CWE-287 · Improper Authentication (page 14)
Page 14 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-44039 | Critical | 9.1 | 2024-04-03 | In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO… |
CVE-2024-22247 | Medium | 4.8 | 2024-04-02 | VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability. A malicious actor with physical access to the SD-WAN Edge applian… |
CVE-2024-28012 | Critical | 9.8 | 2024-03-28 | Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-… |
CVE-2024-28009 | Critical | 9.8 | 2024-03-28 | Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-… |
CVE-2024-28007 | Critical | 9.8 | 2024-03-28 | Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-… |
CVE-2024-28006 | Medium | 5.3 | 2024-03-28 | Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-… |
CVE-2023-31634 | Critical | 9.8 | 2024-03-27 | In TeslaMate before 1.27.2, there is unauthorized access to port 4000 for remote viewing and operation of user data. After accessing the IP address for the Tes… |
CVE-2024-2244 | Medium | 5.3 | 2024-03-27 | REST service authentication anomaly with “valid username/no password” credential combination for batch job processing resulting in successful service invocatio… |
CVE-2024-2873 | Critical | 9.1 | 2024-03-25 | A vulnerability was found in wolfSSH's server-side state machine before versions 1.4.17. A malicious client could create channels without first performing user… |
CVE-2024-2862 | Critical | 9.1 | 2024-03-25 | This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant. |
CVE-2022-44595 | Medium | 5.3 | 2024-03-21 | Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0. |
CVE-2024-1148 | Critical | 9.8 | 2024-03-21 | Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and uploading of files. |
CVE-2024-1147 | Critical | 9.8 | 2024-03-21 | Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and download of files. |
CVE-2024-27923 | High | 8.8 | 2024-03-21 | Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission… |
CVE-2024-28735 | High | 8.1 | 2024-03-20 | Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user… |
CVE-2024-27767 | Critical | 10.0 | 2024-03-18 | CWE-287: Improper Authentication may allow Authentication Bypass |
CVE-2024-28255 | Critical | 9.8 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-2450 | High | 8.8 | 2024-03-15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switchi… |
CVE-2024-25652 | High | 7.6 | 2024-03-14 | In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED… |
CVE-2023-38534 | High | 8.6 | 2024-03-13 | Improper authentication vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.0 and 12.5.1. The vulnerability could allow disclosure of restricted… |
CVE-2024-0799 | Critical | 9.8 | 2024-03-13 | An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.s… |
CVE-2024-21427 | High | 7.5 | 2024-03-12 | Windows Kerberos Security Feature Bypass Vulnerability |
CVE-2024-21390 | High | 7.1 | 2024-03-12 | Microsoft Authenticator Elevation of Privilege Vulnerability |
CVE-2023-46717 | High | 7.5 | 2024-03-12 | An improper authentication vulnerability [CWE-287] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and versions 7.0.12 and below when configured… |
CVE-2023-49340 | Critical | 9.8 | 2024-03-09 | An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to escalate privileges and bypass authe… |
CVE-2024-21899 | Critical | 9.8 | 2024-03-08 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users… |
CVE-2024-23255 | Low | 2.4 | 2024-03-08 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Photos in the Hidden… |
CVE-2023-46172 | Medium | 5.6 | 2024-03-07 | IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow a remote attacker to bypass authentication restrictions for authoriz… |
CVE-2023-42662 | Critical | 9.3 | 2024-03-07 | JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially craft… |
CVE-2023-48703 | High | 7.5 | 2024-03-06 | RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the `x… |
CVE-2024-20301 | Medium | 6.2 | 2024-03-06 | A vulnerability in Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, physical attacker to bypass secondary authentication and ac… |
CVE-2023-38367 | Medium | 6.5 | 2024-02-29 | IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 2… |
CVE-2024-25128 | Critical | 9.1 | 2024-02-29 | Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to f… |
CVE-2023-38372 | Medium | 5.9 | 2024-02-29 | An unauthorized attacker who has obtained an IBM Watson IoT Platform 1.0 security authentication token can use it to impersonate an authorized platform user… |
CVE-2024-1735 | Critical | 9.1 | 2024-02-26 | A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentication. All users… |
CVE-2024-22395 | Medium | 6.3 | 2024-02-24 | Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a… |
CVE-2024-1817 | High | 7.3 | 2024-02-23 | A vulnerability has been found in Demososo DM Enterprise Website Building System up to 2022.8 and classified as critical. Affected by this vulnerability is the… |
CVE-2023-52161 | High | 7.5 | 2024-02-22 | The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a… |
CVE-2023-52160 | Medium | 6.5 | 2024-02-22 | The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verif… |
CVE-2024-22245 | Critical | 9.6 | 2024-02-20 | Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor… |
CVE-2022-41738 | High | 7.5 | 2024-02-17 | IBM Storage Scale Container Native Storage Access 5.1.2.1 -through 5.1.7.0 could allow an attacker to initiate connections to containers from external networks… |
CVE-2022-41737 | High | 7.1 | 2024-02-17 | IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.7.0 could allow a local attacker to initiate connections from a container outside the cur… |
CVE-2023-6451 | High | 8.6 | 2024-02-16 | Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication cookies and bypass the… |
CVE-2024-20738 | Critical | 9.8 | 2024-02-15 | Adobe FrameMaker Publishing Server versions 2022.1 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature… |
CVE-2024-25618 | Medium | 4.2 | 2024-02-14 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML… |
CVE-2024-0568 | High | 8.8 | 2024-02-14 | CWE-287: Improper Authentication vulnerability exists that could cause unauthorized tampering of device configuration over NFC communication. |
CVE-2023-31189 | Medium | 5.2 | 2024-02-14 | Improper authentication in some Intel(R) Server Product OpenBMC firmware before version egs-1.09 may allow an authenticated user to enable escalation of privil… |
CVE-2024-21410 | Critical | 9.8 | 2024-02-13 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
CVE-2024-23813 | High | 7.3 | 2024-02-13 | A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper aut… |
CVE-2024-25313 | High | 8.8 | 2024-02-09 | Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/teacher_login.php. |
CVE-2023-51761 | High | 8.3 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could bypass authentication and acquire admin capabil… |
CVE-2024-25106 | Critical | 9.1 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability h… |
CVE-2024-24830 | Critical | 9.9 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been i… |
CVE-2024-24496 | Critical | 9.8 | 2024-02-08 | An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php… |
CVE-2024-22394 | Critical | 9.8 | 2024-02-08 | An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow a remote attacker t… |
CVE-2024-23806 | Medium | 5.3 | 2024-02-07 | Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys. |
CVE-2024-24771 | High | 7.7 | 2024-02-07 | Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication… |
CVE-2023-39196 | Medium | 5.3 | 2024-02-07 | Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage Container Manager ser… |
CVE-2024-24592 | Critical | 9.8 | 2024-02-06 | Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, mod… |
CVE-2024-20816 | High | 8.0 | 2024-02-06 | Improper authentication vulnerability in onCharacteristicWriteRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackers connect to vict… |
CVE-2024-20815 | High | 8.0 | 2024-02-06 | Improper authentication vulnerability in onCharacteristicReadRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackers connect to victi… |
CVE-2023-39303 | Medium | 5.3 | 2024-02-02 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users… |
CVE-2023-50934 | Medium | 5.3 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses single-factor authentication which can lead to unnecessary risk of compromise when compared with the benefits of a dual-fact… |
CVE-2024-1039 | Critical | 9.8 | 2024-02-01 | Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web managemen… |
CVE-2023-47256 | Medium | 5.5 | 2024-02-01 | ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings |
CVE-2024-23637 | Medium | 4.2 | 2024-01-31 | OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change th… |
CVE-2024-23647 | Medium | 6.5 | 2024-01-30 | Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offe… |
CVE-2023-51982 | Critical | 9.8 | 2024-01-30 | CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case o… |
CVE-2024-1006 | High | 7.3 | 2024-01-29 | A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2024-23792 | Medium | 5.3 | 2024-01-29 | When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user. The attack requires a logged-in other us… |
CVE-2024-0988 | Medium | 6.3 | 2024-01-29 | A vulnerability classified as critical was found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this vulnerability is the function checklogin of t… |
CVE-2024-23629 | Critical | 9.6 | 2024-01-26 | An authentication bypass vulnerability exists in the web component of the Motorola MR2600. An attacker can exploit this vulnerability to access protected URLs… |
CVE-2024-0822 | High | 7.5 | 2024-01-25 | An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in… |
CVE-2024-0879 | Medium | 6.5 | 2024-01-25 | Authentication bypass in vector-admin allows a user to register to a vector-admin server while “domain restriction” is active, even when not owning an authori… |
CVE-2023-50275 | High | 7.5 | 2024-01-23 | HPE OneView may allow clusterService Authentication Bypass resulting in denial of service. |
CVE-2024-23219 | Medium | 6.2 | 2024-01-23 | The issue was addressed with improved authentication. This issue is fixed in iOS 17.3 and iPadOS 17.3. Stolen Device Protection may be unexpectedly disabled. |
CVE-2023-42935 | Medium | 5.5 | 2024-01-23 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.6.4. A local attacker may be able to view the pre… |
CVE-2023-52111 | High | 7.5 | 2024-01-16 | Authorization vulnerability in the BootLoader module. Successful exploitation of this vulnerability may affect service integrity. |
CVE-2023-46942 | High | 7.5 | 2024-01-13 | Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper auth… |
CVE-2024-21654 | Medium | 4.8 | 2024-01-12 | Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of… |
CVE-2024-22206 | Critical | 9.0 | 2024-01-12 | Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the P… |
CVE-2023-46805 | High | 8.2 | 2024-01-12 | An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted reso… |
CVE-2023-49262 | Critical | 9.8 | 2024-01-12 | The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, provided there is an active user session. |
CVE-2023-50919 | Critical | 9.8 | 2024-01-12 | An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4… |
CVE-2023-50127 | Medium | 5.9 | 2024-01-11 | Hozard alarm system (Alarmsysteem) v1.0 is vulnerable to Improper Authentication. Commands sent via the SMS functionality are accepted from random phone number… |
CVE-2024-21638 | Critical | 9.1 | 2024-01-10 | Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address sp… |
CVE-2023-48257 | High | 7.8 | 2024-01-10 | The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges o… |
CVE-2023-5376 | High | 8.6 | 2024-01-09 | An Improper Authentication vulnerability in Korenix JetNet TFTP allows abuse of this service. This issue affects JetNet devices older than firmware version 202… |
CVE-2023-51717 | Critical | 9.8 | 2024-01-09 | Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass. |
CVE-2023-7211 | Medium | 5.6 | 2024-01-07 | A vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component Administrative Web I… |
CVE-2023-7210 | High | 7.3 | 2024-01-07 | A vulnerability was found in OneNav up to 0.9.33. It has been classified as critical. This affects an unknown part of the file /index.php?c=api of the componen… |
CVE-2024-20803 | Medium | 6.8 | 2024-01-04 | Improper authentication vulnerability in Bluetooth pairing process prior to SMR Jan-2024 Release 1 allows remote attackers to establish pairing process without… |
CVE-2024-21632 | High | 8.6 | 2024-01-02 | omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy… |
CVE-2023-7079 | Medium | 6.4 | 2023-12-29 | Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over t… |
CVE-2023-31292 | Medium | 5.5 | 2023-12-29 | An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows local attackers to obtain sensitive information and bypass aut… |
CVE-2023-40038 | High | 8.8 | 2023-12-27 | Arris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. (They use the first 6 characters of the SSID… |
CVE-2023-4641 | Medium | 4.7 | 2023-12-27 | A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-uti… |
CVE-2023-6155 | Medium | 5.3 | 2023-12-26 | The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacke… |
CVE-2023-31224 | Critical | 9.8 | 2023-12-25 | There is broken access control during authentication in Jamf Pro Server before 10.46.1. |
CVE-2022-34267 | Critical | 9.8 | 2023-12-25 | An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Jav… |