CWE-287 · Improper Authentication (page 11)
Page 11 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2344 | Medium | 5.3 | 2025-03-16 | A vulnerability, which was classified as critical, has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this issue is some unknown f… |
CVE-2025-2339 | Medium | 5.3 | 2025-03-16 | A vulnerability was found in otale Tale Blog 2.0.5. It has been classified as problematic. This affects an unknown part of the file /%61dmin/api/logs. The mani… |
CVE-2025-2230 | High | 7.7 | 2025-03-13 | A flaw exists in the Windows login flow where an AuthContext token can be exploited for replay attacks and authentication bypass. |
CVE-2025-29773 | Medium | 5.8 | 2025-03-13 | Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accou… |
CVE-2025-27138 | Critical | 9.8 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease… |
CVE-2025-0813 | Medium | 6.8 | 2025-03-12 | CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permission rights has physica… |
CVE-2025-27403 | | 2025-03-11 | Ratify is a verification engine as a binary executable and on Kubernetes which enables verification of artifact security metadata and admits for deployment onl… | |
CVE-2024-56336 | Critical | 9.8 | 2025-03-11 | A vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FS number is 02). The… |
CVE-2024-11087 | High | 8.1 | 2025-03-08 | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all vers… |
CVE-2025-1475 | Critical | 9.8 | 2025-03-07 | The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verificat… |
CVE-2025-25452 | Medium | 5.1 | 2025-03-06 | An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the "/user" endpoint |
CVE-2025-25451 | Medium | 5.1 | 2025-03-06 | An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a physically proximate attacker to escalate privileges via the "2fa_authorized" Local Stor… |
CVE-2025-25450 | Medium | 5.1 | 2025-03-06 | An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the deactivation of the activated second fact… |
CVE-2025-27672 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows OAUTH Security Bypass OVE-20230524-0016. |
CVE-2025-27641 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.951 Application 20.0.2368 allows Unauthenticated APIs for Single-Sign On V-2024-009. |
CVE-2025-27425 | Medium | 4.3 | 2025-03-04 | Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first. T… |
CVE-2025-1880 | Low | 2.0 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been classified as problematic. Affected is an unknown function of the component Device… |
CVE-2025-27422 | High | 7.5 | 2025-03-03 | FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges… |
CVE-2024-38426 | Medium | 5.4 | 2025-03-03 | While processing the authentication message in UE, improper authentication may lead to information disclosure. |
CVE-2025-1723 | High | 8.1 | 2025-03-03 | Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in th… |
CVE-2025-23116 | Critical | 9.6 | 2025-03-01 | An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor with access to UniFi P… |
CVE-2025-27416 | | 2025-03-01 | Scratch-Coding-Hut.github.io is the website for Coding Hut. The website as of 28 February 2025 contained a sign in with scratch username and password form. Any… | |
CVE-2025-27414 | | 2025-02-28 | MinIO is a high performance object storage. Starting in RELEASE.2024-06-06T09-36-42Z and prior to RELEASE.2025-02-28T09-55-16Z, a bug in evaluating the trust… | |
CVE-2025-26326 | High | 8.8 | 2025-02-28 | A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which allows an attacker t… |
CVE-2025-27112 | Medium | 6.5 | 2025-02-24 | Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API end… |
CVE-2024-5174 | | 2025-02-24 | A flaw in Gliffy results in broken authentication through the reset functionality of the application. | |
CVE-2025-1024 | Medium | 4.8 | 2025-02-19 | A vulnerability exists in ChurchCRM 5.13.0 that allows an attacker to execute arbitrary JavaScript in a victim's browser via Reflected Cross-Site Scripting (XS… |
CVE-2025-24895 | Critical | 9.1 | 2025-02-18 | CIE.AspNetCore.Authentication is an AspNetCore Remote Authenticator for CIE 3.0. Authentication using Spid and CIE is based on the SAML2 standard which provide… |
CVE-2025-24894 | Critical | 9.1 | 2025-02-18 | SPID.AspNetCore.Authentication is an AspNetCore Remote Authenticator for SPID. Authentication using Spid and CIE is based on the SAML2 standard which provides… |
CVE-2024-57046 | High | 8.8 | 2025-02-18 | A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When a… |
CVE-2024-57045 | Critical | 9.8 | 2025-02-18 | A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. An attack… |
CVE-2025-0981 | Medium | 6.1 | 2025-02-18 | A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting (XSS) vulne… |
CVE-2025-24904 | High | 8.5 | 2025-02-13 | libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior… |
CVE-2025-25205 | High | 8.2 | 2025-02-12 | Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic… |
CVE-2025-25201 | Medium | 4.0 | 2025-02-12 | Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For release 1.8.0, and test releases with PIV enabled prior to 1.8.0, the PIV application could… |
CVE-2024-13528 | High | 7.5 | 2025-02-12 | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.9.5. This i… |
CVE-2025-1044 | Critical | 9.8 | 2025-02-11 | Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installati… |
CVE-2025-21349 | Medium | 6.8 | 2025-02-11 | Windows Remote Desktop Configuration Service Tampering Vulnerability |
CVE-2024-52968 | Medium | 6.7 | 2025-02-11 | An improper authentication in Fortinet FortiClientMac 7.0.11 through 7.2.4 allows attacker to gain improper access to MacOS via empty password. |
CVE-2025-1231 | Medium | 5.4 | 2025-02-11 | Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-… |
CVE-2024-46434 | High | 8.8 | 2025-02-10 | Tenda W18E V16.01.0.8(1625) suffers from authentication bypass in the web management portal allowing an unauthorized remote attacker to gain administrative acc… |
CVE-2025-24032 | | 2025-02-10 | PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if cert_policy is set to none (the default v… | |
CVE-2025-1104 | High | 7.3 | 2025-02-07 | A vulnerability has been found in D-Link DHP-W310AV 1.04 and classified as critical. This vulnerability affects unknown code. The manipulation leads to authent… |
CVE-2024-48445 | Critical | 9.8 | 2025-02-04 | An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters. |
CVE-2025-0890 | Critical | 9.8 | 2025-02-04 | **UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_201… |
CVE-2024-27137 | Medium | 5.3 | 2025-02-04 | In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry… |
CVE-2024-12510 | Medium | 6.7 | 2025-02-03 | If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active… |
CVE-2024-57432 | High | 7.5 | 2025-01-31 | macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitl… |
CVE-2025-0637 | Critical | 9.8 | 2025-01-23 | It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow… |
CVE-2025-0604 | Medium | 5.4 | 2025-01-22 | A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new cr… |
CVE-2024-55954 | High | 8.7 | 2025-01-16 | OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint `/api/{org_id}/users/{email_id}` allows an "Admin" role u… |
CVE-2024-36402 | Medium | 5.3 | 2025-01-16 | Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remo… |
CVE-2025-22146 | Critical | 9.1 | 2025-01-15 | Sentry is a developer-first error tracking and performance monitoring tool. A critical vulnerability was discovered in the SAML SSO implementation of Sentry. I… |
CVE-2024-11322 | High | 7.5 | 2025-01-15 | A denial-of-service vulnerability exists in CyberPower PowerPanel Business (PPB) 4.11.0. An unauthenticated remote attacker can restart the ppbd.exe process v… |
CVE-2024-12919 | Critical | 9.8 | 2025-01-14 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypas… |
CVE-2025-0070 | Critical | 9.9 | 2025-01-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper… |
CVE-2024-42172 | Medium | 5.3 | 2025-01-11 | HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity th… |
CVE-2024-9133 | Medium | 6.6 | 2025-01-10 | A user with administrator privileges is able to retrieve authentication tokens |
CVE-2024-13309 | Medium | 5.4 | 2025-01-09 | Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login… |
CVE-2024-53704 | Critical | 9.8 | 2025-01-09 | An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. |
CVE-2024-56445 | Medium | 4.3 | 2025-01-08 | Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulnerability may cause features to perform a… |
CVE-2023-52955 | Medium | 6.5 | 2025-01-08 | Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulnerability may cause features to perform a… |
CVE-2024-12264 | Critical | 9.8 | 2025-01-07 | The PayU CommercePro Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.8.3. This is due to /wp-json/pay… |
CVE-2025-21618 | High | 7.5 | 2025-01-06 | NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in in… |
CVE-2024-13111 | Medium | 5.6 | 2025-01-02 | A vulnerability classified as critical was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected by this vulnerability… |
CVE-2024-1609 | | 2024-12-25 | In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation. | |
CVE-2023-31279 | High | 8.1 | 2024-12-21 | The AirVantage platform is vulnerable to an unauthorized attacker registering previously unregistered devices on the AirVantage platform when the owner has no… |
CVE-2024-56335 | High | 7.6 | 2024-12-20 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker is capable of updati… |
CVE-2024-56329 | | 2024-12-20 | Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by Laravel Jetstream, wi… | |
CVE-2020-9250 | Low | 3.3 | 2024-12-20 | There is an insufficient authentication vulnerability in some Huawei smart phone. An unauthenticated, local attacker can crafts software package to exploit thi… |
CVE-2024-1610 | Critical | 9.8 | 2024-12-18 | In OPPO Store APP, there's a possible escalation of privilege due to improper input validation. |
CVE-2024-12287 | Critical | 9.8 | 2024-12-18 | The Biagiotti Membership plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.0.2. This is due to the plugin not… |
CVE-2024-21543 | High | 7.1 | 2024-12-13 | Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls ba… |
CVE-2024-55886 | Medium | 6.9 | 2024-12-12 | OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists… |
CVE-2024-11015 | Critical | 9.8 | 2024-12-12 | The Sign In With Google plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.8.0. This is due to the 'authentica… |
CVE-2024-10111 | High | 8.1 | 2024-12-12 | The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.26.3. This is… |
CVE-2024-50339 | Medium | 5.3 | 2024-12-12 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the s… |
CVE-2024-49076 | High | 7.8 | 2024-12-12 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability |
CVE-2024-45404 | High | 8.1 | 2024-12-12 | OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attack… |
CVE-2024-47761 | High | 7.2 | 2024-12-11 | GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifi… |
CVE-2024-10511 | Medium | 5.3 | 2024-12-11 | CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local network repeatedly reque… |
CVE-2024-0130 | High | 8.8 | 2024-12-06 | NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malform… |
CVE-2024-48859 | Critical | 9.1 | 2024-12-06 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote… |
CVE-2024-11293 | High | 8.1 | 2024-12-04 | The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login… |
CVE-2024-45106 | High | 8.1 | 2024-12-03 | Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secr… |
CVE-2024-53990 | | 2024-12-02 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP requ… | |
CVE-2018-11952 | High | 8.4 | 2024-11-26 | An image with a version lower than the fuse version may potentially be booted lead to improper authentication. |
CVE-2016-10394 | High | 8.4 | 2024-11-26 | Initial xbl_sec revision does not have all the debug policy features and critical checks. |
CVE-2024-11671 | Medium | 5.4 | 2024-11-25 | Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user t… |
CVE-2022-33862 | Medium | 6.7 | 2024-11-25 | IPP software prior to v1.71 is vulnerable to default credential vulnerability. This could lead attackers to identify and access vulnerable systems. |
CVE-2024-45369 | High | 8.1 | 2024-11-22 | The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource. |
CVE-2024-6248 | High | 7.5 | 2024-11-22 | Wyze Cam v3 Cloud Infrastructure Improper Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute a… |
CVE-2024-11494 | High | 7.5 | 2024-11-20 | **UNSUPPORTED WHEN ASSIGNED** The improper authentication vulnerability in the Zyxel P-6101C ADSL modem firmware version P-6101CSA6AP_20140331 could allow an u… |
CVE-2024-47533 | Critical | 9.8 | 2024-11-18 | Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in… |
CVE-2024-52518 | Medium | 4.4 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to… |
CVE-2024-11209 | Medium | 6.3 | 2024-11-14 | A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA… |
CVE-2024-51996 | High | 7.5 | 2024-11-13 | Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony do… |
CVE-2024-49039 | High | 8.8 | 2024-11-12 | Windows Task Scheduler Elevation of Privilege Vulnerability |
CVE-2024-51997 | High | 8.1 | 2024-11-08 | Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART (**Attestation Results Token**) token, genera… |
CVE-2024-10963 | High | 7.4 | 2024-11-07 | A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick… |