CWE-287 · Improper Authentication (page 13)
Page 13 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-23470 | Critical | 9.6 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to a pre-authentication remote code execution vulnerability. If exploited, this vulnerability… |
CVE-2024-23465 | High | 8.3 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user t… |
CVE-2024-6535 | Medium | 5.3 | 2024-07-17 | A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-pro… |
CVE-2024-22442 | Critical | 9.8 | 2024-07-16 | The vulnerability could be remotely exploited to bypass authentication. |
CVE-2024-39767 | Medium | 4.2 | 2024-07-15 | Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a m… |
CVE-2024-39340 | High | 8.8 | 2024-07-12 | The authentication system of Securepoint UTM mishandles OTP keys. This allows the bypassing of second-factor verification (when OTP is enabled) in both the adm… |
CVE-2024-38433 | Medium | 6.7 | 2024-07-11 | Nuvoton - CWE-305: Authentication Bypass by Primary Weakness An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton… |
CVE-2024-6397 | Critical | 9.8 | 2024-07-11 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44… |
CVE-2024-6235 | High | 8.8 | 2024-07-10 | Sensitive information disclosure in NetScaler Console |
CVE-2024-38099 | Medium | 5.9 | 2024-07-09 | Windows Remote Desktop Licensing Service Denial of Service Vulnerability |
CVE-2024-39723 | Medium | 4.6 | 2024-07-08 | IBM FlashSystem 5300 USB ports may be usable even if the port has been disabled by the administrator. A user with physical access to the system could use the U… |
CVE-2024-39830 | High | 8.1 | 2024-07-03 | Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled, fail to use constant time comparison f… |
CVE-2024-3826 | | 2024-07-02 | In versions of Akana in versions prior to and including 2022.1.3 validation is broken when using the SAML Single Sign-On (SSO) functionality. | |
CVE-2024-34596 | Medium | 5.9 | 2024-07-02 | Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the owner. |
CVE-2024-20900 | Medium | 4.0 | 2024-07-02 | Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentication. |
CVE-2024-20890 | Medium | 5.3 | 2024-07-02 | Improper input validation in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to trigger abnormal behavior. |
CVE-2024-20889 | Medium | 5.9 | 2024-07-02 | Improper authentication in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to pair with devices. |
CVE-2024-28200 | Critical | 9.1 | 2024-07-01 | The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 20… |
CVE-2024-38523 | High | 7.5 | 2024-06-27 | Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that we… |
CVE-2024-23767 | High | 8.8 | 2024-06-26 | An issue was discovered on HMS Anybus X-Gateway AB7832-F firmware version 3. The HICP protocol allows unauthenticated changes to a device's network configurati… |
CVE-2024-27867 | Medium | 4.3 | 2024-06-26 | An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Be… |
CVE-2024-5012 | High | 8.6 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, there is a missing authentication vulnerability in WUGDataAccess.Credentials. This vulnerability allows unau… |
CVE-2024-5806 | Critical | 9.1 | 2024-06-25 | Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023… |
CVE-2024-5805 | Critical | 9.1 | 2024-06-25 | Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0. |
CVE-2024-37085 | Medium | 6.8 | 2024-06-25 | VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESX… |
CVE-2024-37233 | Medium | 4.3 | 2024-06-24 | Improper Authentication vulnerability in Play.Ht allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Play.Ht: from n/a through 3… |
CVE-2024-24554 | High | 8.2 | 2024-06-24 | Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allow… |
CVE-2024-37897 | Medium | 5.4 | 2024-06-20 | SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient s… |
CVE-2024-5432 | Critical | 9.8 | 2024-06-20 | The Lifeline Donation plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.6. This is due to insufficient verifica… |
CVE-2024-38351 | Medium | 5.4 | 2024-06-18 | Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exp… |
CVE-2024-37893 | Medium | 5.9 | 2024-06-17 | Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to b… |
CVE-2024-6057 | Critical | 9.8 | 2024-06-17 | Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an… |
CVE-2024-27275 | High | 7.4 | 2024-06-15 | IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local user without administ… |
CVE-2024-37368 | High | 7.5 | 2024-06-14 | A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote system with FTView to… |
CVE-2024-37367 | High | 7.5 | 2024-06-14 | A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE v12. The vulnerability allows a user from a remote system with FTVie… |
CVE-2024-37313 | High | 7.3 | 2024-06-14 | Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providin… |
CVE-2024-3080 | Critical | 9.8 | 2024-06-14 | Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device. |
CVE-2024-22441 | Critical | 9.8 | 2024-06-13 | HPE Cray Parallel Application Launch Service (PALS) is subject to an authentication bypass. |
CVE-2024-30299 | Critical | 10.0 | 2024-06-13 | Adobe Framemaker Publishing Server versions 2020.3, 2022.2 and earlier are affected by an Improper Authentication vulnerability that could result in privilege… |
CVE-2024-34103 | High | 8.1 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege… |
CVE-2024-5798 | Low | 2.6 | 2024-06-12 | Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have res… |
CVE-2024-36264 | Critical | 9.8 | 2024-06-12 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils. If the user doesn't explicitly set `submarine.auth.de… |
CVE-2024-35248 | High | 7.3 | 2024-06-11 | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability |
CVE-2024-36266 | Critical | 9.3 | 2024-06-11 | A vulnerability has been identified in PowerSys (All versions < V3.11). The affected application insufficiently protects responses to authentication requests… |
CVE-2024-23251 | Medium | 4.6 | 2024-06-10 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sono… |
CVE-2022-45168 | Medium | 6.5 | 2024-06-10 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /login/backup_code endpoint and… |
CVE-2024-37408 | High | 7.3 | 2024-06-08 | fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by "auth sufficient pam_fprintd.so" for Sudo. NOTE… |
CVE-2024-5732 | High | 7.3 | 2024-06-07 | A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Po… |
CVE-2024-37152 | Medium | 5.3 | 2024-06-06 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /a… |
CVE-2024-5658 | Medium | 4.8 | 2024-06-06 | The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period. |
CVE-2023-50804 | Low | 3.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor, and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2… |
CVE-2024-35670 | Medium | 5.3 | 2024-06-04 | Broken Authentication vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.93. |
CVE-2023-51511 | Medium | 6.5 | 2024-06-04 | Improper Authentication vulnerability in Pluggabl LLC Booster Elite for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue… |
CVE-2023-48747 | Medium | 6.5 | 2024-06-04 | Improper Authentication vulnerability in Pluggabl LLC Booster for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affect… |
CVE-2023-47189 | Medium | 5.3 | 2024-06-04 | Improper Authentication vulnerability in WPMU DEV Defender Security allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Defender… |
CVE-2023-46630 | High | 7.5 | 2024-06-04 | Improper Authentication vulnerability in wpase Admin and Site Enhancements (ASE) allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff… |
CVE-2024-37019 | Critical | 9.8 | 2024-06-03 | Northern.tech Mender Enterprise before 3.6.4 and 3.7.x before 3.7.4 has Weak Authentication. |
CVE-2023-43551 | Critical | 9.1 | 2024-06-03 | Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode C… |
CVE-2024-5201 | High | 8.8 | 2024-05-23 | Privilege Escalation in OpenText Dimensions RM allows an authenticated user to escalate there privilege to the privilege of another user via HTTP Request |
CVE-2024-28188 | Medium | 5.3 | 2024-05-23 | Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyter-scheduler` users… |
CVE-2024-29849 | Critical | 9.8 | 2024-05-22 | Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. |
CVE-2024-5044 | Low | 3.7 | 2024-05-17 | A vulnerability was found in Emlog Pro 2.3.4. It has been classified as problematic. This affects an unknown part of the component Cookie Handler. The manipula… |
CVE-2023-41956 | High | 8.8 | 2024-05-17 | Improper Authentication vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.3.4. |
CVE-2024-35184 | Medium | 5.5 | 2024-05-15 | Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to versi… |
CVE-2024-3487 | Low | 3.5 | 2024-05-15 | Broken Authentication vulnerability discovered in OpenText™ iManager 3.2.6.0200. This vulnerability allows an attacker to manipulate certain parameters to bypa… |
CVE-2024-4129 | High | 8.8 | 2024-05-14 | Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Ac… |
CVE-2024-3263 | Critical | 9.8 | 2024-05-14 | YMS VIS Pro is an information system for veterinary and food administration, veterinarians and farm. Due to a combination of improper method for system credent… |
CVE-2024-34340 | Critical | 9.1 | 2024-05-14 | Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their passw… |
CVE-2024-27835 | Low | 2.4 | 2024-05-14 | This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access to an iOS device… |
CVE-2020-18305 | High | 8.0 | 2024-05-14 | Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers… |
CVE-2024-4601 | Medium | 6.7 | 2024-05-07 | An incorrect authentication vulnerability has been found in Socomec Net Vision affecting version 7.20. This vulnerability allows an attacker to perform a brute… |
CVE-2024-20856 | Medium | 4.3 | 2024-05-07 | Improper Authentication vulnerability in Secure Folder prior to SMR May-2024 Release 1 allows physical attackers to access Secure Folder without proper authent… |
CVE-2024-34093 | Medium | 5.3 | 2024-05-06 | An issue was discovered in Archer Platform 6 before 2024.03. There is an X-Forwarded-For Header Bypass vulnerability. An unauthenticated attacker could potenti… |
CVE-2024-33110 | Critical | 9.1 | 2024-05-06 | D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Permission Bypass via the getcfg.php component. |
CVE-2023-38096 | Critical | 9.8 | 2024-05-03 | NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authen… |
CVE-2024-26331 | High | 7.5 | 2024-04-30 | ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID. Attac… |
CVE-2024-4303 | High | 8.8 | 2024-04-29 | ArmorX Android APP's multi-factor authentication (MFA) for the login function is not properly implemented. Remote attackers who obtain user credentials can byp… |
CVE-2023-47222 | Critical | 9.6 | 2024-04-26 | An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow users to com… |
CVE-2024-30939 | Medium | 6.8 | 2024-04-25 | An issue discovered in Yealink VP59 Teams Editions with firmware version 91.15.0.118 allows a physically proximate attacker to gain control of an account via a… |
CVE-2023-6787 | Medium | 6.5 | 2024-04-25 | A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an act… |
CVE-2024-4024 | High | 7.3 | 2024-04-25 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versi… |
CVE-2023-3597 | Medium | 5.0 | 2024-04-25 | A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote… |
CVE-2023-51484 | Critical | 9.8 | 2024-04-25 | Improper Authentication vulnerability in wp-buy Login as User or Customer (User Switching) allows Privilege Escalation.This issue affects Login as User or Cust… |
CVE-2023-51482 | Critical | 9.9 | 2024-04-25 | Improper Authentication vulnerability in EazyPlugins Eazy Plugin Manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Eaz… |
CVE-2023-51478 | Critical | 9.8 | 2024-04-25 | Improper Authentication vulnerability in Abdul Hakeem Build App Online allows Privilege Escalation.This issue affects Build App Online: from n/a through 1.0.19. |
CVE-2023-51477 | Critical | 9.8 | 2024-04-24 | Improper Authentication vulnerability in BUDDYBOSS DMCC BuddyBoss Theme allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Budd… |
CVE-2023-51472 | Critical | 9.8 | 2024-04-24 | Improper Authentication vulnerability in Mestres do WP Checkout Mestres WP allows Privilege Escalation.This issue affects Checkout Mestres WP: from n/a through… |
CVE-2023-51471 | High | 8.2 | 2024-04-24 | Improper Authentication vulnerability in Mestres do WP Checkout Mestres WP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects C… |
CVE-2023-51405 | High | 8.2 | 2024-04-24 | Improper Authentication vulnerability in Repute Infosystems BookingPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Boo… |
CVE-2023-47504 | Medium | 6.5 | 2024-04-24 | Improper Authentication vulnerability in Elementor Elementor Website Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |
CVE-2023-25790 | Medium | 5.3 | 2024-04-24 | Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart allows Cross-Sit… |
CVE-2024-3701 | Critical | 9.8 | 2024-04-15 | The system application (com.transsion.kolun.aiservice) component does not perform an authentication check, which allows attackers to perform malicious exploita… |
CVE-2024-29837 | High | 8.8 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to acce… |
CVE-2023-48865 | Medium | 6.5 | 2024-04-11 | An issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via execute_mode parameter of the URL. |
CVE-2024-2112 | Medium | 5.9 | 2024-04-09 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions… |
CVE-2024-24279 | High | 8.8 | 2024-04-08 | An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attackers to gain escalated privileges via vsVe… |
CVE-2023-52540 | High | 7.5 | 2024-04-08 | Vulnerability of improper authentication in the Iaware module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-29757 | High | 7.3 | 2024-04-05 | there is a possible permission bypass due to Debug certs being allowlisted. This could lead to local escalation of privilege with no additional execution privi… |
CVE-2024-25699 | High | 8.5 | 2024-04-04 | There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux… |
CVE-2023-44039 | Critical | 9.1 | 2024-04-03 | In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO… |