CWE-287 · Improper Authentication (page 16)
Page 16 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47174 | Medium | 5.9 | 2024-09-26 | Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, `<nix/fetchurl.nix>` did not verif… |
CVE-2024-47127 | Medium | 6.5 | 2024-09-26 | In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio… |
CVE-2024-47125 | High | 8.1 | 2024-09-26 | The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages. It is advised to update your app to th… |
CVE-2024-45042 | Medium | 4.4 | 2024-09-26 | Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the `highest_… |
CVE-2024-45750 | High | 7.3 | 2024-09-25 | An issue in TheGreenBow Windows Standard VPN Client 6.87.108 (and older), Windows Enterprise VPN Client 6.87.109 (and older), Windows Enterprise VPN Client 7.5… |
CVE-2024-47078 | High | 8.1 | 2024-09-25 | Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a shared or private MQT… |
CVE-2024-0002 | Critical | 10.0 | 2024-09-23 | A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array. |
CVE-2024-47218 | Critical | 9.8 | 2024-09-22 | An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows bypassing authentication. |
CVE-2022-25768 | High | 7.0 | 2024-09-18 | The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to t… |
CVE-2024-34399 | Critical | 9.8 | 2024-09-18 | **UNSUPPORTED WHEN ASSIGNED** An issue was discovered in BMC Remedy Mid Tier 7.6.04. An unauthenticated remote attacker is able to access any user account with… |
CVE-2024-41929 | High | 8.8 | 2024-09-18 | Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to… |
CVE-2024-8956 | Critical | 9.1 | 2024-09-17 | PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to… |
CVE-2024-44202 | Medium | 5.3 | 2024-09-17 | An authentication issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18. Private Browsing tabs may be acce… |
CVE-2024-44127 | Medium | 5.3 | 2024-09-17 | This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18. Private Browsing tabs may be… |
CVE-2024-45113 | High | 7.5 | 2024-09-13 | ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker… |
CVE-2024-45823 | High | 8.1 | 2024-09-12 | CVE-2024-45823 IMPACT An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts… |
CVE-2024-8642 | High | 8.1 | 2024-09-11 | In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token val… |
CVE-2024-38225 | High | 8.8 | 2024-09-10 | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability |
CVE-2023-37226 | Critical | 9.8 | 2024-09-10 | Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function. |
CVE-2024-40713 | High | 7.8 | 2024-09-07 | A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) set… |
CVE-2023-45038 | Medium | 4.3 | 2024-09-06 | An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the securit… |
CVE-2024-5957 | Medium | 6.3 | 2024-09-05 | This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager. |
CVE-2024-5956 | Medium | 6.5 | 2024-09-05 | This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix IPS Manager with gar… |
CVE-2024-44821 | Medium | 5.3 | 2024-09-04 | ZZCMS 2023 contains a vulnerability in the captcha reuse logic located in /inc/function.php. The checkyzm function does not properly refresh the captcha value… |
CVE-2024-7923 | Critical | 9.8 | 2024-09-04 | An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configura… |
CVE-2024-7012 | Critical | 9.8 | 2024-09-04 | An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This… |
CVE-2024-7870 | Medium | 6.5 | 2024-09-04 | The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in al… |
CVE-2024-7346 | High | 7.2 | 2024-09-03 | Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked co… |
CVE-2024-7745 | Medium | 6.5 | 2024-08-28 | In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the s… |
CVE-2024-45346 | High | 8.8 | 2024-08-28 | The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initiative! At the same t… |
CVE-2024-8181 | Critical | 9.8 | 2024-08-27 | An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an admin… |
CVE-2024-45036 | Medium | 4.3 | 2024-08-26 | Tophat is a mobile applications testing harness. An Improper Access Control vulnerability can expose the `TOPHAT_APP_TOKEN` token stored in `~/.tophatrc` throu… |
CVE-2024-7401 | High | 7.5 | 2024-08-26 | Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. S… |
CVE-2024-36444 | High | 8.1 | 2024-08-22 | cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an unauthenticated attacker to gain access to device logs. |
CVE-2024-43409 | Medium | 6.5 | 2024-08-20 | Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only… |
CVE-2024-42336 | High | 8.2 | 2024-08-20 | Servision - CWE-287: Improper Authentication |
CVE-2024-38810 | Medium | 6.5 | 2024-08-20 | Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective. |
CVE-2024-43240 | Critical | 9.4 | 2024-08-19 | Improper Authentication vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a through <=… |
CVE-2024-42462 | Critical | 9.8 | 2024-08-16 | Improper Authentication vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Bypass.This issue affects upKeeper Manager: through… |
CVE-2024-31800 | Medium | 6.8 | 2024-08-15 | Authentication Bypass in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to gain a privileged command shell via the UART Debugg… |
CVE-2024-6078 | | 2024-08-14 | CVE-2024-6078 IMPACT An improper authentication vulnerability exists in the affected product, which could allow a malicious user to generate cookies for any u… | |
CVE-2024-37028 | Medium | 5.3 | 2024-08-14 | BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Tech… |
CVE-2024-25157 | Medium | 6.5 | 2024-08-14 | An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission check… |
CVE-2024-7593 | Critical | 9.8 | 2024-08-13 | Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass a… |
CVE-2024-7746 | Critical | 9.8 | 2024-08-13 | Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the… |
CVE-2024-35775 | Medium | 5.9 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Authentication vulnerability in Soliloquy Team Slider by… |
CVE-2024-42164 | Medium | 4.3 | 2024-08-12 | Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by pr… |
CVE-2024-4784 | Medium | 4.2 | 2024-08-08 | An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the pas… |
CVE-2024-42038 | High | 8.8 | 2024-08-08 | Vulnerability of PIN enhancement failures in the screen lock module Impact: Successful exploitation of this vulnerability may affect service confidentiality, i… |
CVE-2024-36132 | High | 7.5 | 2024-08-07 | Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources. |
CVE-2024-36130 | Critical | 9.8 | 2024-08-07 | An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary… |
CVE-2024-34788 | Medium | 6.5 | 2024-08-07 | An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive information |
CVE-2024-7395 | | 2024-08-05 | An authentication bypass vulnerability in Korenix JetPort 5601v3 allows an attacker to access functionality on the device without specifying a password.This is… | |
CVE-2022-4002 | High | 7.2 | 2024-07-31 | A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request. |
CVE-2022-4001 | High | 7.3 | 2024-07-31 | An authentication bypass vulnerability could allow an attacker to access API functions without authentication. |
CVE-2019-6198 | High | 7.8 | 2024-07-31 | A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges. |
CVE-2019-6197 | High | 7.8 | 2024-07-31 | A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges. |
CVE-2024-40794 | Medium | 5.3 | 2024-07-29 | This issue was addressed through improved state management. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. Private Browsing t… |
CVE-2024-40778 | Low | 3.3 | 2024-07-29 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sono… |
CVE-2024-6576 | High | 7.3 | 2024-07-29 | Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023… |
CVE-2024-7050 | | 2024-07-26 | Improper Authentication vulnerability in OpenText OpenText Directory Services may allow Multi-factor Authentication Bypass in particular scenarios.This issue a… | |
CVE-2024-41800 | Medium | 4.8 | 2024-07-25 | Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit… |
CVE-2024-41829 | Low | 3.5 | 2024-07-22 | In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection |
CVE-2024-40648 | Medium | 5.4 | 2024-07-18 | matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before… |
CVE-2024-28992 | High | 7.6 | 2024-07-17 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenti… |
CVE-2024-23471 | Critical | 9.6 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authentic… |
CVE-2024-23470 | Critical | 9.6 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to a pre-authentication remote code execution vulnerability. If exploited, this vulnerability… |
CVE-2024-23465 | High | 8.3 | 2024-07-17 | The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user t… |
CVE-2024-6535 | Medium | 5.3 | 2024-07-17 | A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-pro… |
CVE-2024-22442 | Critical | 9.8 | 2024-07-16 | The vulnerability could be remotely exploited to bypass authentication. |
CVE-2024-39767 | Medium | 4.2 | 2024-07-15 | Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a m… |
CVE-2024-39340 | High | 8.8 | 2024-07-12 | The authentication system of Securepoint UTM mishandles OTP keys. This allows the bypassing of second-factor verification (when OTP is enabled) in both the adm… |
CVE-2024-38433 | Medium | 6.7 | 2024-07-11 | Nuvoton - CWE-305: Authentication Bypass by Primary Weakness An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton… |
CVE-2024-6397 | Critical | 9.8 | 2024-07-11 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44… |
CVE-2024-6235 | High | 8.8 | 2024-07-10 | Sensitive information disclosure in NetScaler Console |
CVE-2024-38099 | Medium | 5.9 | 2024-07-09 | Windows Remote Desktop Licensing Service Denial of Service Vulnerability |
CVE-2024-39723 | Medium | 4.6 | 2024-07-08 | IBM FlashSystem 5300 USB ports may be usable even if the port has been disabled by the administrator. A user with physical access to the system could use the U… |
CVE-2024-39830 | High | 8.1 | 2024-07-03 | Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled, fail to use constant time comparison f… |
CVE-2024-3826 | | 2024-07-02 | In versions of Akana in versions prior to and including 2022.1.3 validation is broken when using the SAML Single Sign-On (SSO) functionality. | |
CVE-2024-34596 | Medium | 5.9 | 2024-07-02 | Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the owner. |
CVE-2024-20900 | Medium | 4.0 | 2024-07-02 | Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentication. |
CVE-2024-20890 | Medium | 5.3 | 2024-07-02 | Improper input validation in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to trigger abnormal behavior. |
CVE-2024-20889 | Medium | 5.9 | 2024-07-02 | Improper authentication in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to pair with devices. |
CVE-2024-28200 | Critical | 9.1 | 2024-07-01 | The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 20… |
CVE-2024-38523 | High | 7.5 | 2024-06-27 | Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that we… |
CVE-2024-23767 | High | 8.8 | 2024-06-26 | An issue was discovered on HMS Anybus X-Gateway AB7832-F firmware version 3. The HICP protocol allows unauthenticated changes to a device's network configurati… |
CVE-2024-27867 | Medium | 4.3 | 2024-06-26 | An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Be… |
CVE-2024-5012 | High | 8.6 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, there is a missing authentication vulnerability in WUGDataAccess.Credentials. This vulnerability allows unau… |
CVE-2024-5806 | Critical | 9.1 | 2024-06-25 | Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023… |
CVE-2024-5805 | Critical | 9.1 | 2024-06-25 | Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0. |
CVE-2024-37085 | Medium | 6.8 | 2024-06-25 | VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESX… |
CVE-2024-37233 | Medium | 4.3 | 2024-06-24 | Improper Authentication vulnerability in Play.Ht allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Play.Ht: from n/a through 3… |
CVE-2024-24554 | High | 8.2 | 2024-06-24 | Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allow… |
CVE-2024-37897 | Medium | 5.4 | 2024-06-20 | SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. SFTPGo WebAdmin and WebClient s… |
CVE-2024-5432 | Critical | 9.8 | 2024-06-20 | The Lifeline Donation plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.6. This is due to insufficient verifica… |
CVE-2024-38351 | Medium | 5.4 | 2024-06-18 | Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exp… |
CVE-2024-37893 | Medium | 5.9 | 2024-06-17 | Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to b… |
CVE-2024-6057 | Critical | 9.8 | 2024-06-17 | Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an… |
CVE-2024-27275 | High | 7.4 | 2024-06-15 | IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local user without administ… |
CVE-2024-37368 | High | 7.5 | 2024-06-14 | A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote system with FTView to… |