CWE-287 · Improper Authentication (page 18)
Page 18 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28609 | Critical | 9.8 | 2023-03-18 | api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication. |
CVE-2023-1464 | High | 7.3 | 2023-03-17 | A vulnerability, which was classified as critical, was found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file Users.php?… |
CVE-2023-1460 | Medium | 6.5 | 2023-03-17 | A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admi… |
CVE-2023-21460 | Medium | 4.4 | 2023-03-16 | Improper authentication in SecSettings prior to SMR Mar-2023 Release 1 allows attacker to reset the setting. |
CVE-2023-21455 | Medium | 5.9 | 2023-03-16 | Improper authorization implementation in Exynos baseband prior to SMR Mar-2023 Release 1 allows incorrect handling of unencrypted message. |
CVE-2023-28461 | Critical | 9.8 | 2023-03-15 | Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using… |
CVE-2022-46773 | Medium | 4.3 | 2023-03-15 | IBM Robotic Process Automation 21.0.0 - 21.0.7 and 23.0.0 is vulnerable to client-side validation bypass for credential pools. Invalid credential pools may be… |
CVE-2022-46774 | Medium | 5.4 | 2023-03-15 | IBM Manage Application 8.8.0 and 8.9.0 in the IBM Maximo Application Suite is vulnerable to incorrect default permissions which could give access to a user to… |
CVE-2023-1327 | Critical | 9.8 | 2023-03-14 | Netgear RAX30 (AX2400), prior to version 1.0.6.74, was affected by an authentication bypass vulnerability, allowing an unauthenticated attacker to gain adminis… |
CVE-2023-25957 | Critical | 9.1 | 2023-03-14 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >… |
CVE-2023-23857 | Critical | 9.9 | 2023-03-14 | Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use o… |
CVE-2023-27582 | Critical | 9.1 | 2023-03-13 | maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL author… |
CVE-2022-44574 | High | 7.5 | 2023-03-10 | An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port. |
CVE-2022-33242 | High | 7.8 | 2023-03-10 | Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD. |
CVE-2023-27482 | Critical | 10.0 | 2023-03-08 | homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Ho… |
CVE-2022-48364 | Medium | 4.3 | 2023-03-06 | The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative ac… |
CVE-2023-0228 | High | 8.8 | 2023-03-02 | Improper Authentication vulnerability in ABB Symphony Plus S+ Operations.This issue affects Symphony Plus S+ Operations: from 2.X through 2.1 SP2, 2.2, from 3… |
CVE-2023-25931 | Medium | 6.4 | 2023-03-01 | Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requi… |
CVE-2023-1065 | Medium | 6.5 | 2023-02-28 | This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relev… |
CVE-2023-25264 | High | 7.5 | 2023-02-28 | An issue was discovered in Docmosis Tornado prior to version 2.9.5. An unauthenticated attacker can bypass the authentication check filter completely by introd… |
CVE-2023-23493 | Low | 3.3 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.2, macOS Monterey 12.6.3. An encrypted volume may be unmoun… |
CVE-2022-48305 | Medium | 5.5 | 2023-02-27 | There is an identity authentication bypass vulnerability in Huawei Children Smart Watch (Simba-AL00) 1.1.1.274. Successful exploitation of this vulnerability m… |
CVE-2022-48254 | Medium | 4.6 | 2023-02-27 | There is a data processing error vulnerability in Leia-B29 2.0.0.49(M03). Successful exploitation could bypass lock screen authentication. |
CVE-2022-34908 | High | 8.2 | 2023-02-27 | An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It possesses an authentication mechanism; however, some features do not requ… |
CVE-2023-20012 | Medium | 5.3 | 2023-02-23 | A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender (FEX) when used in UCS Fabric Interconnect deployments c… |
CVE-2023-24093 | Critical | 9.8 | 2023-02-22 | An access control issue in H3C A210-G A210-GV100R005 allows attackers to authenticate without a password. |
CVE-2015-10083 | Medium | 6.3 | 2023-02-21 | A vulnerability has been found in harrystech Dynosaur-Rails and classified as critical. Affected by this vulnerability is the function basic_auth of the file a… |
CVE-2023-0905 | High | 7.3 | 2023-02-18 | A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file change… |
CVE-2022-33946 | Medium | 5.6 | 2023-02-16 | Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2022-32971 | Low | 3.1 | 2023-02-16 | Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow a privileged user to potentially enable escalation of privilege via netw… |
CVE-2022-32570 | Medium | 6.7 | 2023-02-16 | Improper authentication in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of pri… |
CVE-2023-23460 | Critical | 9.1 | 2023-02-15 | Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass. |
CVE-2022-47508 | High | 7.5 | 2023-02-15 | Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were querying for data via IP a… |
CVE-2023-21817 | High | 7.8 | 2023-02-14 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2023-21721 | Medium | 6.5 | 2023-02-14 | Microsoft OneNote Elevation of Privilege Vulnerability |
CVE-2022-45724 | Medium | 5.4 | 2023-02-13 | Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to an unauthenticated pag… |
CVE-2023-25559 | High | 8.2 | 2023-02-11 | DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service (… |
CVE-2023-21437 | Medium | 4.0 | 2023-02-09 | Improper access control vulnerability in Phone application prior to SMR Feb-2023 Release 1 allows local attackers to access sensitive information via implicit… |
CVE-2023-21425 | Medium | 4.3 | 2023-02-09 | Improper access control vulnerability in telecom application prior to SMR JAN-2023 Release 1 allows local attackers to get sensitive information. |
CVE-2023-21419 | Medium | 4.3 | 2023-02-09 | An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container remain unlocked under certain condition. |
CVE-2022-48294 | High | 7.5 | 2023-02-09 | The IHwAttestationService interface has a defect in authentication. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-42951 | High | 8.1 | 2023-02-06 | An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server n… |
CVE-2023-22501 | Critical | 9.1 | 2023-02-01 | An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain… |
CVE-2022-47003 | Critical | 9.8 | 2023-02-01 | A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request. |
CVE-2020-20402 | High | 7.5 | 2023-01-31 | Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation. |
CVE-2022-4441 | High | 7.6 | 2023-01-31 | Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. Thi… |
CVE-2022-4041 | Medium | 5.9 | 2023-01-31 | Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. Thi… |
CVE-2022-30421 | High | 7.8 | 2023-01-31 | Improper Authentication vulnerability in Toshiba Storage Security Software V1.2.0.7413 is that allows for sensitive information to be obtained via(local) passw… |
CVE-2022-32514 | Critical | 9.8 | 2023-01-30 | A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Produ… |
CVE-2023-24830 | High | 7.5 | 2023-01-30 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3. |
CVE-2022-43978 | Medium | 5.6 | 2023-01-27 | There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a… |
CVE-2022-48066 | Critical | 9.8 | 2023-01-27 | An issue in the component global.so of Totolink A830R V4.1.2cu.5182 allows attackers to bypass authentication via a crafted cookie. |
CVE-2023-23612 | Medium | 4.7 | 2023-01-26 | OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when th… |
CVE-2023-20924 | Medium | 6.8 | 2023-01-26 | In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure. This could lead to local escalation of privilege with physic… |
CVE-2021-43445 | Critical | 9.8 | 2023-01-23 | ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE do… |
CVE-2021-43444 | High | 7.5 | 2023-01-23 | ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing… |
CVE-2020-22657 | Critical | 9.1 | 2023-01-20 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199… |
CVE-2023-22964 | Critical | 9.1 | 2023-01-20 | Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled. |
CVE-2023-22334 | Medium | 5.3 | 2023-01-20 | Use of password hash instead of password for authentication vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote authenticated att… |
CVE-2022-45922 | High | 8.8 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The request handler for ll.KeepAliveSession sets a valid AdminPwd cookie even w… |
CVE-2021-4314 | Medium | 5.3 | 2023-01-18 | It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only… |
CVE-2023-21841 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2023-22303 | Critical | 9.8 | 2023-01-17 | TP-Link SG105PE firmware prior to 'TL-SG105PE(UN) 1.0_1.0.0 Build 20221208' contains an authentication bypass vulnerability. Under the certain conditions, an a… |
CVE-2023-22278 | Medium | 5.3 | 2023-01-17 | m-FILTER prior to Ver.5.70R01 (Ver.5 Series) and m-FILTER prior to Ver.4.87R04 (Ver.4 Series) allows a remote unauthenticated attacker to bypass authentication… |
CVE-2023-0311 | Critical | 9.8 | 2023-01-15 | Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-22497 | Medium | 6.5 | 2023-01-14 | Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. Each Netdata Agent has an automatically generated MACHINE GUID. I… |
CVE-2023-0105 | Medium | 6.5 | 2023-01-13 | A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow… |
CVE-2022-25027 | High | 7.5 | 2023-01-12 | The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by valida… |
CVE-2022-39184 | Critical | 9.8 | 2023-01-12 | EXFO - BV-10 Performance Endpoint Unit authentication bypass User can manually manipulate access enabling authentication bypass. |
CVE-2022-4874 | High | 7.5 | 2023-01-11 | Authentication bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows an unauthenticated user to access content. In order to serve static content, t… |
CVE-2022-35401 | High | 8.1 | 2023-01-10 | An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A specially-crafted HTTP re… |
CVE-2023-0036 | Medium | 6.5 | 2023-01-09 | platform_callback_stub in misc subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA relay atta… |
CVE-2023-0035 | Medium | 6.5 | 2023-01-09 | softbus_client_stub in communication subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA rela… |
CVE-2022-1101 | High | 7.3 | 2023-01-07 | A vulnerability was found in SourceCodester Royale Event Management System 1.0. It has been rated as critical. This issue affects some unknown processing of th… |
CVE-2014-125060 | High | 7.3 | 2023-01-07 | A vulnerability, which was classified as critical, was found in holdennb CollabCal. Affected is the function handleGet of the file calenderServer.cpp. The mani… |
CVE-2022-47976 | High | 7.5 | 2023-01-06 | The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this vulnerability may… |
CVE-2022-47974 | Medium | 6.5 | 2023-01-06 | The Bluetooth AVRCP module has a vulnerability that can lead to DoS attacks.Successful exploitation of this vulnerability may cause the Bluetooth process to re… |
CVE-2021-40342 | High | 7.1 | 2023-01-05 | In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive info… |
CVE-2022-43528 | Medium | 4.8 | 2023-01-05 | Under certain configurations, an attacker can login to Aruba EdgeConnect Enterprise Orchestrator without supplying a multi-factor authentication code. Successf… |
CVE-2022-39042 | Critical | 9.8 | 2023-01-03 | aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and access… |
CVE-2022-48195 | Critical | 9.8 | 2022-12-31 | An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for chan… |
CVE-2022-4861 | Medium | 4.8 | 2022-12-30 | Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another reso… |
CVE-2022-23554 | Medium | 6.5 | 2022-12-28 | Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows Authentication Filter bypass. The AuthenticationFilter relies on the request URI… |
CVE-2022-41579 | Medium | 6.5 | 2022-12-28 | There is an insufficient authentication vulnerability in some Huawei band products. Successful exploit could allow the attacker to spoof then connect to the ba… |
CVE-2022-46172 | Medium | 6.4 | 2022-12-28 | authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can… |
CVE-2022-23555 | Critical | 9.4 | 2022-12-28 | authentik is an open-source Identity Provider focused on flexibility and versatility. Versions prior to 2022.11.4 and 2022.10.4 are vulnerable to Improper Auth… |
CVE-2020-36569 | Critical | 9.1 | 2022-12-27 | Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896… |
CVE-2022-3156 | High | 7.8 | 2022-12-27 | A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software. Users are granted elevated permissions on certain prod… |
CVE-2022-4722 | High | 7.2 | 2022-12-27 | Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2020-11101 | Critical | 9.8 | 2022-12-26 | Sierra Wireless AirLink Mobility Manager (AMM) before 2.17 mishandles sessions and thus an unauthenticated attacker can obtain a login session with administrat… |
CVE-2022-47633 | High | 8.1 | 2022-12-23 | An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject uns… |
CVE-2022-46875 | Medium | 6.5 | 2022-12-22 | The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. <br>*Note: This issue onl… |
CVE-2022-35646 | Medium | 5.9 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 software component could allow an authenticated user to modify or cancel any other user's access reque… |
CVE-2022-46170 | High | 8.6 | 2022-12-22 | CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2)… |
CVE-2022-23540 | Medium | 6.4 | 2022-12-22 | In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to def… |
CVE-2022-23541 | Medium | 5.0 | 2022-12-22 | jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented k… |
CVE-2022-46316 | Critical | 9.8 | 2022-12-20 | A thread security vulnerability exists in the authentication process. Successful exploitation of this vulnerability may affect data integrity, confidentiality… |
CVE-2022-46313 | Medium | 5.3 | 2022-12-20 | The sensor privacy module has an authentication vulnerability. Successful exploitation of this vulnerability may cause unavailability of the smartphone's camer… |
CVE-2022-41590 | Medium | 5.5 | 2022-12-20 | Some smartphones have authentication-related (including session management) vulnerabilities as the setup wizard is bypassed. Successful exploitation of this vu… |
CVE-2022-46400 | Medium | 5.4 | 2022-12-19 | The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) allows attackers to bypass passkey entry in legacy pairi… |