CWE-287 · Improper Authentication (page 12)
Page 12 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10963 | High | 7.4 | 2024-11-07 | A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick… |
CVE-2024-50341 | Low | 3.1 | 2024-11-06 | symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack fra… |
CVE-2024-9946 | High | 8.1 | 2024-11-06 | The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to… |
CVE-2024-10020 | High | 8.1 | 2024-11-06 | The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. This is due to ins… |
CVE-2023-29117 | High | 8.8 | 2024-11-05 | Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system. |
CVE-2024-10114 | High | 8.1 | 2024-11-05 | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.7.7. This is due to insuffic… |
CVE-2024-10097 | High | 8.1 | 2024-11-05 | The Loginizer Security and Loginizer plugins for WordPress are vulnerable to authentication bypass in all versions up to, and including, 1.9.2. This is due to… |
CVE-2024-10620 | Medium | 5.3 | 2024-11-01 | A vulnerability was found in knightliao Disconf 2.6.36. It has been classified as critical. This affects an unknown part of the file /api/config/list of the co… |
CVE-2024-10474 | Medium | 6.5 | 2024-10-29 | Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL sa… |
CVE-2024-49755 | Low | 3.1 | 2024-10-28 | Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. IdentityServer's local API authentication handler performs insufficient va… |
CVE-2024-50478 | Critical | 9.8 | 2024-10-28 | Authentication Bypass by Primary Weakness vulnerability in Swoop 1-Click Login: Passwordless Authentication allows Authentication Bypass.This issue affects 1-C… |
CVE-2024-49757 | High | 7.5 | 2024-10-25 | The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versio… |
CVE-2024-49376 | High | 8.8 | 2024-10-25 | Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email… |
CVE-2024-7763 | Critical | 9.8 | 2024-10-24 | In WhatsUp Gold versions released before 2024.0.0, an Authentication Bypass issue exists which allows an attacker to obtain encrypted user credentials. |
CVE-2024-10327 | High | 8.1 | 2024-10-24 | A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension f… |
CVE-2024-9947 | High | 8.1 | 2024-10-23 | The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due to insufficient veri… |
CVE-2024-9927 | High | 7.2 | 2024-10-23 | The WooCommerce Order Proposal plugin for WordPress is vulnerable to privilege escalation via order proposal in all versions up to and including 2.0.5. This is… |
CVE-2024-10173 | High | 7.3 | 2024-10-20 | A vulnerability has been found in didi DDMQ 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Console… |
CVE-2024-9683 | Medium | 4.8 | 2024-10-17 | A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided. This flaw affects the authenticat… |
CVE-2023-22650 | High | 8.8 | 2024-10-16 | A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider… |
CVE-2024-45216 | Critical | 9.8 | 2024-10-16 | Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication i… |
CVE-2020-36832 | Critical | 9.8 | 2024-10-16 | The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and including, 7.3 to 8.6. This makes it possible… |
CVE-2024-38139 | High | 8.7 | 2024-10-15 | Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. |
CVE-2024-47080 | | 2024-10-15 | matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method `MatrixClient… | |
CVE-2024-45148 | High | 8.8 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a sec… |
CVE-2024-45115 | Critical | 9.8 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in privi… |
CVE-2024-38124 | Critical | 9.0 | 2024-10-08 | Windows Netlogon Elevation of Privilege Vulnerability |
CVE-2024-41798 | Critical | 9.8 | 2024-10-08 | A vulnerability has been identified in SENTRON 7KM PAC3200 (All versions). Affected devices only provide a 4-digit PIN to protect from administrative access vi… |
CVE-2024-45051 | High | 8.2 | 2024-10-07 | Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions… |
CVE-2024-47768 | High | 8.1 | 2024-10-04 | Lif Authentication Server is a server used by Lif to do various tasks regarding Lif accounts. This vulnerability has to do with the account recovery system whe… |
CVE-2024-41589 | High | 8.8 | 2024-10-03 | DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests. |
CVE-2024-47807 | High | 8.1 | 2024-10-02 | Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to sub… |
CVE-2024-47806 | High | 8.1 | 2024-10-02 | Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to s… |
CVE-2024-47070 | Critical | 9.0 | 2024-09-27 | authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding… |
CVE-2024-47174 | Medium | 5.9 | 2024-09-26 | Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, `<nix/fetchurl.nix>` did not verif… |
CVE-2024-47127 | Medium | 6.5 | 2024-09-26 | In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio… |
CVE-2024-47125 | High | 8.1 | 2024-09-26 | The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages. It is advised to update your app to th… |
CVE-2024-45042 | Medium | 4.4 | 2024-09-26 | Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the `highest_… |
CVE-2024-45750 | High | 7.3 | 2024-09-25 | An issue in TheGreenBow Windows Standard VPN Client 6.87.108 (and older), Windows Enterprise VPN Client 6.87.109 (and older), Windows Enterprise VPN Client 7.5… |
CVE-2024-47078 | High | 8.1 | 2024-09-25 | Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a shared or private MQT… |
CVE-2024-0002 | Critical | 10.0 | 2024-09-23 | A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array. |
CVE-2024-47218 | Critical | 9.8 | 2024-09-22 | An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows bypassing authentication. |
CVE-2022-25768 | High | 7.0 | 2024-09-18 | The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to t… |
CVE-2024-34399 | Critical | 9.8 | 2024-09-18 | **UNSUPPORTED WHEN ASSIGNED** An issue was discovered in BMC Remedy Mid Tier 7.6.04. An unauthenticated remote attacker is able to access any user account with… |
CVE-2024-41929 | High | 8.8 | 2024-09-18 | Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to… |
CVE-2024-8956 | Critical | 9.1 | 2024-09-17 | PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to… |
CVE-2024-44202 | Medium | 5.3 | 2024-09-17 | An authentication issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18. Private Browsing tabs may be acce… |
CVE-2024-44127 | Medium | 5.3 | 2024-09-17 | This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18. Private Browsing tabs may be… |
CVE-2024-45113 | High | 7.5 | 2024-09-13 | ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker… |
CVE-2024-45823 | High | 8.1 | 2024-09-12 | CVE-2024-45823 IMPACT An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts… |
CVE-2024-8642 | High | 8.1 | 2024-09-11 | In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token val… |
CVE-2024-38225 | High | 8.8 | 2024-09-10 | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability |
CVE-2023-37226 | Critical | 9.8 | 2024-09-10 | Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function. |
CVE-2024-40713 | High | 7.8 | 2024-09-07 | A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) set… |
CVE-2023-45038 | Medium | 4.3 | 2024-09-06 | An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the securit… |
CVE-2024-5957 | Medium | 6.3 | 2024-09-05 | This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager. |
CVE-2024-5956 | Medium | 6.5 | 2024-09-05 | This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix IPS Manager with gar… |
CVE-2024-44821 | Medium | 5.3 | 2024-09-04 | ZZCMS 2023 contains a vulnerability in the captcha reuse logic located in /inc/function.php. The checkyzm function does not properly refresh the captcha value… |
CVE-2024-7923 | Critical | 9.8 | 2024-09-04 | An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configura… |
CVE-2024-7012 | Critical | 9.8 | 2024-09-04 | An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This… |
CVE-2024-7870 | Medium | 6.5 | 2024-09-04 | The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in al… |
CVE-2024-7346 | High | 7.2 | 2024-09-03 | Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked co… |
CVE-2024-7745 | Medium | 6.5 | 2024-08-28 | In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the s… |
CVE-2024-45346 | High | 8.8 | 2024-08-28 | The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same t… |
CVE-2024-8181 | Critical | 9.8 | 2024-08-27 | An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an admin… |
CVE-2024-45036 | Medium | 4.3 | 2024-08-26 | Tophat is a mobile applications testing harness. An Improper Access Control vulnerability can expose the `TOPHAT_APP_TOKEN` token stored in `~/.tophatrc` throu… |
CVE-2024-7401 | High | 7.5 | 2024-08-26 | Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. S… |
CVE-2024-36444 | High | 8.1 | 2024-08-22 | cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an unauthenticated attacker to gain access to device logs. |
CVE-2024-43409 | Medium | 6.5 | 2024-08-20 | Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only… |
CVE-2024-42336 | High | 8.2 | 2024-08-20 | Servision - CWE-287: Improper Authentication |
CVE-2024-38810 | Medium | 6.5 | 2024-08-20 | Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective. |
CVE-2024-43240 | Critical | 9.4 | 2024-08-19 | Improper Authentication vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a through <=… |
CVE-2024-42462 | Critical | 9.8 | 2024-08-16 | Improper Authentication vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Bypass.This issue affects upKeeper Manager: through… |
CVE-2024-31800 | Medium | 6.8 | 2024-08-15 | Authentication Bypass in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to gain a privileged command shell via the UART Debugg… |
CVE-2024-6078 | | 2024-08-14 | CVE-2024-6078 IMPACT An improper authentication vulnerability exists in the affected product, which could allow a malicious user to generate cookies for any u… | |
CVE-2024-37028 | Medium | 5.3 | 2024-08-14 | BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Tech… |
CVE-2024-25157 | Medium | 6.5 | 2024-08-14 | An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission check… |
CVE-2024-7593 | Critical | 9.8 | 2024-08-13 | Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass a… |
CVE-2024-7746 | Critical | 9.8 | 2024-08-13 | Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the… |
CVE-2024-35775 | Medium | 5.9 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Authentication vulnerability in Soliloquy Team Slider by… |
CVE-2024-42164 | Medium | 4.3 | 2024-08-12 | Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by pr… |
CVE-2024-4784 | Medium | 4.2 | 2024-08-08 | An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the pas… |
CVE-2024-42038 | High | 8.8 | 2024-08-08 | Vulnerability of PIN enhancement failures in the screen lock module Impact: Successful exploitation of this vulnerability may affect service confidentiality, i… |
CVE-2024-36132 | High | 7.5 | 2024-08-07 | Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources. |
CVE-2024-36130 | Critical | 9.8 | 2024-08-07 | An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary… |
CVE-2024-34788 | Medium | 6.5 | 2024-08-07 | An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive information |
CVE-2024-7395 | | 2024-08-05 | An authentication bypass vulnerability in Korenix JetPort 5601v3 allows an attacker to access functionality on the device without specifying a password.This is… | |
CVE-2022-4002 | High | 7.2 | 2024-07-31 | A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request. |
CVE-2022-4001 | High | 7.3 | 2024-07-31 | An authentication bypass vulnerability could allow an attacker to access API functions without authentication. |
CVE-2019-6198 | High | 7.8 | 2024-07-31 | A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges. |
CVE-2019-6197 | High | 7.8 | 2024-07-31 | A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges. |
CVE-2024-40794 | Medium | 5.3 | 2024-07-29 | This issue was addressed through improved state management. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. Private Browsing t… |
CVE-2024-40778 | Low | 3.3 | 2024-07-29 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sono… |
CVE-2024-6576 | High | 7.3 | 2024-07-29 | Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023… |
CVE-2024-7050 | | 2024-07-26 | Improper Authentication vulnerability in OpenText OpenText Directory Services may allow Multi-factor Authentication Bypass in particular scenarios.This issue a… | |
CVE-2024-41800 | Medium | 4.8 | 2024-07-25 | Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit… |
CVE-2024-41829 | Low | 3.5 | 2024-07-22 | In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection |
CVE-2024-40648 | Medium | 5.4 | 2024-07-18 | matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before… |
CVE-2024-28992 | High | 7.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-23471 | Critical | 9.6 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authentic… |