CWE-287 · Improper Authentication (page 18)
Page 18 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-22395 | Medium | 6.3 | 2024-02-24 | Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a… |
CVE-2024-1817 | High | 7.3 | 2024-02-23 | A vulnerability has been found in Demososo DM Enterprise Website Building System up to 2022.8 and classified as critical. Affected by this vulnerability is the… |
CVE-2023-52161 | High | 7.5 | 2024-02-22 | The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a… |
CVE-2023-52160 | Medium | 6.5 | 2024-02-22 | The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verif… |
CVE-2024-22245 | Critical | 9.6 | 2024-02-20 | Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor… |
CVE-2022-41738 | High | 7.5 | 2024-02-17 | IBM Storage Scale Container Native Storage Access 5.1.2.1 -through 5.1.7.0 could allow an attacker to initiate connections to containers from external networks… |
CVE-2022-41737 | High | 7.1 | 2024-02-17 | IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.7.0 could allow a local attacker to initiate connections from a container outside the cur… |
CVE-2023-6451 | High | 8.6 | 2024-02-16 | Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication cookies and bypass the… |
CVE-2024-20738 | Critical | 9.8 | 2024-02-15 | Adobe FrameMaker Publishing Server versions 2022.1 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature… |
CVE-2024-25618 | Medium | 4.2 | 2024-02-14 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML… |
CVE-2024-0568 | High | 8.8 | 2024-02-14 | CWE-287: Improper Authentication vulnerability exists that could cause unauthorized tampering of device configuration over NFC communication. |
CVE-2023-31189 | Medium | 5.2 | 2024-02-14 | Improper authentication in some Intel(R) Server Product OpenBMC firmware before version egs-1.09 may allow an authenticated user to enable escalation of privil… |
CVE-2024-21410 | Critical | 9.8 | 2024-02-13 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
CVE-2024-23813 | High | 7.3 | 2024-02-13 | A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper aut… |
CVE-2024-25313 | High | 8.8 | 2024-02-09 | Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/teacher_login.php. |
CVE-2023-51761 | High | 8.3 | 2024-02-09 | In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could bypass authentication and acquire admin capabil… |
CVE-2024-25106 | Critical | 9.1 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability h… |
CVE-2024-24830 | Critical | 9.9 | 2024-02-08 | OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been i… |
CVE-2024-24496 | Critical | 9.8 | 2024-02-08 | An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php… |
CVE-2024-22394 | Critical | 9.8 | 2024-02-08 | An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow a remote attacker t… |
CVE-2024-23806 | Medium | 5.3 | 2024-02-07 | Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys. |
CVE-2024-24771 | High | 7.7 | 2024-02-07 | Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication… |
CVE-2023-39196 | Medium | 5.3 | 2024-02-07 | Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage Container Manager ser… |
CVE-2024-24592 | Critical | 9.8 | 2024-02-06 | Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, mod… |
CVE-2024-20816 | High | 8.0 | 2024-02-06 | Improper authentication vulnerability in onCharacteristicWriteRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackers connect to vict… |
CVE-2024-20815 | High | 8.0 | 2024-02-06 | Improper authentication vulnerability in onCharacteristicReadRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackers connect to victi… |
CVE-2023-39303 | Medium | 5.3 | 2024-02-02 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users… |
CVE-2023-50934 | Medium | 5.3 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses single-factor authentication which can lead to unnecessary risk of compromise when compared with the benefits of a dual-fact… |
CVE-2024-1039 | Critical | 9.8 | 2024-02-01 | Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web managemen… |
CVE-2023-47256 | Medium | 5.5 | 2024-02-01 | ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings |
CVE-2024-23637 | Medium | 4.2 | 2024-01-31 | OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change th… |
CVE-2024-23647 | Medium | 6.5 | 2024-01-30 | Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offe… |
CVE-2023-51982 | Critical | 9.8 | 2024-01-30 | CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case o… |
CVE-2024-1006 | High | 7.3 | 2024-01-29 | A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2024-23792 | Medium | 5.3 | 2024-01-29 | When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user. The attack requires a logged-in other us… |
CVE-2024-0988 | Medium | 6.3 | 2024-01-29 | A vulnerability classified as critical was found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this vulnerability is the function checklogin of t… |
CVE-2024-23629 | Critical | 9.6 | 2024-01-26 | An authentication bypass vulnerability exists in the web component of the Motorola MR2600. An attacker can exploit this vulnerability to access protected URLs… |
CVE-2024-0822 | High | 7.5 | 2024-01-25 | An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in… |
CVE-2024-0879 | Medium | 6.5 | 2024-01-25 | Authentication bypass in vector-admin allows a user to register to a vector-admin server while “domain restriction” is active, even when not owning an authori… |
CVE-2023-50275 | High | 7.5 | 2024-01-23 | HPE OneView may allow clusterService Authentication Bypass resulting in denial of service. |
CVE-2024-23219 | Medium | 6.2 | 2024-01-23 | The issue was addressed with improved authentication. This issue is fixed in iOS 17.3 and iPadOS 17.3. Stolen Device Protection may be unexpectedly disabled. |
CVE-2023-42935 | Medium | 5.5 | 2024-01-23 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.6.4. A local attacker may be able to view the pre… |
CVE-2023-52111 | High | 7.5 | 2024-01-16 | Authorization vulnerability in the BootLoader module. Successful exploitation of this vulnerability may affect service integrity. |
CVE-2023-46942 | High | 7.5 | 2024-01-13 | Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper auth… |
CVE-2024-21654 | Medium | 4.8 | 2024-01-12 | Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of… |
CVE-2024-22206 | Critical | 9.0 | 2024-01-12 | Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the P… |
CVE-2023-46805 | High | 8.2 | 2024-01-12 | An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted reso… |
CVE-2023-49262 | Critical | 9.8 | 2024-01-12 | The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, provided there is an active user session. |
CVE-2023-50919 | Critical | 9.8 | 2024-01-12 | An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4… |
CVE-2023-50127 | Medium | 5.9 | 2024-01-11 | Hozard alarm system (Alarmsysteem) v1.0 is vulnerable to Improper Authentication. Commands sent via the SMS functionality are accepted from random phone number… |
CVE-2024-21638 | Critical | 9.1 | 2024-01-10 | Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address sp… |
CVE-2023-48257 | High | 7.8 | 2024-01-10 | The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges o… |
CVE-2023-5376 | High | 8.6 | 2024-01-09 | An Improper Authentication vulnerability in Korenix JetNet TFTP allows abuse of this service. This issue affects JetNet devices older than firmware version 202… |
CVE-2023-51717 | Critical | 9.8 | 2024-01-09 | Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass. |
CVE-2023-7211 | Medium | 5.6 | 2024-01-07 | A vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component Administrative Web I… |
CVE-2023-7210 | High | 7.3 | 2024-01-07 | A vulnerability was found in OneNav up to 0.9.33. It has been classified as critical. This affects an unknown part of the file /index.php?c=api of the componen… |
CVE-2024-20803 | Medium | 6.8 | 2024-01-04 | Improper authentication vulnerability in Bluetooth pairing process prior to SMR Jan-2024 Release 1 allows remote attackers to establish pairing process without… |
CVE-2024-21632 | High | 8.6 | 2024-01-02 | omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy… |
CVE-2023-7079 | Medium | 6.4 | 2023-12-29 | Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over t… |
CVE-2023-31292 | Medium | 5.5 | 2023-12-29 | An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows local attackers to obtain sensitive information and bypass aut… |
CVE-2023-40038 | High | 8.8 | 2023-12-27 | Arris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. (They use the first 6 characters of the SSID… |
CVE-2023-4641 | Medium | 4.7 | 2023-12-27 | A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-uti… |
CVE-2023-6155 | Medium | 5.3 | 2023-12-26 | The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacke… |
CVE-2023-31224 | Critical | 9.8 | 2023-12-25 | There is broken access control during authentication in Jamf Pro Server before 10.46.1. |
CVE-2022-34267 | Critical | 9.8 | 2023-12-25 | An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Jav… |
CVE-2023-50714 | Medium | 6.8 | 2023-12-22 | yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2… |
CVE-2023-49791 | Medium | 5.4 | 2023-12-22 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcl… |
CVE-2023-49790 | Medium | 4.3 | 2023-12-22 | The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be… |
CVE-2023-51708 | High | 8.6 | 2023-12-22 | Bentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via… |
CVE-2023-6847 | High | 7.5 | 2023-12-21 | An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of Private Mode by using a specially crafted API requ… |
CVE-2023-51442 | High | 8.6 | 2023-12-21 | Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome's subsonic endpoint, allo… |
CVE-2023-6768 | Critical | 9.4 | 2023-12-20 | Authentication bypass vulnerability in Amazing Little Poll affecting versions 1.3 and 1.4. This vulnerability could allow an unauthenticated user to access the… |
CVE-2023-37544 | High | 7.5 | 2023-12-20 | Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This is… |
CVE-2023-6483 | Critical | 9.1 | 2023-12-18 | The vulnerability exists in ADiTaaS (Allied Digital Integrated Tool-as-a-Service) version 5.1 due to an improper authentication vulnerability in the ADiTaaS ba… |
CVE-2023-6907 | Medium | 5.4 | 2023-12-18 | A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2023-49646 | Medium | 6.4 | 2023-12-13 | Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access. |
CVE-2023-44252 | High | 8.8 | 2023-12-13 | ** UNSUPPORTED WHEN ASSIGNED **An improper authentication vulnerability [CWE-287] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5… |
CVE-2023-45801 | High | 7.5 | 2023-12-13 | Improper Authentication vulnerability in Nadatel DVR allows Information Elicitation.This issue affects DVR: from 3.0.0 before 9.9.0. |
CVE-2023-36004 | High | 7.5 | 2023-12-12 | Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability |
CVE-2023-36648 | High | 8.2 | 2023-12-12 | Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read potentially sensitive… |
CVE-2023-50430 | Medium | 6.4 | 2023-12-09 | The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol (SDCP) when enrolling via Linux… |
CVE-2023-45866 | Medium | 6.3 | 2023-12-08 | Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboar… |
CVE-2023-43742 | Critical | 9.8 | 2023-12-08 | An authentication bypass in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109… |
CVE-2023-36655 | Critical | 9.8 | 2023-12-06 | The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) allows a remote blocked user to login and obtain… |
CVE-2023-6514 | High | 8.8 | 2023-12-06 | The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability m… |
CVE-2023-5970 | High | 8.8 | 2023-12-05 | Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using ac… |
CVE-2023-47304 | High | 7.8 | 2023-12-05 | An issue was discovered in Vonage Box Telephone Adapter VDV23 version VDV21-3.2.11-0.5.1, allows local attackers to bypass UART authentication controls and rea… |
CVE-2023-42576 | Medium | 5.4 | 2023-12-05 | Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to invalid exception ha… |
CVE-2023-33070 | High | 7.1 | 2023-12-05 | Transient DOS in Automotive OS due to improper authentication to the secure IO calls. |
CVE-2023-33054 | Critical | 9.1 | 2023-12-05 | Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data. |
CVE-2023-5808 | High | 7.6 | 2023-12-05 | SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrat… |
CVE-2023-44302 | High | 8.1 | 2023-12-04 | Dell DM5500 5.14.0.0 and prior contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerabilit… |
CVE-2023-6354 | Medium | 5.3 | 2023-11-30 | Tyler Technologies Magistrate Court Case Management Plus allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the PDFVi… |
CVE-2023-6353 | Medium | 5.3 | 2023-11-30 | Tyler Technologies Civil and Criminal Electronic Filing allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the Upload… |
CVE-2023-6344 | Medium | 5.3 | 2023-11-30 | Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate directories using the tiffserver/te003.aspx or te004.aspx… |
CVE-2023-6343 | Medium | 5.3 | 2023-11-30 | Tyler Technologies Court Case Management Plus allows a remote, unauthenticated attacker to enumerate and access sensitive files using the tiffserver/tssp.aspx… |
CVE-2023-6342 | Medium | 5.3 | 2023-11-30 | Tyler Technologies Court Case Management Plus allows a remote attacker to authenticate as any user by manipulating at least the 'CmWebSearchPfp/Login.aspx?xyzl… |
CVE-2023-34388 | Medium | 6.5 | 2023-11-30 | An Improper Authentication vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote unauthenticated attacker to potentially perfor… |
CVE-2023-35137 | High | 7.5 | 2023-11-30 | An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(A… |
CVE-2023-29062 | Low | 3.8 | 2023-11-28 | The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately vali… |