CWE-287 · Improper Authentication (page 16)
Page 16 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5326 | Medium | 6.3 | 2023-10-01 | A vulnerability was found in SATO CL4NX-J Plus 1.13.2-u455_r2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2023-43660 | Medium | 4.8 | 2023-09-27 | Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by s… |
CVE-2023-42818 | Medium | 5.4 | 2023-09-27 | JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding… |
CVE-2023-20252 | Critical | 9.8 | 2023-09-27 | A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker… |
CVE-2023-44152 | Critical | 9.1 | 2023-09-27 | Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Linux, macOS… |
CVE-2023-41904 | Medium | 5.4 | 2023-09-27 | Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs. |
CVE-2023-31015 | Medium | 6.6 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication issue. A successful exploit of this vul… |
CVE-2023-4094 | Medium | 6.5 | 2023-09-19 | ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate acco… |
CVE-2023-0773 | Critical | 9.1 | 2023-09-19 | The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remote attacker could e… |
CVE-2023-42442 | High | 8.2 | 2023-09-15 | JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3… |
CVE-2023-41900 | Low | 3.5 | 2023-09-15 | Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `Op… |
CVE-2023-0813 | High | 7.5 | 2023-09-15 | A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is n… |
CVE-2022-47848 | High | 7.5 | 2023-09-15 | An issue was discovered in Bezeq Vtech NB403-IL version BZ_2.02.07.09.13.01 and Vtech IAD604-IL versions BZ_2.02.07.09.13.01, BZ_2.02.07.09.13T, and BZ_2.02.07… |
CVE-2023-4985 | Medium | 5.9 | 2023-09-15 | A vulnerability classified as critical has been found in Supcon InPlant SCADA up to 20230901. Affected is an unknown function of the file Project.xml. The mani… |
CVE-2023-4669 | Critical | 9.8 | 2023-09-14 | Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass. This issue affects SYSGuard 3001: before… |
CVE-2023-4568 | Medium | 6.5 | 2023-09-13 | PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may al… |
CVE-2023-39215 | High | 7.1 | 2023-09-12 | Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
CVE-2023-4501 | Critical | 9.8 | 2023-09-12 | User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enter… |
CVE-2023-29463 | High | 8.8 | 2023-09-12 | The JMX Console within the Rockwell Automation Pavilion8 is exposed to application users and does not require authentication. If exploited, a malicious user c… |
CVE-2023-39069 | Critical | 9.8 | 2023-09-11 | An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism. |
CVE-2023-4816 | Medium | 6.9 | 2023-09-11 | A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password validation in T214. This vulnerability… |
CVE-2021-27715 | Critical | 9.8 | 2023-09-08 | An issue was discovered in MoFi Network MOFI4500-4GXeLTE-V2 3.5.6-xnet-5052 allows attackers to bypass the authentication and execute arbitrary code via crafte… |
CVE-2023-20238 | Critical | 10.0 | 2023-09-06 | A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform cou… |
CVE-2023-4498 | Medium | 5.3 | 2023-09-06 | Tenda N300 Wireless N VDSL2 Modem Router allows unauthenticated access to pages that in turn should be accessible to authenticated users only |
CVE-2023-37284 | High | 8.8 | 2023-09-06 | Improper authentication vulnerability in Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616' allows a network-adjacent unauthenticated attacker to… |
CVE-2023-30725 | Medium | 5.1 | 2023-09-06 | Improper authentication in LocalProvier of Gallery prior to version 14.5.01.2 allows attacker to access the data in content provider. |
CVE-2023-30724 | Medium | 4.0 | 2023-09-06 | Improper authentication in GallerySearchProvider of Gallery prior to version 14.5.01.2 allows attacker to access search history. |
CVE-2023-30708 | Medium | 4.6 | 2023-09-06 | Improper authentication in SecSettings prior to SMR Sep-2023 Release 1 allows attacker to access Captive Portal Wi-Fi in Reactivation Lock status. |
CVE-2023-34998 | High | 8.1 | 2023-09-05 | An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series… |
CVE-2023-31242 | High | 8.1 | 2023-09-05 | An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series… |
CVE-2023-39981 | High | 7.5 | 2023-09-02 | A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1. This vulnerability arises from inadequate authe… |
CVE-2023-41751 | Medium | 5.5 | 2023-08-31 | Sensitive information disclosure due to improper token expiration validation. The following products are affected: Acronis Agent (Windows) before build 32047. |
CVE-2023-35785 | High | 8.1 | 2023-08-28 | Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7… |
CVE-2023-32202 | Medium | 6.5 | 2023-08-23 | Walchem Intuition 9 firmware versions prior to v4.21 are vulnerable to improper authentication. Login credentials are stored in a format that could allow an at… |
CVE-2023-40282 | Medium | 5.4 | 2023-08-23 | Improper authentication vulnerability in Rakuten WiFi Pocket all versions allows a network-adjacent attacker to log in to the product's Management Screen. As a… |
CVE-2023-38585 | High | 8.8 | 2023-08-23 | Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its… |
CVE-2023-25913 | High | 7.5 | 2023-08-21 | Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, u… |
CVE-2023-4373 | Critical | 9.8 | 2023-08-21 | Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a… |
CVE-2023-4415 | High | 7.3 | 2023-08-18 | A vulnerability was found in Ruijie RG-EW1200G 07161417 r483. It has been rated as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2023-39415 | High | 7.5 | 2023-08-18 | Improper authentication vulnerability in Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail… |
CVE-2023-33237 | High | 8.8 | 2023-08-17 | TN-5900 Series firmware version v3.3 and prior is vulnerable to improper-authentication vulnerability. This vulnerability arises from inadequate authentication… |
CVE-2023-39846 | Critical | 9.8 | 2023-08-16 | An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token. |
CVE-2023-32453 | Medium | 4.6 | 2023-08-16 | Dell BIOS contains an improper authentication vulnerability. A malicious user with physical access to the system may potentially exploit this vulnerability in… |
CVE-2023-35082 | Critical | 9.8 | 2023-08-15 | An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the applica… |
CVE-2023-40020 | Critical | 9.9 | 2023-08-14 | PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctl… |
CVE-2023-3263 | High | 7.5 | 2023-08-14 | The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of spec… |
CVE-2023-39380 | High | 7.5 | 2023-08-13 | Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause audio devices to perform abnormally. |
CVE-2023-40260 | Critical | 9.1 | 2023-08-11 | EmpowerID before 7.205.0.1 allows an attacker to bypass an MFA (multi factor authentication) requirement if the first factor (username and password) is known… |
CVE-2023-40253 | Medium | 6.0 | 2023-08-11 | Improper Authentication vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Authentica… |
CVE-2023-39531 | Medium | 6.5 | 2023-08-09 | Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 23.7.2, an attacker with sufficient client-sid… |
CVE-2023-4242 | Medium | 4.3 | 2023-08-09 | The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to impr… |
CVE-2023-21626 | High | 7.1 | 2023-08-08 | Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key. |
CVE-2023-36926 | Low | 3.7 | 2023-08-08 | Due to missing authentication check in SAP Host Agent - version 7.22, an unauthenticated attacker can set an undocumented parameter to a particular compatibili… |
CVE-2023-39349 | High | 8.1 | 2023-08-07 | Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token wit… |
CVE-2023-32090 | Critical | 9.8 | 2023-08-07 | Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials |
CVE-2023-0264 | Medium | 5.0 | 2023-08-04 | A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain infor… |
CVE-2023-39112 | Medium | 6.5 | 2023-08-04 | ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel. |
CVE-2023-38691 | Medium | 5.0 | 2023-08-04 | matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can… |
CVE-2023-20214 | Critical | 9.1 | 2023-08-03 | A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to g… |
CVE-2023-33363 | High | 7.5 | 2023-08-03 | An authentication bypass vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated users to access some functionality on BioStar 2 s… |
CVE-2023-34196 | High | 8.2 | 2023-08-03 | In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue… |
CVE-2023-1935 | Critical | 9.4 | 2023-08-02 | ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the devic… |
CVE-2023-3470 | Medium | 6.0 | 2023-08-02 | Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the p… |
CVE-2023-33563 | High | 8.8 | 2023-08-01 | In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attack… |
CVE-2023-3622 | Medium | 4.3 | 2023-07-26 | Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to read arbitrary resource |
CVE-2023-38555 | High | 8.8 | 2023-07-26 | Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change… |
CVE-2023-2626 | High | 7.5 | 2023-07-25 | There exists an authentication bypass vulnerability in OpenThread border router devices and implementations. This issue allows unauthenticated nodes to craft r… |
CVE-2023-35078 | Critical | 9.8 | 2023-07-25 | An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without prop… |
CVE-2023-37918 | Medium | 6.8 | 2023-07-21 | Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypas… |
CVE-2023-37471 | Critical | 9.1 | 2023-07-20 | Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Se… |
CVE-2023-3638 | Critical | 9.8 | 2023-07-19 | In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application. |
CVE-2023-27877 | Medium | 5.3 | 2023-07-19 | IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB se… |
CVE-2022-34155 | High | 8.8 | 2023-07-18 | Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Sing… |
CVE-2023-37266 | Critical | 9.8 | 2023-07-17 | CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and… |
CVE-2023-3591 | Medium | 4.8 | 2023-07-17 | Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created. |
CVE-2023-2959 | High | 7.5 | 2023-07-17 | Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users. This issue affects Ol… |
CVE-2023-35901 | Low | 2.7 | 2023-07-17 | IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could allow invalid chang… |
CVE-2023-37268 | Medium | 6.4 | 2023-07-14 | Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may au… |
CVE-2023-36466 | Low | 3.5 | 2023-07-14 | Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for t… |
CVE-2023-2975 | Medium | 5.3 | 2023-07-14 | Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequen… |
CVE-2023-30560 | Medium | 6.8 | 2023-07-13 | The configuration from the PCU can be modified without authentication using physical connection to the PCU. |
CVE-2023-30559 | Medium | 5.2 | 2023-07-13 | The firmware update package for the wireless card is not properly signed and can be modified. |
CVE-2023-34137 | Critical | 9.8 | 2023-07-13 | SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerabil… |
CVE-2023-34124 | Critical | 9.8 | 2023-07-13 | The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2… |
CVE-2023-33274 | Critical | 9.8 | 2023-07-12 | The authentication mechanism in PowerShield SNMP Web Pro 1.1 contains a vulnerability that allows unauthenticated users to directly access Common Gateway Inter… |
CVE-2023-31007 | Unrated | | 2023-07-12 | Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication dat… |
CVE-2023-3127 | High | 7.5 | 2023-07-11 | An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights. |
CVE-2023-31190 | High | 8.1 | 2023-07-11 | DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an Improper Authentication vulnerability during the firmware update procedure. Sp… |
CVE-2023-30675 | Medium | 6.2 | 2023-07-06 | Improper authentication in Samsung Pass prior to version 4.2.03.1 allows local attacker to access stored account information when Samsung Wallet is not install… |
CVE-2023-35940 | High | 7.5 | 2023-07-05 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an u… |
CVE-2023-32620 | Medium | 6.5 | 2023-06-30 | Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireles… |
CVE-2023-33190 | Critical | 9.9 | 2023-06-29 | Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration… |
CVE-2023-32222 | Critical | 9.8 | 2023-06-28 | D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method. |
CVE-2023-20199 | Medium | 6.2 | 2023-06-28 | A vulnerability in Cisco Duo Two-Factor Authentication for macOS could allow an authenticated, physical attacker to bypass secondary authentication and access… |
CVE-2023-30945 | Critical | 9.8 | 2023-06-26 | Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary… |
CVE-2023-32524 | High | 8.8 | 2023-06-26 | Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentia… |
CVE-2023-32523 | High | 8.8 | 2023-06-26 | Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentia… |
CVE-2023-35154 | High | 7.2 | 2023-06-23 | Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can register and activat… |
CVE-2023-28073 | High | 8.2 | 2023-06-23 | Dell BIOS contains an improper authentication vulnerability. A locally authenticated malicious user may potentially exploit this vulnerability by bypassing ce… |
CVE-2023-3326 | Critical | 9.8 | 2023-06-22 | pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Ce… |