exposing the access to the indexes. \nFor instance, the CreateIndexHandler (http/index_create.go) and DeleteIndexHandler (http/index_delete.go) \nenable an attacker to create a bleve index (directory structure) anywhere where the user running the server \nhas the write permissions and to delete recursively any directory owned by the same user account.\n \nUsers who have used the bleve/http package for exposing access to bleve index without the explicit \nhandling for the Role Based Access Controls(RBAC) of the index assets would be impacted.\n\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n**No**. The http package is purely intended to be used for demonstration purposes. \nAnd bleve is never designed to be handling the RBACs or it was ever advertised to be used in that way. \nHence the collaborators of this project have decided to stay away from adding any authentication or \nauthorization to bleve project at the moment.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThe bleve/http package is mainly for demonstration purposes and it lacks exhaustive validation of the user \ninputs as well as any authentication and authorization measures. \nSo it is recommended to not use that in production use cases.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue [here](https://github.com/blevesearch/bleve/issues).\n* Email us at [mailto:security@couchbase.com, fts-team@couchbase.com].",
"id": "GHSA-9w9f-6mg8-jp7w",
"modified": "2025-05-08T16:45:25Z",
"published": "2022-06-03T22:17:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/blevesearch/bleve/security/advisories/GHSA-9w9f-6mg8-jp7w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31022"
},
{
"type": "WEB",
"url": "https://github.com/blevesearch/bleve/commit/1c7509d6a17d36f265c90b4e8f4e3a3182fe79ff"
},
{
"type": "WEB",
"url": "https://github.com/blevesearch/bleve/commit/af9e3111dadfedf9d30f0448506b4a57fecc8550"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0470"
},
{
"type": "PACKAGE",
"url": "github.com/blevesearch/bleve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Missing Role Based Access Control for the REST handlers in bleve/http package"
}
GHSA-9WCP-Q959-7MQ8
Vulnerability from github – Published: 2025-05-13 18:30 – Updated: 2025-10-22 00:33An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
{
"affected": [],
"aliases": [
"CVE-2025-4427"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-13T16:15:32Z",
"severity": "MODERATE"
},
"details": "An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.",
"id": "GHSA-9wcp-q959-7mq8",
"modified": "2025-10-22T00:33:18Z",
"published": "2025-05-13T18:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4427"
},
{
"type": "WEB",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4427"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9WGG-QJJM-45VR
Vulnerability from github – Published: 2022-04-12 00:00 – Updated: 2022-04-19 00:01Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting.
{
"affected": [],
"aliases": [
"CVE-2022-1067"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-11T20:15:00Z",
"severity": "MODERATE"
},
"details": "Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting.",
"id": "GHSA-9wgg-qjjm-45vr",
"modified": "2022-04-19T00:01:25Z",
"published": "2022-04-12T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1067"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsma-22-095-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9WQX-G2CW-VC7R
Vulnerability from github – Published: 2026-03-27 22:31 – Updated: 2026-04-10 17:21Summary
Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers
Affected Packages / Versions
- Package:
openclaw - Affected versions:
<= 2026.3.24 - First patched version:
2026.3.25 - Latest published npm version at verification time:
2026.3.24
Details
Matrix verification notices previously bypassed DM access checks and could reply to peers that were unpaired or otherwise outside the allowed DM policy. Commit 2383daf5c4a4e08d9553e0e949552ad755ef9ec2 gates verification notices on DM access before sending.
Verified vulnerable on tag v2026.3.24 and fixed on main by commit 2383daf5c4a4e08d9553e0e949552ad755ef9ec2.
Fix Commit(s)
2383daf5c4a4e08d9553e0e949552ad755ef9ec2
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2026.3.24"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35647"
],
"database_specific": {
"cwe_ids": [
"CWE-288",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-27T22:31:48Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nMatrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `\u003c= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nMatrix verification notices previously bypassed DM access checks and could reply to peers that were unpaired or otherwise outside the allowed DM policy. Commit `2383daf5c4a4e08d9553e0e949552ad755ef9ec2` gates verification notices on DM access before sending.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `2383daf5c4a4e08d9553e0e949552ad755ef9ec2`.\n\n## Fix Commit(s)\n\n- `2383daf5c4a4e08d9553e0e949552ad755ef9ec2`",
"id": "GHSA-9wqx-g2cw-vc7r",
"modified": "2026-04-10T17:21:40Z",
"published": "2026-03-27T22:31:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-9wqx-g2cw-vc7r"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/2383daf5c4a4e08d9553e0e949552ad755ef9ec2"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers"
}
GHSA-9X97-7GH3-F487
Vulnerability from github – Published: 2023-07-06 21:15 – Updated: 2024-04-04 05:45The iBoot device’s basic discovery protocol assists in initial device configuration. The discovery protocol shows basic information about devices on the network and allows users to perform configuration changes.
{
"affected": [],
"aliases": [
"CVE-2022-47320"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-22T23:15:09Z",
"severity": "HIGH"
},
"details": "The iBoot device\u2019s basic discovery protocol assists in initial device configuration. The discovery protocol shows basic information about devices on the network and allows users to perform configuration changes.",
"id": "GHSA-9x97-7gh3-f487",
"modified": "2024-04-04T05:45:34Z",
"published": "2023-07-06T21:15:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47320"
},
{
"type": "WEB",
"url": "https://dataprobe.com/support/iboot-pdu/local_upgrade_pdu_procedure.pdf"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-263-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C29C-M7WJ-F57R
Vulnerability from github – Published: 2026-08-18 15:31 – Updated: 2026-08-18 15:31Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.
{
"affected": [],
"aliases": [
"CVE-2026-32481"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-18T15:16:53Z",
"severity": "HIGH"
},
"details": "Unauthenticated Broken Authentication in Ezoic \u003c= 2.22.11 versions.",
"id": "GHSA-c29c-m7wj-f57r",
"modified": "2026-08-18T15:31:46Z",
"published": "2026-08-18T15:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32481"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/ezoic-integration/vulnerability/wordpress-ezoic-plugin-2-22-11-broken-authentication-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C2HR-CQG6-8J6R
Vulnerability from github – Published: 2024-07-01 18:35 – Updated: 2024-07-02 02:40Impact
This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database.
Patches
The algorithm to detect SQL injection has been improved.
Workarounds
None.
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r
- https://github.com/parse-community/parse-server/pull/9167 (fix for Parse Server 7)
- https://github.com/parse-community/parse-server/pull/9168 (fix for Parse Server 6)
Credits
- Smile Thanapattheerakul of Trend Micro (finder)
- Manuel Trezza (coordinator)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.5.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-39309"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-01T18:35:04Z",
"nvd_published_at": "2024-07-01T22:15:03Z",
"severity": "CRITICAL"
},
"details": "### Impact\n\nThis vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database.\n\n### Patches\n\nThe algorithm to detect SQL injection has been improved.\n\n### Workarounds\n\nNone.\n\n### References\n\n- https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r\n- https://github.com/parse-community/parse-server/pull/9167 (fix for Parse Server 7)\n- https://github.com/parse-community/parse-server/pull/9168 (fix for Parse Server 6)\n\n### Credits\n\n- Smile Thanapattheerakul of Trend Micro (finder)\n- Manuel Trezza (coordinator)",
"id": "GHSA-c2hr-cqg6-8j6r",
"modified": "2024-07-02T02:40:41Z",
"published": "2024-07-01T18:35:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39309"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/pull/9167"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/pull/9168"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5b"
},
{
"type": "PACKAGE",
"url": "https://github.com/parse-community/parse-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability"
}
GHSA-C379-GMCC-4R2M
Vulnerability from github – Published: 2024-11-12 12:32 – Updated: 2024-11-12 12:32The Relais 2FA plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0. This is due to incorrect authentication and capability checking in the 'rl_do_ajax' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
{
"affected": [],
"aliases": [
"CVE-2024-10245"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T10:15:04Z",
"severity": "CRITICAL"
},
"details": "The Relais 2FA plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0. This is due to incorrect authentication and capability checking in the \u0027rl_do_ajax\u0027 function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.",
"id": "GHSA-c379-gmcc-4r2m",
"modified": "2024-11-12T12:32:34Z",
"published": "2024-11-12T12:32:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10245"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/relais-2fa/trunk/relais.php?rev=2439540#L39"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d476336-e997-4379-a8f6-963ae22b2417?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
CAPEC-127: Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.