CWE-287 · Improper Authentication (page 14)
Page 14 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41195 | Critical | 9.8 | 2025-05-22 | An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a craft… |
CVE-2025-32815 | Medium | 6.5 | 2025-05-22 | An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur. |
CVE-2025-0605 | Medium | 4.6 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access contro… |
CVE-2025-44083 | Critical | 9.8 | 2025-05-21 | An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authentication |
CVE-2025-4978 | Critical | 9.8 | 2025-05-20 | A vulnerability, which was classified as very critical, was found in Netgear DGND3700 1.1.00.15_1.00.15NA. This affects an unknown part of the file /BRS_top.ht… |
CVE-2025-47790 | Medium | 6.4 | 2025-05-16 | Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13… |
CVE-2025-4755 | High | 7.3 | 2025-05-16 | A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125). It has been classified as critical. This affects the function sub_497DE4 of the file /H5/ne… |
CVE-2025-47275 | Critical | 9.1 | 2025-05-15 | Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of ap… |
CVE-2025-47889 | Critical | 9.8 | 2025-05-14 | In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticate… |
CVE-2025-20083 | High | 7.5 | 2025-05-13 | Improper authentication in the firmware for the Intel(R) Slim Bootloader may allow a privileged user to potentially enable escalation of privilege via local ac… |
CVE-2025-26685 | Medium | 6.5 | 2025-05-13 | Improper authentication in Microsoft Defender for Identity allows an unauthorized attacker to perform spoofing over an adjacent network. |
CVE-2025-31228 | Medium | 6.8 | 2025-05-12 | The issue was addressed with improved authentication. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physical access to a dev… |
CVE-2025-3659 | | 2025-05-12 | Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families: * Digi PortServer TS - prior to a… | |
CVE-2025-4494 | High | 7.3 | 2025-05-09 | A vulnerability, which was classified as critical, was found in JAdmin-JAVA JAdmin 1.0. Affected is the function toLogin of the file NoNeedLoginController.java… |
CVE-2025-29813 | Critical | 10.0 | 2025-05-08 | Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2024-11186 | Critical | 10.0 | 2025-05-08 | On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS dev… |
CVE-2025-46573 | | 2025-05-06 | passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including versi… | |
CVE-2025-46572 | | 2025-05-06 | passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including versi… | |
CVE-2025-22477 | High | 8.3 | 2025-05-06 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with adjacent… |
CVE-2025-46590 | Medium | 6.3 | 2025-05-06 | Bypass vulnerability in the network search instruction authentication module Impact: Successful exploitation of this vulnerability can bypass authentication an… |
CVE-2025-0217 | High | 7.8 | 2025-05-05 | BeyondTrust Privileged Remote Access (PRA) versions prior to 25.1 are vulnerable to a local authentication bypass. A local authenticated attacker can view the… |
CVE-2025-25504 | Medium | 6.5 | 2025-05-05 | An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with network access to connec… |
CVE-2025-4268 | Medium | 5.3 | 2025-05-05 | A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.c… |
CVE-2025-46631 | Medium | 6.5 | 2025-05-01 | Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to the… |
CVE-2025-46630 | Medium | 6.5 | 2025-05-01 | Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable 'ate' (a remote syst… |
CVE-2025-4144 | Critical | 9.8 | 2025-05-01 | PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However… |
CVE-2025-29906 | High | 8.6 | 2025-04-29 | Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the `tty` configuration… |
CVE-2025-46348 | Critical | 10.0 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication… |
CVE-2025-3910 | Medium | 5.4 | 2025-04-29 | A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirem… |
CVE-2025-4019 | High | 7.3 | 2025-04-28 | A vulnerability, which was classified as critical, was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. Affected is the function ge… |
CVE-2025-4018 | Medium | 5.3 | 2025-04-28 | A vulnerability, which was classified as critical, has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This issue affects the… |
CVE-2025-4015 | Medium | 5.3 | 2025-04-28 | A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. It has been rated as critical. Affected by this issue is the f… |
CVE-2025-3627 | Medium | 4.3 | 2025-04-25 | A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying thei… |
CVE-2025-3634 | Medium | 4.3 | 2025-04-25 | A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Spec… |
CVE-2024-11917 | High | 8.1 | 2025-04-25 | The JobSearch WP Job Board plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.9.2. This is due to improper con… |
CVE-2025-2771 | Medium | 5.3 | 2025-04-23 | BEC Technologies Multiple Routers Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installa… |
CVE-2023-44752 | Critical | 9.8 | 2025-04-22 | An issue in Student Study Center Desk Management System v1.0 allows attackers to bypass authentication via a crafted GET request to /php-sscdms/admin/login.php. |
CVE-2025-3850 | Low | 3.7 | 2025-04-22 | A vulnerability, which was classified as problematic, has been found in YXJ2018 SpringBoot-Vue-OnlineExam 1.0. This issue affects some unknown processing of th… |
CVE-2025-27086 | High | 8.1 | 2025-04-21 | A vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication. |
CVE-2025-31478 | High | 8.2 | 2025-04-16 | Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited solely by being able to authenticate with a s… |
CVE-2025-30215 | Critical | 9.6 | 2025-04-16 | NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11… |
CVE-2025-30733 | Medium | 6.5 | 2025-04-15 | Vulnerability in the RDBMS Listener component of Oracle Database Server. Supported versions that are affected are 19.3-19.26, 21.3-21.17 and 23.4-23.7. Easil… |
CVE-2024-44843 | Medium | 5.9 | 2025-04-15 | An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via supplying crafted OC… |
CVE-2025-24949 | Medium | 6.5 | 2025-04-15 | In JotUrl 2.0, is possible to bypass security requirements during the password change process. |
CVE-2025-2572 | Medium | 5.6 | 2025-04-14 | In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of Whats… |
CVE-2025-22232 | Medium | 5.3 | 2025-04-10 | Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affecte… |
CVE-2025-22375 | | 2025-04-10 | An authentication bypass vulnerability was found in Videx's CyberAudit-Web. Through the exploitation of a logic flaw, an attacker could create a valid session… | |
CVE-2025-30287 | High | 8.2 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution… |
CVE-2025-30282 | Critical | 9.1 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution… |
CVE-2025-25227 | High | 7.5 | 2025-04-08 | Insufficient state checks lead to a vector that allows to bypass 2FA checks. |
CVE-2025-3268 | Medium | 5.3 | 2025-04-04 | A vulnerability has been found in qinguoyi TinyWebServer up to 1.0 and classified as critical. This vulnerability affects unknown code of the file http/http_co… |
CVE-2025-3062 | Medium | 6.6 | 2025-03-31 | Vulnerability in Drupal Drupal Admin LTE theme.This issue affects Drupal Admin LTE theme: *.*. |
CVE-2025-3061 | Medium | 6.6 | 2025-03-31 | Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*. |
CVE-2025-30432 | Medium | 6.4 | 2025-03-31 | A logic issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sonoma 14.7.5, macOS Ventura… |
CVE-2025-30430 | Critical | 9.8 | 2025-03-31 | This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. Pa… |
CVE-2025-31122 | | 2025-03-31 | scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by changing the userna… | |
CVE-2024-13804 | Critical | 9.8 | 2025-03-30 | Unauthenticated RCE in HPE Insight Cluster Management Utility |
CVE-2025-2859 | Critical | 9.8 | 2025-03-28 | An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the… |
CVE-2025-30361 | Critical | 9.8 | 2025-03-27 | WeGIA is a Web manager for charitable institutions. A security vulnerability was identified in versions prior to 3.2.6, where it is possible to change a user's… |
CVE-2025-30214 | High | 7.5 | 2025-03-25 | Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that coul… |
CVE-2025-30168 | Medium | 6.9 | 2025-03-21 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication… |
CVE-2024-57490 | High | 7.7 | 2025-03-21 | Guangzhou Hongfan Technology Co., LTD. iOffice20 has any user login vulnerability. An attacker can log in to any system account including the system administra… |
CVE-2025-22228 | High | 7.4 | 2025-03-20 | BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are… |
CVE-2025-26475 | Medium | 5.5 | 2025-03-19 | Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, Enables Live-Restore setting which enhances security by keeping containers running duri… |
CVE-2025-30116 | High | 7.5 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Remotely Dumping of Video Footage and the Live Video Stream can occur. It allows rem… |
CVE-2025-30114 | Critical | 9.1 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Bypassing of Device Pairing can occur. The pairing mechanism relies solely on the co… |
CVE-2025-2388 | High | 7.3 | 2025-03-17 | A vulnerability was found in Keytop 路内停车收费系统 2.7.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /s… |
CVE-2025-2344 | Medium | 5.3 | 2025-03-16 | A vulnerability, which was classified as critical, has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this issue is some unknown f… |
CVE-2025-2339 | Medium | 5.3 | 2025-03-16 | A vulnerability was found in otale Tale Blog 2.0.5. It has been classified as problematic. This affects an unknown part of the file /%61dmin/api/logs. The mani… |
CVE-2025-2230 | High | 7.7 | 2025-03-13 | A flaw exists in the Windows login flow where an AuthContext token can be exploited for replay attacks and authentication bypass. |
CVE-2025-29773 | Medium | 5.8 | 2025-03-13 | Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accou… |
CVE-2025-27138 | Critical | 9.8 | 2025-03-13 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease… |
CVE-2025-0813 | Medium | 6.8 | 2025-03-12 | CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permission rights has physica… |
CVE-2025-27403 | | 2025-03-11 | Ratify is a verification engine as a binary executable and on Kubernetes which enables verification of artifact security metadata and admits for deployment onl… | |
CVE-2024-56336 | Critical | 9.8 | 2025-03-11 | A vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FS number is 02). The… |
CVE-2024-11087 | High | 8.1 | 2025-03-08 | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all vers… |
CVE-2025-1475 | Critical | 9.8 | 2025-03-07 | The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verificat… |
CVE-2025-25452 | Medium | 5.1 | 2025-03-06 | An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the "/user" endpoint |
CVE-2025-25451 | Medium | 5.1 | 2025-03-06 | An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a physically proximate attacker to escalate privileges via the "2fa_authorized" Local Stor… |
CVE-2025-25450 | Medium | 5.1 | 2025-03-06 | An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the deactivation of the activated second fact… |
CVE-2025-27672 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows OAUTH Security Bypass OVE-20230524-0016. |
CVE-2025-27641 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.951 Application 20.0.2368 allows Unauthenticated APIs for Single-Sign On V-2024-009. |
CVE-2025-27425 | Medium | 4.3 | 2025-03-04 | Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first. T… |
CVE-2025-1880 | Low | 2.0 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been classified as problematic. Affected is an unknown function of the component Device… |
CVE-2025-27422 | High | 7.5 | 2025-03-03 | FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges… |
CVE-2024-38426 | Medium | 5.4 | 2025-03-03 | While processing the authentication message in UE, improper authentication may lead to information disclosure. |
CVE-2025-1723 | High | 8.1 | 2025-03-03 | Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in th… |
CVE-2025-23116 | Critical | 9.6 | 2025-03-01 | An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor with access to UniFi P… |
CVE-2025-27416 | | 2025-03-01 | Scratch-Coding-Hut.github.io is the website for Coding Hut. The website as of 28 February 2025 contained a sign in with scratch username and password form. Any… | |
CVE-2025-27414 | | 2025-02-28 | MinIO is a high performance object storage. Starting in RELEASE.2024-06-06T09-36-42Z and prior to RELEASE.2025-02-28T09-55-16Z, a bug in evaluating the trust… | |
CVE-2025-26326 | High | 8.8 | 2025-02-28 | A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which allows an attacker t… |
CVE-2025-27112 | Medium | 6.5 | 2025-02-24 | Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API end… |
CVE-2024-5174 | | 2025-02-24 | A flaw in Gliffy results in broken authentication through the reset functionality of the application. | |
CVE-2025-1024 | Medium | 4.8 | 2025-02-19 | A vulnerability exists in ChurchCRM 5.13.0 that allows an attacker to execute arbitrary JavaScript in a victim's browser via Reflected Cross-Site Scripting (XS… |
CVE-2025-24895 | Critical | 9.1 | 2025-02-18 | CIE.AspNetCore.Authentication is an AspNetCore Remote Authenticator for CIE 3.0. Authentication using Spid and CIE is based on the SAML2 standard which provide… |
CVE-2025-24894 | Critical | 9.1 | 2025-02-18 | SPID.AspNetCore.Authentication is an AspNetCore Remote Authenticator for SPID. Authentication using Spid and CIE is based on the SAML2 standard which provides… |
CVE-2024-57046 | High | 8.8 | 2025-02-18 | A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When a… |
CVE-2024-57045 | Critical | 9.8 | 2025-02-18 | A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. An attack… |
CVE-2025-0981 | Medium | 6.1 | 2025-02-18 | A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting (XSS) vulne… |
CVE-2025-24904 | High | 8.5 | 2025-02-13 | libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior… |