CWE-287 · Improper Authentication (page 17)
Page 17 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-37367 | High | 7.5 | 2024-06-14 | A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE v12. The vulnerability allows a user from a remote system with FTVie… |
CVE-2024-37313 | High | 7.3 | 2024-06-14 | Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providin… |
CVE-2024-3080 | Critical | 9.8 | 2024-06-14 | Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device. |
CVE-2024-22441 | Critical | 9.8 | 2024-06-13 | HPE Cray Parallel Application Launch Service (PALS) is subject to an authentication bypass. |
CVE-2024-30299 | Critical | 10.0 | 2024-06-13 | Adobe Framemaker Publishing Server versions 2020.3, 2022.2 and earlier are affected by an Improper Authentication vulnerability that could result in privilege… |
CVE-2024-34103 | High | 8.1 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege… |
CVE-2024-5798 | Low | 2.6 | 2024-06-12 | Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have res… |
CVE-2024-36264 | Critical | 9.8 | 2024-06-12 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils. If the user doesn't explicitly set `submarine.auth.de… |
CVE-2024-35248 | High | 7.3 | 2024-06-11 | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability |
CVE-2024-36266 | Critical | 9.3 | 2024-06-11 | A vulnerability has been identified in PowerSys (All versions < V3.11). The affected application insufficiently protects responses to authentication requests… |
CVE-2024-23251 | Medium | 4.6 | 2024-06-10 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sono… |
CVE-2022-45168 | Medium | 6.5 | 2024-06-10 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /login/backup_code endpoint and… |
CVE-2024-37408 | High | 7.3 | 2024-06-08 | fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by "auth sufficient pam_fprintd.so" for Sudo. NOTE… |
CVE-2024-5732 | High | 7.3 | 2024-06-07 | A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Po… |
CVE-2024-37152 | Medium | 5.3 | 2024-06-06 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /a… |
CVE-2024-5658 | Medium | 4.8 | 2024-06-06 | The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period. |
CVE-2023-50804 | Low | 3.7 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor, and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2… |
CVE-2024-35670 | Medium | 5.3 | 2024-06-04 | Broken Authentication vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.93. |
CVE-2023-51511 | Medium | 6.5 | 2024-06-04 | Improper Authentication vulnerability in Pluggabl LLC Booster Elite for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue… |
CVE-2023-48747 | Medium | 6.5 | 2024-06-04 | Improper Authentication vulnerability in Pluggabl LLC Booster for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affect… |
CVE-2023-47189 | Medium | 5.3 | 2024-06-04 | Improper Authentication vulnerability in WPMU DEV Defender Security allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Defender… |
CVE-2023-46630 | High | 7.5 | 2024-06-04 | Improper Authentication vulnerability in wpase Admin and Site Enhancements (ASE) allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff… |
CVE-2024-37019 | Critical | 9.8 | 2024-06-03 | Northern.tech Mender Enterprise before 3.6.4 and 3.7.x before 3.7.4 has Weak Authentication. |
CVE-2023-43551 | Critical | 9.1 | 2024-06-03 | Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode C… |
CVE-2024-5201 | High | 8.8 | 2024-05-23 | Privilege Escalation in OpenText Dimensions RM allows an authenticated user to escalate there privilege to the privilege of another user via HTTP Request |
CVE-2024-28188 | Medium | 5.3 | 2024-05-23 | Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyter-scheduler` users… |
CVE-2024-29849 | Critical | 9.8 | 2024-05-22 | Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. |
CVE-2024-5044 | Low | 3.7 | 2024-05-17 | A vulnerability was found in Emlog Pro 2.3.4. It has been classified as problematic. This affects an unknown part of the component Cookie Handler. The manipula… |
CVE-2023-41956 | High | 8.8 | 2024-05-17 | Improper Authentication vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.3.4. |
CVE-2024-35184 | Medium | 5.5 | 2024-05-15 | Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to versi… |
CVE-2024-3487 | Low | 3.5 | 2024-05-15 | Broken Authentication vulnerability discovered in OpenText™ iManager 3.2.6.0200. This vulnerability allows an attacker to manipulate certain parameters to bypa… |
CVE-2024-4129 | High | 8.8 | 2024-05-14 | Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Ac… |
CVE-2024-3263 | Critical | 9.8 | 2024-05-14 | YMS VIS Pro is an information system for veterinary and food administration, veterinarians and farm. Due to a combination of improper method for system credent… |
CVE-2024-34340 | Critical | 9.1 | 2024-05-14 | Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their passw… |
CVE-2024-27835 | Low | 2.4 | 2024-05-14 | This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access to an iOS device… |
CVE-2020-18305 | High | 8.0 | 2024-05-14 | Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers… |
CVE-2024-4601 | Medium | 6.7 | 2024-05-07 | An incorrect authentication vulnerability has been found in Socomec Net Vision affecting version 7.20. This vulnerability allows an attacker to perform a brute… |
CVE-2024-20856 | Medium | 4.3 | 2024-05-07 | Improper Authentication vulnerability in Secure Folder prior to SMR May-2024 Release 1 allows physical attackers to access Secure Folder without proper authent… |
CVE-2024-34093 | Medium | 5.3 | 2024-05-06 | An issue was discovered in Archer Platform 6 before 2024.03. There is an X-Forwarded-For Header Bypass vulnerability. An unauthenticated attacker could potenti… |
CVE-2024-33110 | Critical | 9.1 | 2024-05-06 | D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Permission Bypass via the getcfg.php component. |
CVE-2023-38096 | Critical | 9.8 | 2024-05-03 | NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authen… |
CVE-2024-26331 | High | 7.5 | 2024-04-30 | ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID. Attac… |
CVE-2024-4303 | High | 8.8 | 2024-04-29 | ArmorX Android APP's multi-factor authentication (MFA) for the login function is not properly implemented. Remote attackers who obtain user credentials can byp… |
CVE-2023-47222 | Critical | 9.6 | 2024-04-26 | An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow users to com… |
CVE-2024-30939 | Medium | 6.8 | 2024-04-25 | An issue discovered in Yealink VP59 Teams Editions with firmware version 91.15.0.118 allows a physically proximate attacker to gain control of an account via a… |
CVE-2023-6787 | Medium | 6.5 | 2024-04-25 | A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an act… |
CVE-2024-4024 | High | 7.3 | 2024-04-25 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versi… |
CVE-2023-3597 | Medium | 5.0 | 2024-04-25 | A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote… |
CVE-2023-51484 | Critical | 9.8 | 2024-04-25 | Improper Authentication vulnerability in wp-buy Login as User or Customer (User Switching) allows Privilege Escalation.This issue affects Login as User or Cust… |
CVE-2023-51482 | Critical | 9.9 | 2024-04-25 | Improper Authentication vulnerability in EazyPlugins Eazy Plugin Manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Eaz… |
CVE-2023-51478 | Critical | 9.8 | 2024-04-25 | Improper Authentication vulnerability in Abdul Hakeem Build App Online allows Privilege Escalation.This issue affects Build App Online: from n/a through 1.0.19. |
CVE-2023-51477 | Critical | 9.8 | 2024-04-24 | Improper Authentication vulnerability in BUDDYBOSS DMCC BuddyBoss Theme allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Budd… |
CVE-2023-51472 | Critical | 9.8 | 2024-04-24 | Improper Authentication vulnerability in Mestres do WP Checkout Mestres WP allows Privilege Escalation.This issue affects Checkout Mestres WP: from n/a through… |
CVE-2023-51471 | High | 8.2 | 2024-04-24 | Improper Authentication vulnerability in Mestres do WP Checkout Mestres WP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects C… |
CVE-2023-51405 | High | 8.2 | 2024-04-24 | Improper Authentication vulnerability in Repute Infosystems BookingPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Boo… |
CVE-2023-47504 | Medium | 6.5 | 2024-04-24 | Improper Authentication vulnerability in Elementor Elementor Website Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |
CVE-2023-25790 | Medium | 5.3 | 2024-04-24 | Improper Authentication, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart allows Cross-Sit… |
CVE-2024-3701 | Critical | 9.8 | 2024-04-15 | The system application (com.transsion.kolun.aiservice) component does not perform an authentication check, which allows attackers to perform malicious exploita… |
CVE-2024-29837 | High | 8.8 | 2024-04-15 | The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to acce… |
CVE-2023-48865 | Medium | 6.5 | 2024-04-11 | An issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via execute_mode parameter of the URL. |
CVE-2024-2112 | Medium | 5.9 | 2024-04-09 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions… |
CVE-2024-24279 | High | 8.8 | 2024-04-08 | An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attackers to gain escalated privileges via vsVe… |
CVE-2023-52540 | High | 7.5 | 2024-04-08 | Vulnerability of improper authentication in the Iaware module. Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-29757 | High | 7.3 | 2024-04-05 | there is a possible permission bypass due to Debug certs being allowlisted. This could lead to local escalation of privilege with no additional execution privi… |
CVE-2024-25699 | High | 8.5 | 2024-04-04 | There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux… |
CVE-2023-44039 | Critical | 9.1 | 2024-04-03 | In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO… |
CVE-2024-22247 | Medium | 4.8 | 2024-04-02 | VMware SD-WAN Edge contains a missing authentication and protection mechanism vulnerability. A malicious actor with physical access to the SD-WAN Edge applian… |
CVE-2024-28012 | Critical | 9.8 | 2024-03-28 | Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-… |
CVE-2024-28009 | Critical | 9.8 | 2024-03-28 | Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-… |
CVE-2024-28007 | Critical | 9.8 | 2024-03-28 | Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-… |
CVE-2024-28006 | Medium | 5.3 | 2024-03-28 | Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-… |
CVE-2023-31634 | Critical | 9.8 | 2024-03-27 | In TeslaMate before 1.27.2, there is unauthorized access to port 4000 for remote viewing and operation of user data. After accessing the IP address for the Tes… |
CVE-2024-2244 | Medium | 5.3 | 2024-03-27 | REST service authentication anomaly with “valid username/no password” credential combination for batch job processing resulting in successful service invocatio… |
CVE-2024-2873 | Critical | 9.1 | 2024-03-25 | A vulnerability was found in wolfSSH's server-side state machine before versions 1.4.17. A malicious client could create channels without first performing user… |
CVE-2024-2862 | Critical | 9.1 | 2024-03-25 | This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant. |
CVE-2022-44595 | Medium | 5.3 | 2024-03-21 | Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0. |
CVE-2024-1148 | Critical | 9.8 | 2024-03-21 | Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and uploading of files. |
CVE-2024-1147 | Critical | 9.8 | 2024-03-21 | Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and download of files. |
CVE-2024-27923 | High | 8.8 | 2024-03-21 | Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission… |
CVE-2024-28735 | High | 8.1 | 2024-03-20 | Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user… |
CVE-2024-27767 | Critical | 10.0 | 2024-03-18 | CWE-287: Improper Authentication may allow Authentication Bypass |
CVE-2024-28255 | Critical | 9.8 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-2450 | High | 8.8 | 2024-03-15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switchi… |
CVE-2024-25652 | High | 7.6 | 2024-03-14 | In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED… |
CVE-2023-38534 | High | 8.6 | 2024-03-13 | Improper authentication vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.0 and 12.5.1. The vulnerability could allow disclosure of restricted… |
CVE-2024-0799 | Critical | 9.8 | 2024-03-13 | An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.s… |
CVE-2024-21427 | High | 7.5 | 2024-03-12 | Windows Kerberos Security Feature Bypass Vulnerability |
CVE-2024-21390 | High | 7.1 | 2024-03-12 | Microsoft Authenticator Elevation of Privilege Vulnerability |
CVE-2023-46717 | High | 7.5 | 2024-03-12 | An improper authentication vulnerability [CWE-287] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and versions 7.0.12 and below when configured… |
CVE-2023-49340 | Critical | 9.8 | 2024-03-09 | An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to escalate privileges and bypass authe… |
CVE-2024-21899 | Critical | 9.8 | 2024-03-08 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users… |
CVE-2024-23255 | Low | 2.4 | 2024-03-08 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Photos in the Hidden… |
CVE-2023-46172 | Medium | 5.6 | 2024-03-07 | IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow a remote attacker to bypass authentication restrictions for authoriz… |
CVE-2023-42662 | Critical | 9.3 | 2024-03-07 | JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially craft… |
CVE-2023-48703 | High | 7.5 | 2024-03-06 | RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the `x… |
CVE-2024-20301 | Medium | 6.2 | 2024-03-06 | A vulnerability in Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, physical attacker to bypass secondary authentication and ac… |
CVE-2023-38367 | Medium | 6.5 | 2024-02-29 | IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 2… |
CVE-2024-25128 | Critical | 9.1 | 2024-02-29 | Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to f… |
CVE-2023-38372 | Medium | 5.9 | 2024-02-29 | An unauthorized attacker who has obtained an IBM Watson IoT Platform 1.0 security authentication token can use it to impersonate an authorized platform user… |
CVE-2024-1735 | Critical | 9.1 | 2024-02-26 | A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentication. All users… |