CWE-287 · Improper Authentication (page 15)
Page 15 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-25205 | High | 8.2 | 2025-02-12 | Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic… |
CVE-2025-25201 | Medium | 4.0 | 2025-02-12 | Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For release 1.8.0, and test releases with PIV enabled prior to 1.8.0, the PIV application could… |
CVE-2024-13528 | High | 7.5 | 2025-02-12 | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.9.5. This i… |
CVE-2025-1044 | Critical | 9.8 | 2025-02-11 | Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installati… |
CVE-2025-21349 | Medium | 6.8 | 2025-02-11 | Windows Remote Desktop Configuration Service Tampering Vulnerability |
CVE-2024-52968 | Medium | 6.7 | 2025-02-11 | An improper authentication in Fortinet FortiClientMac 7.0.11 through 7.2.4 allows attacker to gain improper access to MacOS via empty password. |
CVE-2025-1231 | Medium | 5.4 | 2025-02-11 | Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-… |
CVE-2024-46434 | High | 8.8 | 2025-02-10 | Tenda W18E V16.01.0.8(1625) suffers from authentication bypass in the web management portal allowing an unauthorized remote attacker to gain administrative acc… |
CVE-2025-24032 | | 2025-02-10 | PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if cert_policy is set to none (the default v… | |
CVE-2025-1104 | High | 7.3 | 2025-02-07 | A vulnerability has been found in D-Link DHP-W310AV 1.04 and classified as critical. This vulnerability affects unknown code. The manipulation leads to authent… |
CVE-2024-48445 | Critical | 9.8 | 2025-02-04 | An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters. |
CVE-2025-0890 | Critical | 9.8 | 2025-02-04 | **UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_201… |
CVE-2024-27137 | Medium | 5.3 | 2025-02-04 | In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry… |
CVE-2024-12510 | Medium | 6.7 | 2025-02-03 | If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active… |
CVE-2024-57432 | High | 7.5 | 2025-01-31 | macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitl… |
CVE-2025-0637 | Critical | 9.8 | 2025-01-23 | It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow… |
CVE-2025-0604 | Medium | 5.4 | 2025-01-22 | A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new cr… |
CVE-2024-55954 | High | 8.7 | 2025-01-16 | OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint `/api/{org_id}/users/{email_id}` allows an "Admin" role u… |
CVE-2024-36402 | Medium | 5.3 | 2025-01-16 | Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remo… |
CVE-2025-22146 | Critical | 9.1 | 2025-01-15 | Sentry is a developer-first error tracking and performance monitoring tool. A critical vulnerability was discovered in the SAML SSO implementation of Sentry. I… |
CVE-2024-11322 | High | 7.5 | 2025-01-15 | A denial-of-service vulnerability exists in CyberPower PowerPanel Business (PPB) 4.11.0. An unauthenticated remote attacker can restart the ppbd.exe process v… |
CVE-2024-12919 | Critical | 9.8 | 2025-01-14 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypas… |
CVE-2025-0070 | Critical | 9.9 | 2025-01-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper… |
CVE-2024-42172 | Medium | 5.3 | 2025-01-11 | HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity th… |
CVE-2024-9133 | Medium | 6.6 | 2025-01-10 | A user with administrator privileges is able to retrieve authentication tokens |
CVE-2024-13309 | Medium | 5.4 | 2025-01-09 | Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login… |
CVE-2024-53704 | Critical | 9.8 | 2025-01-09 | An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. |
CVE-2024-56445 | Medium | 4.3 | 2025-01-08 | Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulnerability may cause features to perform a… |
CVE-2023-52955 | Medium | 6.5 | 2025-01-08 | Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulnerability may cause features to perform a… |
CVE-2024-12264 | Critical | 9.8 | 2025-01-07 | The PayU CommercePro Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.8.3. This is due to /wp-json/pay… |
CVE-2025-21618 | High | 7.5 | 2025-01-06 | NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in in… |
CVE-2024-13111 | Medium | 5.6 | 2025-01-02 | A vulnerability classified as critical was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected by this vulnerability… |
CVE-2024-1609 | | 2024-12-25 | In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation. | |
CVE-2023-31279 | High | 8.1 | 2024-12-21 | The AirVantage platform is vulnerable to an unauthorized attacker registering previously unregistered devices on the AirVantage platform when the owner has no… |
CVE-2024-56335 | High | 7.6 | 2024-12-20 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker is capable of updati… |
CVE-2024-56329 | | 2024-12-20 | Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by Laravel Jetstream, wi… | |
CVE-2020-9250 | Low | 3.3 | 2024-12-20 | There is an insufficient authentication vulnerability in some Huawei smart phone. An unauthenticated, local attacker can crafts software package to exploit thi… |
CVE-2024-1610 | Critical | 9.8 | 2024-12-18 | In OPPO Store APP, there's a possible escalation of privilege due to improper input validation. |
CVE-2024-12287 | Critical | 9.8 | 2024-12-18 | The Biagiotti Membership plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.0.2. This is due to the plugin not… |
CVE-2024-21543 | High | 7.1 | 2024-12-13 | Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls ba… |
CVE-2024-55886 | Medium | 6.9 | 2024-12-12 | OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists… |
CVE-2024-11015 | Critical | 9.8 | 2024-12-12 | The Sign In With Google plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.8.0. This is due to the 'authentica… |
CVE-2024-10111 | High | 8.1 | 2024-12-12 | The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.26.3. This is… |
CVE-2024-50339 | Medium | 5.3 | 2024-12-12 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the s… |
CVE-2024-49076 | High | 7.8 | 2024-12-12 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability |
CVE-2024-45404 | High | 8.1 | 2024-12-12 | OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attack… |
CVE-2024-47761 | High | 7.2 | 2024-12-11 | GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifi… |
CVE-2024-10511 | Medium | 5.3 | 2024-12-11 | CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local network repeatedly reque… |
CVE-2024-0130 | High | 8.8 | 2024-12-06 | NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malform… |
CVE-2024-48859 | Critical | 9.1 | 2024-12-06 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote… |
CVE-2024-11293 | High | 8.1 | 2024-12-04 | The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login… |
CVE-2024-45106 | High | 8.1 | 2024-12-03 | Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secr… |
CVE-2024-53990 | | 2024-12-02 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP requ… | |
CVE-2018-11952 | High | 8.4 | 2024-11-26 | An image with a version lower than the fuse version may potentially be booted lead to improper authentication. |
CVE-2016-10394 | High | 8.4 | 2024-11-26 | Initial xbl_sec revision does not have all the debug policy features and critical checks. |
CVE-2024-11671 | Medium | 5.4 | 2024-11-25 | Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user t… |
CVE-2022-33862 | Medium | 6.7 | 2024-11-25 | IPP software prior to v1.71 is vulnerable to default credential vulnerability. This could lead attackers to identify and access vulnerable systems. |
CVE-2024-45369 | High | 8.1 | 2024-11-22 | The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource. |
CVE-2024-6248 | High | 7.5 | 2024-11-22 | Wyze Cam v3 Cloud Infrastructure Improper Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute a… |
CVE-2024-11494 | High | 7.5 | 2024-11-20 | **UNSUPPORTED WHEN ASSIGNED** The improper authentication vulnerability in the Zyxel P-6101C ADSL modem firmware version P-6101CSA6AP_20140331 could allow an u… |
CVE-2024-47533 | Critical | 9.8 | 2024-11-18 | Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in… |
CVE-2024-52518 | Medium | 4.4 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to… |
CVE-2024-11209 | Medium | 6.3 | 2024-11-14 | A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA… |
CVE-2024-51996 | High | 7.5 | 2024-11-13 | Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony do… |
CVE-2024-49039 | High | 8.8 | 2024-11-12 | Windows Task Scheduler Elevation of Privilege Vulnerability |
CVE-2024-51997 | High | 8.1 | 2024-11-08 | Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART (**Attestation Results Token**) token, genera… |
CVE-2024-10963 | High | 7.4 | 2024-11-07 | A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick… |
CVE-2024-50341 | Low | 3.1 | 2024-11-06 | symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack fra… |
CVE-2024-9946 | High | 8.1 | 2024-11-06 | The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to… |
CVE-2024-10020 | High | 8.1 | 2024-11-06 | The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. This is due to ins… |
CVE-2023-29117 | High | 8.8 | 2024-11-05 | Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system. |
CVE-2024-10114 | High | 8.1 | 2024-11-05 | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.7.7. This is due to insuffic… |
CVE-2024-10097 | High | 8.1 | 2024-11-05 | The Loginizer Security and Loginizer plugins for WordPress are vulnerable to authentication bypass in all versions up to, and including, 1.9.2. This is due to… |
CVE-2024-10620 | Medium | 5.3 | 2024-11-01 | A vulnerability was found in knightliao Disconf 2.6.36. It has been classified as critical. This affects an unknown part of the file /api/config/list of the co… |
CVE-2024-10474 | Medium | 6.5 | 2024-10-29 | Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL sa… |
CVE-2024-49755 | Low | 3.1 | 2024-10-28 | Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. IdentityServer's local API authentication handler performs insufficient va… |
CVE-2024-50478 | Critical | 9.8 | 2024-10-28 | Authentication Bypass by Primary Weakness vulnerability in Swoop 1-Click Login: Passwordless Authentication allows Authentication Bypass.This issue affects 1-C… |
CVE-2024-49757 | High | 7.5 | 2024-10-25 | The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versio… |
CVE-2024-49376 | High | 8.8 | 2024-10-25 | Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email… |
CVE-2024-7763 | Critical | 9.8 | 2024-10-24 | In WhatsUp Gold versions released before 2024.0.0, an Authentication Bypass issue exists which allows an attacker to obtain encrypted user credentials. |
CVE-2024-10327 | High | 8.1 | 2024-10-24 | A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension f… |
CVE-2024-9947 | High | 8.1 | 2024-10-23 | The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due to insufficient veri… |
CVE-2024-9927 | High | 7.2 | 2024-10-23 | The WooCommerce Order Proposal plugin for WordPress is vulnerable to privilege escalation via order proposal in all versions up to and including 2.0.5. This is… |
CVE-2024-10173 | High | 7.3 | 2024-10-20 | A vulnerability has been found in didi DDMQ 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Console… |
CVE-2024-9683 | Medium | 4.8 | 2024-10-17 | A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided. This flaw affects the authenticat… |
CVE-2023-22650 | High | 8.8 | 2024-10-16 | A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider… |
CVE-2024-45216 | Critical | 9.8 | 2024-10-16 | Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication i… |
CVE-2020-36832 | Critical | 9.8 | 2024-10-16 | The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and including, 7.3 to 8.6. This makes it possible… |
CVE-2024-38139 | High | 8.7 | 2024-10-15 | Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. |
CVE-2024-47080 | | 2024-10-15 | matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method `MatrixClient… | |
CVE-2024-45148 | High | 8.8 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a sec… |
CVE-2024-45115 | Critical | 9.8 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in privi… |
CVE-2024-38124 | Critical | 9.0 | 2024-10-08 | Windows Netlogon Elevation of Privilege Vulnerability |
CVE-2024-41798 | Critical | 9.8 | 2024-10-08 | A vulnerability has been identified in SENTRON 7KM PAC3200 (All versions). Affected devices only provide a 4-digit PIN to protect from administrative access vi… |
CVE-2024-45051 | High | 8.2 | 2024-10-07 | Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions… |
CVE-2024-47768 | High | 8.1 | 2024-10-04 | Lif Authentication Server is a server used by Lif to do various tasks regarding Lif accounts. This vulnerability has to do with the account recovery system whe… |
CVE-2024-41589 | High | 8.8 | 2024-10-03 | DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests. |
CVE-2024-47807 | High | 8.1 | 2024-10-02 | Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to sub… |
CVE-2024-47806 | High | 8.1 | 2024-10-02 | Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to s… |
CVE-2024-47070 | Critical | 9.0 | 2024-09-27 | authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding… |