CWE-287 · Improper Authentication (page 19)
Page 19 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-42453 | Medium | 6.9 | 2022-12-19 | There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with… |
CVE-2022-3875 | High | 7.3 | 2022-12-19 | A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown… |
CVE-2022-47209 | High | 8.8 | 2022-12-16 | A support user exists on the device and appears to be a backdoor for Technical Support staff. The default password for this account is “support” and cannot be… |
CVE-2021-35252 | High | 7.5 | 2022-12-16 | Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker… |
CVE-2022-47408 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-23501 | Medium | 5.9 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Impro… |
CVE-2022-2757 | Critical | 9.8 | 2022-12-13 | Due to the lack of adequately implemented access-control rules, all versions Kingspan TMS300 CS are vulnerable to an attacker viewing and modifying the appl… |
CVE-2022-25685 | High | 7.5 | 2022-12-13 | Denial of service in Modem module due to improper authorization while error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdrago… |
CVE-2022-23505 | Medium | 5.3 | 2022-12-13 | Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be ab… |
CVE-2022-29838 | Medium | 4.3 | 2022-12-09 | Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the… |
CVE-2022-2752 | Medium | 5.5 | 2022-12-09 | A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions. This issu… |
CVE-2022-46829 | High | 7.1 | 2022-12-08 | In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented. |
CVE-2022-45877 | High | 8.3 | 2022-12-08 | OpenHarmony-v3.1.4 and prior versions had an vulnerability. PIN code is transmitted to the peer device in plain text during cross-device authentication, which… |
CVE-2022-45118 | Medium | 6.2 | 2022-12-08 | OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission… |
CVE-2022-39901 | Medium | 6.5 | 2022-12-08 | Improper authentication in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to disable the network traffic encryption between UE and gNod… |
CVE-2022-39899 | Medium | 5.7 | 2022-12-08 | Improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1 allows attacker to send the input event using S Pen gestu… |
CVE-2022-42458 | Critical | 9.8 | 2022-12-07 | Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticated attacker to uplo… |
CVE-2022-40966 | High | 8.8 | 2022-12-07 | Authentication bypass vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to bypass authentication and access the device. The… |
CVE-2022-44620 | High | 8.8 | 2022-12-07 | Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attack… |
CVE-2022-35843 | High | 8.1 | 2022-12-06 | An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9… |
CVE-2022-38336 | High | 8.1 | 2022-12-06 | An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication. |
CVE-2022-43557 | Medium | 5.3 | 2022-12-05 | The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with physical access, speci… |
CVE-2022-43549 | Critical | 9.8 | 2022-12-05 | Improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechanisms. |
CVE-2022-40259 | High | 8.3 | 2022-12-05 | MegaRAC Default Credentials Vulnerability |
CVE-2022-40242 | High | 7.5 | 2022-12-05 | MegaRAC Default Credentials Vulnerability |
CVE-2022-43504 | Medium | 5.3 | 2022-12-05 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who… |
CVE-2022-46411 | High | 8.8 | 2022-12-04 | An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. A default password is persisted after installation an… |
CVE-2022-46145 | High | 8.1 | 2022-12-02 | authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account tak… |
CVE-2022-43900 | Medium | 5.3 | 2022-12-01 | IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.2 could provide a weaker than expected security. A local attacker can create an outbound netwo… |
CVE-2022-36960 | High | 8.8 | 2022-11-29 | SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to e… |
CVE-2022-46146 | Medium | 6.2 | 2022-11-29 | Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and… |
CVE-2021-45036 | High | 8.7 | 2022-11-28 | Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the… |
CVE-2022-41912 | Critical | 9.1 | 2022-11-28 | The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion eleme… |
CVE-2022-36133 | Critical | 9.1 | 2022-11-25 | The WebConfig functionality of Epson TM-C3500 and TM-C7500 devices with firmware version WAM31500 allows authentication bypass. |
CVE-2022-37774 | Medium | 5.3 | 2022-11-23 | There is a broken access control vulnerability in the Maarch RM 2.8.3 solution. When accessing some specific document (pdf, email) from an archive, a preview i… |
CVE-2022-37931 | High | 7.3 | 2022-11-22 | A vulnerability in NetBatch-Plus software allows unauthorized access to the application. HPE has provided a workaround and fix. Please refer to HPE Security… |
CVE-2022-40602 | Critical | 9.8 | 2022-11-22 | A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an improper pre-configured… |
CVE-2022-20918 | High | 7.5 | 2022-11-15 | A vulnerability in the Simple Network Management Protocol (SNMP) access controls for Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER m… |
CVE-2022-25667 | High | 7.5 | 2022-11-15 | Information disclosure in kernel due to improper handling of ICMP requests in Snapdragon Wired Infrastructure and Networking |
CVE-2022-43690 | Medium | 6.3 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication byp… |
CVE-2022-3477 | Critical | 9.8 | 2022-11-14 | The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not prope… |
CVE-2022-34331 | Medium | 5.5 | 2022-11-11 | After performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly configured leading to desired VEPA configu… |
CVE-2022-37345 | High | 7.8 | 2022-11-11 | Improper authentication in BIOS firmware[A1] for some Intel(R) NUC Kits before version RY0386 may allow an authenticated user to potentially enable escalation… |
CVE-2022-36370 | High | 7.5 | 2022-11-11 | Improper authentication in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow a privileged user to potentially… |
CVE-2022-29893 | High | 8.1 | 2022-11-11 | Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an authenticated… |
CVE-2022-27874 | Medium | 6.8 | 2022-11-11 | Improper authentication in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable esca… |
CVE-2022-26845 | High | 8.7 | 2022-11-11 | Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an unauthenticat… |
CVE-2022-26508 | Medium | 4.3 | 2022-11-11 | Improper authentication in the Intel(R) SDP Tool before version 3.0.0 may allow an unauthenticated user to potentially enable information disclosure via networ… |
CVE-2022-21794 | High | 7.7 | 2022-11-11 | Improper authentication in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, Intel(R) NUC Kits before version HN0067… |
CVE-2021-33159 | High | 7.4 | 2022-11-11 | Improper authentication in subsystem for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow a privileged us… |
CVE-2022-39038 | High | 8.8 | 2022-11-10 | Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account t… |
CVE-2022-38119 | Critical | 9.8 | 2022-11-10 | UPSMON Pro login function has insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and get a… |
CVE-2022-44244 | Medium | 6.6 | 2022-11-09 | An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator. |
CVE-2022-39892 | Low | 3.6 | 2022-11-09 | Improper access control in Samsung Pass prior to version 4.0.05.1 allows attackers to unauthenticated access via keep open feature. |
CVE-2022-31686 | Critical | 9.8 | 2022-11-09 | VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist… |
CVE-2022-31685 | Critical | 9.8 | 2022-11-09 | VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious actor with network access to Workspace ONE Assist may b… |
CVE-2022-27510 | Critical | 9.8 | 2022-11-08 | Unauthorized access to Gateway user capabilities |
CVE-2022-39387 | Critical | 9.1 | 2022-11-04 | XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through… |
CVE-2022-43451 | High | 8.4 | 2022-11-03 | OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary dir… |
CVE-2022-32935 | Medium | 4.6 | 2022-11-01 | A lock screen issue was addressed with improved state management. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16, macOS Ventura 13… |
CVE-2022-32928 | Medium | 5.3 | 2022-11-01 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16, macOS Ventura 13, watchOS 9. A user in a privileged network position may… |
CVE-2022-2572 | Critical | 9.8 | 2022-11-01 | In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/dele… |
CVE-2022-39019 | Medium | 6.3 | 2022-10-31 | Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the applicatio… |
CVE-2022-39018 | High | 8.2 | 2022-10-31 | Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL. |
CVE-2022-41648 | Critical | 9.8 | 2022-10-28 | The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC communication for CNC machines. Authen… |
CVE-2022-39366 | Critical | 9.9 | 2022-10-28 | DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the sig… |
CVE-2022-37914 | Critical | 9.8 | 2022-10-28 | Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass aut… |
CVE-2022-37913 | Critical | 9.8 | 2022-10-28 | Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass aut… |
CVE-2022-38744 | High | 7.5 | 2022-10-27 | An unauthenticated attacker with network access to a victim's Rockwell Automation FactoryTalk Alarm and Events service could open a connection, causing the s… |
CVE-2022-40703 | Medium | 5.2 | 2022-10-26 | CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior on Android allows an unauthenticated attack… |
CVE-2022-39355 | Critical | 9.1 | 2022-10-26 | Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerab… |
CVE-2022-39360 | Medium | 6.5 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were a… |
CVE-2022-3674 | High | 7.3 | 2022-10-26 | A vulnerability has been found in SourceCodester Sanitization Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2022-26870 | High | 7.0 | 2022-10-21 | Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability… |
CVE-2022-43400 | Critical | 9.8 | 2022-10-21 | A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 (All versions < V22.2a (80)). The mobile server component of affected applicati… |
CVE-2022-42233 | Critical | 9.8 | 2022-10-20 | Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability. |
CVE-2022-37298 | Critical | 9.8 | 2022-10-20 | Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py i… |
CVE-2022-39267 | High | 8.8 | 2022-10-19 | Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Ver… |
CVE-2022-21618 | Medium | 5.3 | 2022-10-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Or… |
CVE-2022-40684 | Critical | 9.8 | 2022-10-18 | An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy versi… |
CVE-2022-31122 | Critical | 9.8 | 2022-10-18 | Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Confusion. If an attack… |
CVE-2022-22237 | Medium | 6.5 | 2022-10-18 | An Improper Authentication vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause an impact on con… |
CVE-2022-2533 | Medium | 6.5 | 2022-10-17 | An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions st… |
CVE-2022-23769 | High | 7.5 | 2022-10-17 | Remote code execution vulnerability due to insufficient user privilege verification in reverseWall-MDS. Remote attackers can exploit the vulnerability such as… |
CVE-2022-41436 | Critical | 9.1 | 2022-10-14 | An issue in OXHOO TP50 OXH1.50 allows unauthenticated attackers to access the administrative panel via browsing to the URL http://device_ip/index1.html. |
CVE-2022-38982 | Critical | 9.8 | 2022-10-14 | The fingerprint module has service logic errors.Successful exploitation of this vulnerability will cause the phone lock to be cracked. |
CVE-2022-42488 | High | 8.4 | 2022-10-14 | OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application instal… |
CVE-2022-42463 | High | 8.3 | 2022-10-14 | OpenHarmony-v3.1.2 and prior versions have an authenication bypass vulnerability in a callback handler function of Softbus_server in communication subsystem. A… |
CVE-2022-39229 | Medium | 4.3 | 2022-10-13 | Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's… |
CVE-2022-35135 | High | 8.8 | 2022-10-13 | Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/<uuid>. |
CVE-2021-36369 | High | 7.5 | 2022-10-12 | An issue was discovered in Dropbear through 2020.81. Due to a non-RFC-compliant check of the available authentication methods in the client-side SSH code, it i… |
CVE-2022-3465 | High | 7.3 | 2022-10-12 | A vulnerability classified as critical was found in Mediabridge Medialink. This vulnerability affects unknown code of the file /index.asp. The manipulation lea… |
CVE-2022-40664 | Critical | 9.8 | 2022-10-12 | Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher. |
CVE-2022-39290 | High | 8.0 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. In affected versions authenticated users can bypass CSRF keys by modifying th… |
CVE-2022-39289 | Critical | 9.1 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user… |
CVE-2022-21936 | High | 8.1 | 2022-10-07 | On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP… |
CVE-2022-40494 | Critical | 9.8 | 2022-10-06 | NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameter… |
CVE-2022-20662 | Medium | 6.1 | 2022-09-30 | A vulnerability in the smart card login authentication of Cisco Duo for macOS could allow an unauthenticated attacker with physical access to bypass authentica… |
CVE-2022-39254 | High | 8.6 | 2022-09-29 | matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their dev… |
CVE-2022-39252 | High | 8.6 | 2022-09-29 | matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, w… |