CWE-287 · Improper Authentication (page 19)
Page 19 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-48121 | Medium | 5.3 | 2023-11-28 | An authentication bypass vulnerability in the Direct Connection Module in Ezviz CS-C6N-xxx prior to v5.3.x build 20230401, Ezviz CS-CV310-xxx prior to v5.3.x b… |
CVE-2023-41264 | Critical | 9.8 | 2023-11-28 | Netwrix Usercube before 6.0.215, in certain misconfigured on-premises installations, allows authentication bypass on deployment endpoints, leading to privilege… |
CVE-2022-41678 | High | 8.8 | 2023-11-28 | Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolok… |
CVE-2023-6329 | Critical | 9.8 | 2023-11-27 | An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a "passwordCustom" option that… |
CVE-2023-41999 | Critical | 9.8 | 2023-11-27 | An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that all… |
CVE-2023-48312 | Critical | 9.8 | 2023-11-24 | capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a mi… |
CVE-2023-4677 | High | 7.0 | 2023-11-23 | Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory… |
CVE-2023-2437 | Critical | 9.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on th… |
CVE-2023-6248 | Critical | 10.0 | 2023-11-21 | The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code… |
CVE-2023-49105 | Critical | 9.8 | 2023-11-21 | An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of… |
CVE-2023-48228 | High | 7.5 | 2023-11-21 | authentik is an open-source identity provider. When initialising a oauth2 flow with a `code_challenge` and `code_method` (thus requesting PKCE), the single sig… |
CVE-2023-29155 | Critical | 9.8 | 2023-11-20 | Versions of INEA ME RTU firmware 3.36b and prior do not require authentication to the "root" account on the host system of the device. This could allow an atta… |
CVE-2023-44324 | Critical | 9.8 | 2023-11-17 | Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature b… |
CVE-2023-41442 | Critical | 9.8 | 2023-11-15 | An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via a crafted request t… |
CVE-2023-43582 | Medium | 5.5 | 2023-11-15 | Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access. |
CVE-2023-47127 | Medium | 4.2 | 2023-11-14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different site… |
CVE-2023-32661 | Medium | 6.7 | 2023-11-14 | Improper authentication in some Intel(R) NUC Kits NUC7PJYH and NUC7CJYH Realtek* SD Card Reader Driver installation software before version 10.0.19041.29098 ma… |
CVE-2023-28377 | Medium | 6.7 | 2023-11-14 | Improper authentication in some Intel(R) NUC Kit NUC11PH USB firmware installation software before version 1.1 for Windows may allow an authenticated user to p… |
CVE-2023-22663 | Medium | 5.9 | 2023-11-14 | Improper authentication for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. |
CVE-2023-29975 | High | 7.2 | 2023-11-09 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification. |
CVE-2023-4612 | Critical | 9.8 | 2023-11-09 | Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.T… |
CVE-2023-42554 | Medium | 5.4 | 2023-11-07 | Improper Authentication vulnerabiity in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication. |
CVE-2023-42531 | Medium | 6.2 | 2023-11-07 | Improper access control vulnerability in SmsController prior to SMR Nov-2023 Release1 allows local attackers to bypass restrictions on starting activities from… |
CVE-2023-24852 | High | 8.4 | 2023-11-07 | Memory Corruption in Core due to secure memory access by user while loading modem image. |
CVE-2023-39345 | High | 7.6 | 2023-11-06 | strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration en… |
CVE-2023-40660 | Medium | 6.6 | 2023-11-06 | A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operatio… |
CVE-2023-46963 | Medium | 5.3 | 2023-11-04 | An issue in Beijing Yunfan Internet Technology Co., Ltd, Yunfan Learning Examination System v.6.5 allows a remote attacker to obtain sensitive information via… |
CVE-2022-44569 | High | 7.8 | 2023-11-03 | A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication. |
CVE-2023-26455 | Medium | 5.6 | 2023-11-02 | RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI serv… |
CVE-2023-46327 | Medium | 5.9 | 2023-11-02 | Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their… |
CVE-2023-5627 | High | 7.5 | 2023-11-01 | A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implemen… |
CVE-2023-46249 | Critical | 9.6 | 2023-10-31 | authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possib… |
CVE-2023-44397 | High | 7.5 | 2023-10-30 | CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller… |
CVE-2023-21307 | Medium | 5.0 | 2023-10-30 | In Bluetooth, there is a possible way for a paired Bluetooth device to access a long term identifier for an Android device due to a permissions bypass. This co… |
CVE-2023-21297 | Medium | 4.4 | 2023-10-30 | In SEPolicy, there is a possible way to access the factory MAC address due to a permissions bypass. This could lead to local information disclosure with System… |
CVE-2023-5844 | High | 7.2 | 2023-10-30 | Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0. |
CVE-2023-5830 | High | 7.3 | 2023-10-27 | A vulnerability classified as critical has been found in ColumbiaSoft Document Locator. This affects an unknown part of the file /api/authentication/login of t… |
CVE-2023-35794 | High | 8.8 | 2023-10-27 | An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint (spawned console) can be accessed without authentication. S… |
CVE-2022-3681 | Medium | 6.5 | 2023-10-27 | A vulnerability has been identified in the MR2600 router v1.0.18 and earlier that could allow an attacker within range of the wireless network to successfully… |
CVE-2023-46290 | High | 8.1 | 2023-10-27 | Due to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk® Servic… |
CVE-2022-34887 | Medium | 4.3 | 2023-10-27 | Standard users can directly operate and set printer configuration information , such as IP, in some Lenovo Printers without having to authenticate with the adm… |
CVE-2023-30967 | Critical | 9.8 | 2023-10-26 | Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files… |
CVE-2023-37283 | High | 8.1 | 2023-10-25 | Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter |
CVE-2023-27377 | High | 7.5 | 2023-10-25 | Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction o… |
CVE-2023-5246 | High | 8.8 | 2023-10-23 | Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 10… |
CVE-2023-38735 | Medium | 5.7 | 2023-10-22 | IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attack… |
CVE-2023-4939 | Medium | 5.3 | 2023-10-21 | The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication to… |
CVE-2023-41089 | High | 8.0 | 2023-10-19 | The affected product is vulnerable to an improper authentication vulnerability, which may allow an attacker to impersonate a legitimate user as long a… |
CVE-2023-45669 | Medium | 4.8 | 2023-10-16 | WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature count… |
CVE-2023-4562 | Critical | 9.1 | 2023-10-13 | Improper Authentication vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules allows a remote unauthenticated attacker to obtain sequen… |
CVE-2023-41261 | Medium | 5.3 | 2023-10-12 | An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV does not require authenti… |
CVE-2023-23632 | High | 7.8 | 2023-10-12 | BeyondTrust Privileged Remote Access (PRA) versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. Attackers can exploit a flawed secret ver… |
CVE-2023-24479 | Critical | 9.8 | 2023-10-11 | An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead t… |
CVE-2023-44096 | High | 7.5 | 2023-10-11 | Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-36724 | Medium | 5.5 | 2023-10-10 | Windows Power Management Service Information Disclosure Vulnerability |
CVE-2023-43809 | High | 7.5 | 2023-10-04 | Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, r… |
CVE-2023-43805 | High | 7.5 | 2023-10-04 | Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypas… |
CVE-2023-43793 | High | 7.5 | 2023-10-04 | Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull… |
CVE-2021-3784 | Medium | 5.3 | 2023-10-04 | Garuda Linux performs an insecure user creation and authentication that allows any user to impersonate the created account. By creating users from the 'Garuda… |
CVE-2023-40376 | Medium | 5.3 | 2023-10-04 | IBM UrbanCode Deploy (UCD) 7.1 - 7.1.2.12, 7.2 through 7.2.3.5, and 7.3 through 7.3.2.0 under certain configurations could allow an authenticated user to make… |
CVE-2023-28540 | Critical | 9.1 | 2023-10-03 | Cryptographic issue in Data Modem due to improper authentication during TLS handshake. |
CVE-2023-26150 | Medium | 6.5 | 2023-10-03 | Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and… |
CVE-2023-42771 | High | 8.8 | 2023-10-03 | Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unaut… |
CVE-2023-5329 | Medium | 4.3 | 2023-10-02 | A vulnerability classified as problematic was found in Field Logic DataCube4 up to 20231001. This vulnerability affects unknown code of the file /api/ of the c… |
CVE-2023-5328 | Medium | 6.3 | 2023-10-02 | A vulnerability classified as critical has been found in SATO CL4NX-J Plus 1.13.2-u455_r2. This affects an unknown part of the component Cookie Handler. The ma… |
CVE-2023-5326 | Medium | 6.3 | 2023-10-01 | A vulnerability was found in SATO CL4NX-J Plus 1.13.2-u455_r2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2023-43660 | Medium | 4.8 | 2023-09-27 | Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by s… |
CVE-2023-42818 | Medium | 5.4 | 2023-09-27 | JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding… |
CVE-2023-20252 | Critical | 9.8 | 2023-09-27 | A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker… |
CVE-2023-44152 | Critical | 9.1 | 2023-09-27 | Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Linux, macOS… |
CVE-2023-41904 | Medium | 5.4 | 2023-09-27 | Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs. |
CVE-2023-31015 | Medium | 6.6 | 2023-09-20 | NVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication issue. A successful exploit of this vul… |
CVE-2023-4094 | Medium | 6.5 | 2023-09-19 | ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate acco… |
CVE-2023-0773 | Critical | 9.1 | 2023-09-19 | The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remote attacker could e… |
CVE-2023-42442 | High | 8.2 | 2023-09-15 | JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3… |
CVE-2023-41900 | Low | 3.5 | 2023-09-15 | Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `Op… |
CVE-2023-0813 | High | 7.5 | 2023-09-15 | A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is n… |
CVE-2022-47848 | High | 7.5 | 2023-09-15 | An issue was discovered in Bezeq Vtech NB403-IL version BZ_2.02.07.09.13.01 and Vtech IAD604-IL versions BZ_2.02.07.09.13.01, BZ_2.02.07.09.13T, and BZ_2.02.07… |
CVE-2023-4985 | Medium | 5.9 | 2023-09-15 | A vulnerability classified as critical has been found in Supcon InPlant SCADA up to 20230901. Affected is an unknown function of the file Project.xml. The mani… |
CVE-2023-4669 | Critical | 9.8 | 2023-09-14 | Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass. This issue affects SYSGuard 3001: before… |
CVE-2023-4568 | Medium | 6.5 | 2023-09-13 | PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may al… |
CVE-2023-39215 | High | 7.1 | 2023-09-12 | Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
CVE-2023-4501 | Critical | 9.8 | 2023-09-12 | User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enter… |
CVE-2023-29463 | High | 8.8 | 2023-09-12 | The JMX Console within the Rockwell Automation Pavilion8 is exposed to application users and does not require authentication. If exploited, a malicious user c… |
CVE-2023-39069 | Critical | 9.8 | 2023-09-11 | An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism. |
CVE-2023-4816 | Medium | 6.9 | 2023-09-11 | A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password validation in T214. This vulnerability… |
CVE-2021-27715 | Critical | 9.8 | 2023-09-08 | An issue was discovered in MoFi Network MOFI4500-4GXeLTE-V2 3.5.6-xnet-5052 allows attackers to bypass the authentication and execute arbitrary code via crafte… |
CVE-2023-20238 | Critical | 10.0 | 2023-09-06 | A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform cou… |
CVE-2023-4498 | Medium | 5.3 | 2023-09-06 | Tenda N300 Wireless N VDSL2 Modem Router allows unauthenticated access to pages that in turn should be accessible to authenticated users only |
CVE-2023-37284 | High | 8.8 | 2023-09-06 | Improper authentication vulnerability in Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616' allows a network-adjacent unauthenticated attacker to… |
CVE-2023-30725 | Medium | 5.1 | 2023-09-06 | Improper authentication in LocalProvier of Gallery prior to version 14.5.01.2 allows attacker to access the data in content provider. |
CVE-2023-30724 | Medium | 4.0 | 2023-09-06 | Improper authentication in GallerySearchProvider of Gallery prior to version 14.5.01.2 allows attacker to access search history. |
CVE-2023-30708 | Medium | 4.6 | 2023-09-06 | Improper authentication in SecSettings prior to SMR Sep-2023 Release 1 allows attacker to access Captive Portal Wi-Fi in Reactivation Lock status. |
CVE-2023-34998 | High | 8.1 | 2023-09-05 | An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series… |
CVE-2023-31242 | High | 8.1 | 2023-09-05 | An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series… |
CVE-2023-39981 | High | 7.5 | 2023-09-02 | A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1. This vulnerability arises from inadequate authe… |
CVE-2023-41751 | Medium | 5.5 | 2023-08-31 | Sensitive information disclosure due to improper token expiration validation. The following products are affected: Acronis Agent (Windows) before build 32047. |
CVE-2023-35785 | High | 8.1 | 2023-08-28 | Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7… |
CVE-2023-32202 | Medium | 6.5 | 2023-08-23 | Walchem Intuition 9 firmware versions prior to v4.21 are vulnerable to improper authentication. Login credentials are stored in a format that could allow an at… |
CVE-2023-40282 | Medium | 5.4 | 2023-08-23 | Improper authentication vulnerability in Rakuten WiFi Pocket all versions allows a network-adjacent attacker to log in to the product's Management Screen. As a… |