CWE-287 · Improper Authentication (page 17)
Page 17 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-34340 | Critical | 9.8 | 2023-06-21 | Improper Authentication vulnerability in Apache Software Foundation Apache Accumulo. This issue affects Apache Accumulo: 2.1.0. Accumulo 2.1.0 contains a defe… |
CVE-2023-3337 | High | 7.3 | 2023-06-20 | A vulnerability was found in PuneethReddyHC Online Shopping System Advanced 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2022-48496 | High | 7.5 | 2023-06-19 | Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to bec… |
CVE-2022-48494 | High | 7.5 | 2023-06-19 | Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to bec… |
CVE-2023-30223 | High | 7.5 | 2023-06-16 | A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to send crafted TCP packets containing reques… |
CVE-2023-34367 | Medium | 6.5 | 2023-06-14 | Windows 7 is vulnerable to a full blind TCP/IP hijacking attack. The vulnerability exists in Windows 7 (any Windows until Windows 8) and in any implementation… |
CVE-2023-2638 | Medium | 5.9 | 2023-06-13 | Rockwell Automation's FactoryTalk System Services does not verify that a backup configuration archive is password protected. Improper authorization in FTS… |
CVE-2023-20867 | Low | 3.9 | 2023-06-13 | A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest… |
CVE-2023-30762 | Critical | 9.8 | 2023-06-13 | Improper authentication vulnerability exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed o… |
CVE-2023-29129 | Critical | 9.1 | 2023-06-13 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >… |
CVE-2023-32220 | High | 8.2 | 2023-06-12 | Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method. |
CVE-2023-34246 | Medium | 4.2 | 2023-06-12 | Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user con… |
CVE-2023-33553 | Critical | 9.8 | 2023-06-07 | An issue in Planet Technologies WDRT-1800AX v1.01-CP21 allows attackers to bypass authentication and escalate privileges to root via manipulation of the LoginS… |
CVE-2023-32682 | Medium | 5.4 | 2023-06-06 | Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login w… |
CVE-2022-40536 | High | 7.5 | 2023-06-06 | Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network. |
CVE-2022-40521 | High | 7.5 | 2023-06-06 | Transient DOS due to improper authorization in Modem |
CVE-2023-3065 | Critical | 9.1 | 2023-06-05 | Improper Authentication vulnerability in Mobatime mobile application AMXGT100 allows Authentication Bypass.This issue affects Mobatime mobile application AMXGT… |
CVE-2023-3069 | Critical | 9.8 | 2023-06-02 | Unverified Password Change in GitHub repository tsolucio/corebos prior to 8. |
CVE-2023-3028 | High | 8.6 | 2023-06-01 | Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles us… |
CVE-2023-2283 | Medium | 6.5 | 2023-05-26 | A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memo… |
CVE-2023-0117 | Medium | 5.3 | 2023-05-26 | The online authentication provided by the hwKitAssistant lacks strict identity verification of applications. Successful exploitation of this vulnerability may… |
CVE-2023-27388 | Critical | 9.8 | 2023-05-23 | Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to login to the prod… |
CVE-2023-25946 | High | 8.8 | 2023-05-23 | Authentication bypass vulnerability in Qrio Lock (Q-SL2) firmware version 2.0.9 and earlier allows a network-adjacent attacker to analyze the product's communi… |
CVE-2023-2586 | Critical | 9.0 | 2023-05-22 | Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices through the RMS pla… |
CVE-2023-32347 | High | 8.1 | 2023-05-22 | Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the user perspective for de… |
CVE-2023-2024 | Critical | 10.0 | 2023-05-18 | Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstanc… |
CVE-2023-0863 | High | 8.8 | 2023-05-17 | Improper Authentication vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC… |
CVE-2023-2706 | High | 8.1 | 2023-05-17 | The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes f… |
CVE-2023-2499 | Critical | 9.8 | 2023-05-16 | The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verifi… |
CVE-2023-23450 | Medium | 6.2 | 2023-05-15 | Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524… |
CVE-2023-32081 | Medium | 6.5 | 2023-05-12 | Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4… |
CVE-2023-27823 | Critical | 9.8 | 2023-05-12 | An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials. |
CVE-2023-32243 | Critical | 9.8 | 2023-05-12 | Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elemen… |
CVE-2023-29032 | High | 8.1 | 2023-05-12 | An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected… |
CVE-2023-28325 | Medium | 6.5 | 2023-05-11 | An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage metho… |
CVE-2023-0858 | Low | 3.1 | 2023-05-11 | Improper Authentication of RemoteUI of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to… |
CVE-2023-31152 | Medium | 4.0 | 2023-05-10 | An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC)… |
CVE-2022-41985 | High | 8.6 | 2023-05-10 | An authentication bypass vulnerability exists in the Authentication functionality of Weston Embedded uC-FTPs v 1.98.00. A specially crafted set of network pack… |
CVE-2022-44610 | Medium | 5.4 | 2023-05-10 | Improper authentication in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via netwo… |
CVE-2023-27919 | Medium | 5.3 | 2023-05-10 | Authentication bypass vulnerability in NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) all versions allows a remote unauthenticated attacker to alter t… |
CVE-2023-28125 | Medium | 5.9 | 2023-05-09 | An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to the server by regi… |
CVE-2023-31127 | Critical | 9.0 | 2023-05-08 | libspdm is a sample implementation that follows the DMTF SPDM specifications. A vulnerability has been identified in SPDM session establishment in libspdm prio… |
CVE-2023-31123 | Critical | 9.1 | 2023-05-08 | `effectindex/tripreporter` is a community-powered, universal platform for submitting and analyzing trip reports. Prior to commit bd80ba833b9023d39ca22e29874296… |
CVE-2023-28182 | Medium | 6.5 | 2023-05-08 | The issue was addressed with improved authentication. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS… |
CVE-2023-30328 | Critical | 9.8 | 2023-05-04 | An issue in the helper tool of Mailbutler GmbH Shimo VPN Client for macOS v5.0.4 allows attackers to bypass authentication via PID re-use. |
CVE-2023-21487 | Medium | 5.1 | 2023-05-04 | Improper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows local attackers to change a call setting. |
CVE-2023-21484 | Medium | 5.1 | 2023-05-04 | Improper access control vulnerability in AppLock prior to SMR May-2023 Release 1 allows local attackers without proper permission to execute a privileged opera… |
CVE-2022-45860 | Medium | 5.3 | 2023-05-03 | A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versi… |
CVE-2022-30995 | High | 7.5 | 2023-05-03 | Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29… |
CVE-2023-30869 | Critical | 9.8 | 2023-05-02 | Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1… |
CVE-2022-35898 | Critical | 9.8 | 2023-05-01 | OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation. This allows any authenticated user to change the p… |
CVE-2023-30063 | High | 7.5 | 2023-05-01 | D-Link DIR-890L FW1.10 A1 is vulnerable to Authentication bypass. |
CVE-2023-30061 | High | 7.5 | 2023-05-01 | D-Link DIR-879 v105A1 is vulnerable to Authentication Bypass via phpcgi. |
CVE-2023-1477 | High | 7.2 | 2023-04-28 | Improper Authentication vulnerability in HYPR Keycloak Authenticator Extension allows Authentication Abuse.This issue affects HYPR Keycloak Authenticator Exten… |
CVE-2023-28473 | Low | 3.3 | 2023-04-28 | Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section. |
CVE-2023-1778 | Critical | 10.0 | 2023-04-27 | This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default credentials which allows… |
CVE-2023-2297 | Critical | 9.8 | 2023-04-27 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and includi… |
CVE-2023-30845 | High | 8.2 | 2023-04-26 | ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 contains an authentication… |
CVE-2022-45456 | High | 7.5 | 2023-04-26 | Denial of service due to unauthenticated API endpoint. The following products are affected: Acronis Agent (Windows, macOS, Linux) before build 30161. |
CVE-2022-40723 | Medium | 6.5 | 2023-04-25 | The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations. |
CVE-2023-25131 | Critical | 9.4 | 2023-04-24 | Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and… |
CVE-2023-0209 | High | 8.2 | 2023-04-22 | NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary… |
CVE-2023-27351 | High | 7.5 | 2023-04-20 | This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not requir… |
CVE-2023-25601 | Medium | 4.3 | 2023-04-20 | On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack wit… |
CVE-2023-22893 | High | 7.5 | 2023-04-19 | Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A rem… |
CVE-2023-25556 | High | 8.3 | 2023-04-18 | A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the at… |
CVE-2021-40507 | Critical | 9.8 | 2023-04-18 | An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not being updated corre… |
CVE-2021-40506 | Critical | 9.8 | 2023-04-18 | An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not being updated for t… |
CVE-2023-28973 | High | 7.1 | 2023-04-17 | An Improper Authorization vulnerability in the 'sysmanctl' shell command of Juniper Networks Junos OS Evolved allows a local, authenticated attacker to execute… |
CVE-2023-28963 | Medium | 5.3 | 2023-04-17 | An Improper Authentication vulnerability in cert-mgmt.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based at… |
CVE-2023-28962 | Medium | 5.3 | 2023-04-17 | An Improper Authentication vulnerability in upload-file.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based… |
CVE-2023-24831 | Critical | 9.8 | 2023-04-17 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3… |
CVE-2022-48314 | Medium | 6.5 | 2023-04-16 | The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect co… |
CVE-2023-2027 | Critical | 9.8 | 2023-04-15 | The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is due to insufficient v… |
CVE-2023-25597 | Medium | 5.9 | 2023-04-14 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a cra… |
CVE-2023-1833 | Critical | 9.8 | 2023-04-14 | Authentication Bypass by Primary Weakness vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass. This issue affects Redline Ro… |
CVE-2023-1803 | Critical | 9.8 | 2023-04-14 | Authentication Bypass by Alternate Name vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass. This issue affects Redline Rout… |
CVE-2022-45174 | Critical | 9.8 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication for SAML Users can occur under the /login/backup_cod… |
CVE-2022-45173 | Critical | 9.8 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /api/v1/vdeskintegration/challen… |
CVE-2023-1617 | Critical | 9.8 | 2023-04-14 | Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based… |
CVE-2023-28121 | Critical | 9.8 | 2023-04-12 | An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated u… |
CVE-2023-1980 | Medium | 6.5 | 2023-04-11 | Two factor authentication bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to cancel the two factor authentication via… |
CVE-2023-23761 | High | 7.7 | 2023-04-07 | An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users' secret gists by a… |
CVE-2023-27091 | High | 7.2 | 2023-04-04 | An unauthorized access issue found in XiaoBingby TeaCMS 2.3.3 allows attackers to escalate privileges via the id and keywords parameter(s). |
CVE-2023-1752 | High | 8.1 | 2023-04-04 | The listed versions of Nexx Smart Home devices could allow any user to register an already registered alarm or associated device with only the device’s MAC add… |
CVE-2021-28235 | Critical | 9.8 | 2023-04-04 | Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function. |
CVE-2023-1784 | Medium | 5.3 | 2023-03-31 | A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The ma… |
CVE-2023-28862 | Critical | 9.8 | 2023-03-31 | An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password ch… |
CVE-2023-28727 | Critical | 9.6 | 2023-03-31 | Panasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass authentication due to mishandling of X-Forwarded-For headers. |
CVE-2023-27538 | Medium | 5.5 | 2023-03-30 | An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH o… |
CVE-2023-27536 | Medium | 5.9 | 2023-03-30 | An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect… |
CVE-2023-27535 | Medium | 5.9 | 2023-03-30 | An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subs… |
CVE-2023-28647 | Medium | 4.4 | 2023-03-30 | Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access… |
CVE-2023-28646 | Medium | 4.4 | 2023-03-30 | Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has acc… |
CVE-2023-28503 | Critical | 9.8 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication… |
CVE-2022-43620 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not… |
CVE-2023-28398 | Critical | 9.8 | 2023-03-28 | Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication, thereby gaining unauthorized access to… |
CVE-2022-4126 | Critical | 9.6 | 2023-03-27 | Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: befo… |
CVE-2023-21027 | High | 7.5 | 2023-03-24 | In multiple functions of PasspointXmlUtils.java, there is a possible authentication misconfiguration due to a logic error in the code. This could lead to remot… |
CVE-2022-45124 | High | 7.5 | 2023-03-20 | An information disclosure vulnerability exists in the User authentication functionality of WellinTech KingHistorian 35.01.00.05. A specially crafted network pa… |