CWE-287 · Improper Authentication (page 15)
Page 15 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50714 | Medium | 6.8 | 2023-12-22 | yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2… |
CVE-2023-49791 | Medium | 5.4 | 2023-12-22 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcl… |
CVE-2023-49790 | Medium | 4.3 | 2023-12-22 | The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be… |
CVE-2023-51708 | High | 8.6 | 2023-12-22 | Bentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via… |
CVE-2023-6847 | High | 7.5 | 2023-12-21 | An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of Private Mode by using a specially crafted API requ… |
CVE-2023-51442 | High | 8.6 | 2023-12-21 | Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allo… |
CVE-2023-6768 | Critical | 9.4 | 2023-12-20 | Authentication bypass vulnerability in Amazing Little Poll affecting versions 1.3 and 1.4. This vulnerability could allow an unauthenticated user to access the… |
CVE-2023-37544 | High | 7.5 | 2023-12-20 | Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This is… |
CVE-2023-6483 | Critical | 9.1 | 2023-12-18 | The vulnerability exists in ADiTaaS (Allied Digital Integrated Tool-as-a-Service) version 5.1 due to an improper authentication vulnerability in the ADiTaaS ba… |
CVE-2023-6907 | Medium | 5.4 | 2023-12-18 | A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2023-49646 | Medium | 6.4 | 2023-12-13 | Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access. |
CVE-2023-44252 | High | 8.8 | 2023-12-13 | ** UNSUPPORTED WHEN ASSIGNED **An improper authentication vulnerability [CWE-287] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5… |
CVE-2023-45801 | High | 7.5 | 2023-12-13 | Improper Authentication vulnerability in Nadatel DVR allows Information Elicitation.This issue affects DVR: from 3.0.0 before 9.9.0. |
CVE-2023-36004 | High | 7.5 | 2023-12-12 | Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability |
CVE-2023-36648 | High | 8.2 | 2023-12-12 | Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read potentially sensitive… |
CVE-2023-50430 | Medium | 6.4 | 2023-12-09 | The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol (SDCP) when enrolling via Linux… |
CVE-2023-45866 | Medium | 6.3 | 2023-12-08 | Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboar… |
CVE-2023-43742 | Critical | 9.8 | 2023-12-08 | An authentication bypass in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109… |
CVE-2023-36655 | Critical | 9.8 | 2023-12-06 | The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) allows a remote blocked user to login and obtain… |
CVE-2023-6514 | High | 8.8 | 2023-12-06 | The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability m… |
CVE-2023-5970 | High | 8.8 | 2023-12-05 | Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using ac… |
CVE-2023-47304 | High | 7.8 | 2023-12-05 | An issue was discovered in Vonage Box Telephone Adapter VDV23 version VDV21-3.2.11-0.5.1, allows local attackers to bypass UART authentication controls and rea… |
CVE-2023-42576 | Medium | 5.4 | 2023-12-05 | Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to invalid exception ha… |
CVE-2023-33070 | High | 7.1 | 2023-12-05 | Transient DOS in Automotive OS due to improper authentication to the secure IO calls. |
CVE-2023-33054 | Critical | 9.1 | 2023-12-05 | Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data. |
CVE-2023-5808 | High | 7.6 | 2023-12-05 | SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrat… |
CVE-2023-44302 | High | 8.1 | 2023-12-04 | Dell DM5500 5.14.0.0 and prior contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerabilit… |
CVE-2023-6354 | Medium | 5.3 | 2023-11-30 | Tyler Technologies Magistrate Court Case Management Plus allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the PDFVi… |
CVE-2023-6353 | Medium | 5.3 | 2023-11-30 | Tyler Technologies Civil and Criminal Electronic Filing allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the Upload… |
CVE-2023-6344 | Medium | 5.3 | 2023-11-30 | Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate directories using the tiffserver/te003.aspx or te004.aspx… |
CVE-2023-6343 | Medium | 5.3 | 2023-11-30 | Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate and access sensitive files using the tiffserver/tssp.aspx… |
CVE-2023-6342 | Medium | 5.3 | 2023-11-30 | Tyler Technologies Court Case Management Plus allows a remote attacker to authenticate as any user by manipulating at least the 'CmWebSearchPfp/Login.aspx?xyzl… |
CVE-2023-34388 | Medium | 6.5 | 2023-11-30 | An Improper Authentication vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote unauthenticated attacker to potentially perfor… |
CVE-2023-35137 | High | 7.5 | 2023-11-30 | An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(A… |
CVE-2023-29062 | Low | 3.8 | 2023-11-28 | The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately vali… |
CVE-2023-48121 | Medium | 5.3 | 2023-11-28 | An authentication bypass vulnerability in the Direct Connection Module in Ezviz CS-C6N-xxx prior to v5.3.x build 20230401, Ezviz CS-CV310-xxx prior to v5.3.x b… |
CVE-2023-41264 | Critical | 9.8 | 2023-11-28 | Netwrix Usercube before 6.0.215, in certain misconfigured on-premises installations, allows authentication bypass on deployment endpoints, leading to privilege… |
CVE-2022-41678 | High | 8.8 | 2023-11-28 | Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolok… |
CVE-2023-6329 | Critical | 9.8 | 2023-11-27 | An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a "passwordCustom" option that… |
CVE-2023-41999 | Critical | 9.8 | 2023-11-27 | An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that all… |
CVE-2023-48312 | Critical | 9.8 | 2023-11-24 | capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a mi… |
CVE-2023-4677 | High | 7.0 | 2023-11-23 | Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory… |
CVE-2023-2437 | Critical | 9.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on th… |
CVE-2023-6248 | Critical | 10.0 | 2023-11-21 | The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code… |
CVE-2023-49105 | Critical | 9.8 | 2023-11-21 | An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of… |
CVE-2023-48228 | High | 7.5 | 2023-11-21 | authentik is an open-source identity provider. When initialising a oauth2 flow with a `code_challenge` and `code_method` (thus requesting PKCE), the single sig… |
CVE-2023-29155 | Critical | 9.8 | 2023-11-20 | Versions of INEA ME RTU firmware 3.36b and prior do not require authentication to the "root" account on the host system of the device. This could allow an atta… |
CVE-2023-44324 | Critical | 9.8 | 2023-11-17 | Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature b… |
CVE-2023-41442 | Critical | 9.8 | 2023-11-15 | An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via a crafted request t… |
CVE-2023-43582 | Medium | 5.5 | 2023-11-15 | Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access. |
CVE-2023-47127 | Medium | 4.2 | 2023-11-14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different site… |
CVE-2023-32661 | Medium | 6.7 | 2023-11-14 | Improper authentication in some Intel(R) NUC Kits NUC7PJYH and NUC7CJYH Realtek* SD Card Reader Driver installation software before version 10.0.19041.29098 ma… |
CVE-2023-28377 | Medium | 6.7 | 2023-11-14 | Improper authentication in some Intel(R) NUC Kit NUC11PH USB firmware installation software before version 1.1 for Windows may allow an authenticated user to p… |
CVE-2023-22663 | Medium | 5.9 | 2023-11-14 | Improper authentication for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. |
CVE-2023-29975 | High | 7.2 | 2023-11-09 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification. |
CVE-2023-4612 | Critical | 9.8 | 2023-11-09 | Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.T… |
CVE-2023-42554 | Medium | 5.4 | 2023-11-07 | Improper Authentication vulnerabiity in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication. |
CVE-2023-42531 | Medium | 6.2 | 2023-11-07 | Improper access control vulnerability in SmsController prior to SMR Nov-2023 Release1 allows local attackers to bypass restrictions on starting activities from… |
CVE-2023-24852 | High | 8.4 | 2023-11-07 | Memory Corruption in Core due to secure memory access by user while loading modem image. |
CVE-2023-39345 | High | 7.6 | 2023-11-06 | strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration en… |
CVE-2023-40660 | Medium | 6.6 | 2023-11-06 | A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operatio… |
CVE-2023-46963 | Medium | 5.3 | 2023-11-04 | An issue in Beijing Yunfan Internet Technology Co., Ltd, Yunfan Learning Examination System v.6.5 allows a remote attacker to obtain sensitive information via… |
CVE-2022-44569 | High | 7.8 | 2023-11-03 | A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication. |
CVE-2023-26455 | Medium | 5.6 | 2023-11-02 | RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI serv… |
CVE-2023-46327 | Medium | 5.9 | 2023-11-02 | Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their… |
CVE-2023-5627 | High | 7.5 | 2023-11-01 | A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implemen… |
CVE-2023-46249 | Critical | 9.6 | 2023-10-31 | authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possib… |
CVE-2023-44397 | High | 7.5 | 2023-10-30 | CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller… |
CVE-2023-21307 | Medium | 5.0 | 2023-10-30 | In Bluetooth, there is a possible way for a paired Bluetooth device to access a long term identifier for an Android device due to a permissions bypass. This co… |
CVE-2023-21297 | Medium | 4.4 | 2023-10-30 | In SEPolicy, there is a possible way to access the factory MAC address due to a permissions bypass. This could lead to local information disclosure with System… |
CVE-2023-5844 | High | 7.2 | 2023-10-30 | Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0. |
CVE-2023-5830 | High | 7.3 | 2023-10-27 | A vulnerability classified as critical has been found in ColumbiaSoft Document Locator. This affects an unknown part of the file /api/authentication/login of t… |
CVE-2023-35794 | High | 8.8 | 2023-10-27 | An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint (spawned console) can be accessed without authentication. S… |
CVE-2022-3681 | Medium | 6.5 | 2023-10-27 | A vulnerability has been identified in the MR2600 router v1.0.18 and earlier that could allow an attacker within range of the wireless network to successfully… |
CVE-2023-46290 | High | 8.1 | 2023-10-27 | Due to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk® Servic… |
CVE-2022-34887 | Medium | 4.3 | 2023-10-27 | Standard users can directly operate and set printer configuration information , such as IP, in some Lenovo Printers without having to authenticate with the adm… |
CVE-2023-30967 | Critical | 9.8 | 2023-10-26 | Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files… |
CVE-2023-37283 | High | 8.1 | 2023-10-25 | Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter |
CVE-2023-27377 | High | 7.5 | 2023-10-25 | Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction o… |
CVE-2023-5246 | High | 8.8 | 2023-10-23 | Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 10… |
CVE-2023-38735 | Medium | 5.7 | 2023-10-22 | IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attack… |
CVE-2023-4939 | Medium | 5.3 | 2023-10-21 | The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication to… |
CVE-2023-41089 | High | 8.0 | 2023-10-19 | The affected product is vulnerable to an improper authentication vulnerability, which may allow an attacker to impersonate a legitimate user as long a… |
CVE-2023-45669 | Medium | 4.8 | 2023-10-16 | WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature count… |
CVE-2023-4562 | Critical | 9.1 | 2023-10-13 | Improper Authentication vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules allows a remote unauthenticated attacker to obtain sequen… |
CVE-2023-41261 | Medium | 5.3 | 2023-10-12 | An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV does not require authenti… |
CVE-2023-23632 | High | 7.8 | 2023-10-12 | BeyondTrust Privileged Remote Access (PRA) versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. Attackers can exploit a flawed secret ver… |
CVE-2023-24479 | Critical | 9.8 | 2023-10-11 | An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead t… |
CVE-2023-44096 | High | 7.5 | 2023-10-11 | Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-36724 | Medium | 5.5 | 2023-10-10 | Windows Power Management Service Information Disclosure Vulnerability |
CVE-2023-43809 | High | 7.5 | 2023-10-04 | Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, r… |
CVE-2023-43805 | High | 7.5 | 2023-10-04 | Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypas… |
CVE-2023-43793 | High | 7.5 | 2023-10-04 | Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull… |
CVE-2021-3784 | Medium | 5.3 | 2023-10-04 | Garuda Linux performs an insecure user creation and authentication that allows any user to impersonate the created account. By creating users from the 'Garuda… |
CVE-2023-40376 | Medium | 5.3 | 2023-10-04 | IBM UrbanCode Deploy (UCD) 7.1 - 7.1.2.12, 7.2 through 7.2.3.5, and 7.3 through 7.3.2.0 under certain configurations could allow an authenticated user to make… |
CVE-2023-28540 | Critical | 9.1 | 2023-10-03 | Cryptographic issue in Data Modem due to improper authentication during TLS handshake. |
CVE-2023-26150 | Medium | 6.5 | 2023-10-03 | Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and… |
CVE-2023-42771 | High | 8.8 | 2023-10-03 | Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unaut… |
CVE-2023-5329 | Medium | 4.3 | 2023-10-02 | A vulnerability classified as problematic was found in Field Logic DataCube4 up to 20231001. This vulnerability affects unknown code of the file /api/ of the c… |
CVE-2023-5328 | Medium | 6.3 | 2023-10-02 | A vulnerability classified as critical has been found in SATO CL4NX-J Plus 1.13.2-u455_r2. This affects an unknown part of the component Cookie Handler. The ma… |