CWE-287 · Improper Authentication (page 20)
Page 20 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-39252 | High | 8.6 | 2022-09-29 | matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, w… |
CVE-2022-39250 | High | 8.6 | 2022-09-29 | Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malici… |
CVE-2021-40693 | Medium | 6.5 | 2022-09-29 | An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability. |
CVE-2022-39264 | High | 8.6 | 2022-09-28 | nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which cou… |
CVE-2022-39263 | Medium | 6.8 | 2022-09-28 | `@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` E… |
CVE-2022-39257 | High | 7.5 | 2022-09-28 | Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can co… |
CVE-2022-39255 | High | 8.6 | 2022-09-28 | Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can co… |
CVE-2022-39251 | High | 8.6 | 2022-09-28 | Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construc… |
CVE-2022-39249 | High | 7.5 | 2022-09-28 | Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construc… |
CVE-2022-39248 | High | 8.6 | 2022-09-28 | matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legi… |
CVE-2022-39246 | High | 7.5 | 2022-09-28 | matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing… |
CVE-2022-22523 | High | 7.5 | 2022-09-28 | An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows… |
CVE-2022-39245 | High | 8.4 | 2022-09-26 | Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` variable can allow… |
CVE-2022-39219 | High | 8.5 | 2022-09-26 | Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to… |
CVE-2022-3119 | High | 7.5 | 2022-09-26 | The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticate… |
CVE-2022-35248 | High | 8.8 | 2022-09-23 | A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be bypassed when telling the… |
CVE-2022-30124 | Medium | 6.8 | 2022-09-23 | An improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with physical access to a mobile device to byp… |
CVE-2021-45035 | Medium | 6.3 | 2022-09-23 | Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the… |
CVE-2022-39238 | Medium | 4.2 | 2022-09-23 | Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentication Modules (PAM)… |
CVE-2022-39231 | Low | 3.7 | 2022-09-23 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, v… |
CVE-2022-40616 | High | 8.1 | 2022-09-21 | IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass authentication and obtain sensitive information or perform tasks they sh… |
CVE-2021-33076 | Medium | 5.3 | 2022-09-20 | Improper authentication in firmware for some Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physi… |
CVE-2022-28321 | Critical | 9.8 | 2022-09-19 | The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict… |
CVE-2022-40144 | Critical | 9.8 | 2022-09-19 | A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authentication by falsifyin… |
CVE-2022-3218 | Critical | 9.8 | 2022-09-19 | Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can resul… |
CVE-2022-3173 | Medium | 4.3 | 2022-09-17 | Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10. |
CVE-2022-39009 | Critical | 9.8 | 2022-09-16 | The WLAN module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause third-party apps to affect WLAN functio… |
CVE-2021-42949 | Critical | 9.8 | 2022-09-16 | The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authe… |
CVE-2022-25652 | Critical | 9.0 | 2022-09-16 | Cryptographic issues in BSP due to improper hash verification in Snapdragon Wired Infrastructure and Networking |
CVE-2022-36436 | Critical | 9.8 | 2022-09-14 | OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerability that could al… |
CVE-2022-40622 | High | 8.8 | 2022-09-13 | The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore… |
CVE-2022-39205 | Critical | 9.0 | 2022-09-13 | Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev insta… |
CVE-2022-36106 | Medium | 5.4 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset… |
CVE-2022-39801 | High | 7.5 | 2022-09-13 | SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logo… |
CVE-2022-38700 | High | 8.8 | 2022-09-09 | OpenHarmony-v3.1.1 and prior versions have a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service. |
CVE-2022-38081 | Medium | 6.2 | 2022-09-09 | OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of… |
CVE-2022-38064 | Medium | 6.2 | 2022-09-09 | OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information. |
CVE-2022-36093 | High | 8.5 | 2022-09-08 | XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template… |
CVE-2022-36092 | High | 7.5 | 2022-09-08 | XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normall… |
CVE-2022-37164 | Critical | 9.8 | 2022-09-08 | Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Ad… |
CVE-2022-37163 | Critical | 9.8 | 2022-09-08 | Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force a… |
CVE-2022-20923 | Medium | 4.0 | 2022-09-08 | A vulnerability in the IPSec VPN Server authentication functionality of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthent… |
CVE-2022-38399 | Medium | 6.8 | 2022-09-08 | Missing protection mechanism for alternate hardware interface in SmaCam CS-QR10 all versions and SmaCam Night Vision CS-QR20 all versions allows an attacker to… |
CVE-2022-36073 | High | 8.3 | 2022-09-07 | RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's emai… |
CVE-2022-3152 | High | 8.8 | 2022-09-07 | Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20. |
CVE-2022-26858 | Medium | 6.1 | 2022-09-06 | Dell BIOS versions contain an Improper Authentication vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sen… |
CVE-2022-31020 | High | 8.8 | 2022-09-06 | Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request hand… |
CVE-2022-36071 | High | 8.3 | 2022-09-02 | SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time… |
CVE-2022-34380 | Critical | 9.3 | 2022-09-01 | Dell CloudLink 7.1.3 and all earlier versions contain an Authentication Bypass Using an Alternate Path or Channel Vulnerability. A high privileged local attack… |
CVE-2022-34379 | Critical | 9.4 | 2022-09-01 | Dell EMC CloudLink 7.1.2 and all prior versions contain an Authentication Bypass Vulnerability. A remote attacker, with the knowledge of the active directory u… |
CVE-2022-34372 | Critical | 9.8 | 2022-09-01 | Dell PowerProtect Cyber Recovery versions before 19.11.0.2 contain an authentication bypass vulnerability. A remote unauthenticated attacker may potentially ac… |
CVE-2022-38557 | Critical | 9.8 | 2022-08-28 | D-Link DIR845L v1.00-v1.03 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh. |
CVE-2022-38556 | Critical | 9.8 | 2022-08-28 | Trendnet TEW733GR v1.03B01 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh. |
CVE-2022-36755 | Critical | 9.8 | 2022-08-28 | D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZED_GROUP=1 value, as demonstrated by a request for getcfg.php. |
CVE-2021-3632 | High | 7.5 | 2022-08-26 | A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any u… |
CVE-2021-3979 | Medium | 6.5 | 2022-08-25 | A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to c… |
CVE-2022-2031 | High | 8.8 | 2022-08-25 | A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt… |
CVE-2021-4142 | Medium | 5.5 | 2022-08-24 | The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple conten… |
CVE-2022-35726 | Medium | 4.3 | 2022-08-23 | Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress. |
CVE-2021-3827 | Medium | 6.8 | 2022-08-23 | A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can… |
CVE-2022-35203 | High | 7.2 | 2022-08-23 | An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system information. |
CVE-2022-34919 | Critical | 9.8 | 2022-08-23 | The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenticated. By uploading a crafted aspx file… |
CVE-2022-32282 | High | 8.8 | 2022-08-22 | An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash w… |
CVE-2022-34149 | Critical | 9.8 | 2022-08-22 | Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress. |
CVE-2022-22730 | Critical | 9.8 | 2022-08-18 | Improper authentication in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an unauthenticated user to potentially enable esca… |
CVE-2022-35198 | High | 7.5 | 2022-08-18 | Contract Management System v2.0 contains a weak default password which gives attackers to access database connection information. |
CVE-2022-2336 | Critical | 9.8 | 2022-08-17 | Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admi… |
CVE-2022-2662 | Critical | 9.6 | 2022-08-16 | Sequi PortBloque S has a improper authentication issues which may allow an attacker to bypass the authentication process and gain user-level access to the devi… |
CVE-2022-38368 | High | 8.8 | 2022-08-15 | An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated… |
CVE-2022-36524 | High | 7.5 | 2022-08-15 | D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Static Default Credentials via /etc/init0.d/S80telnetd.sh. |
CVE-2022-37397 | High | 8.3 | 2022-08-12 | An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticat… |
CVE-2022-2503 | Medium | 6.9 | 2022-08-12 | Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root f… |
CVE-2022-38180 | Medium | 5.3 | 2022-08-12 | In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases |
CVE-2022-2765 | Medium | 6.3 | 2022-08-11 | A vulnerability was found in SourceCodester Company Website CMS 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2022-32429 | Critical | 9.8 | 2022-08-10 | An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unaut… |
CVE-2022-29083 | Medium | 6.8 | 2022-08-09 | Prior Dell BIOS versions contain an Improper Authentication vulnerability. An unauthenticated attacker with physical access to the system could potentially exp… |
CVE-2022-36296 | Medium | 6.5 | 2022-08-05 | Broken Authentication vulnerability in JumpDEMAND Inc. ActiveDEMAND plugin <= 0.2.27 at WordPress allows unauthenticated post update/create/delete. |
CVE-2022-33732 | Medium | 6.2 | 2022-08-05 | Improper access control vulnerability in Samsung Dex for PC prior to SMR Aug-2022 Release 1 allows local attackers to scan and connect to PC by unprotected bin… |
CVE-2022-33720 | Low | 2.4 | 2022-08-05 | Improper authentication vulnerability in AppLock prior to SMR Aug-2022 Release 1 allows physical attacker to access Chrome locked by AppLock via new tap shortc… |
CVE-2022-2303 | Medium | 4.3 | 2022-08-05 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15… |
CVE-2022-2664 | High | 7.3 | 2022-08-05 | A vulnerability classified as critical has been found in Private Cloud Management Platform. Affected is an unknown function of the file /management/api/rcx_man… |
CVE-2022-35142 | High | 7.5 | 2022-08-04 | An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter. |
CVE-2022-27484 | Medium | 5.4 | 2022-08-03 | A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypass the Old Password… |
CVE-2022-35925 | Medium | 5.3 | 2022-08-02 | BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force at… |
CVE-2022-35629 | Medium | 5.4 | 2022-07-29 | Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, t… |
CVE-2016-0796 | High | 7.5 | 2022-07-28 | WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vul… |
CVE-2022-2553 | Medium | 6.5 | 2022-07-28 | The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do no… |
CVE-2022-30270 | Critical | 9.8 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 has default credentials. It exposes an SSH interface on port 22/TCP. This interface is used for remote maintenance… |
CVE-2022-36412 | Critical | 9.8 | 2022-07-26 | In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. (An API request may, in effect, be executed with… |
CVE-2022-34575 | Medium | 5.7 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing fct… |
CVE-2022-34839 | Medium | 5.9 | 2022-07-22 | Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress. |
CVE-2022-31164 | High | 7.5 | 2022-07-22 | Tovy is a a staff management system for Roblox groups. A vulnerability in versions prior to 0.7.51 allows users to log in as other users, including privileged… |
CVE-2022-28666 | Medium | 5.3 | 2022-07-21 | Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-content-toggle option… |
CVE-2022-26136 | Critical | 9.8 | 2022-07-20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impa… |
CVE-2022-2141 | Critical | 9.8 | 2022-07-20 | SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication. |
CVE-2022-34535 | High | 7.5 | 2022-07-19 | Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows unauthenticated attackers to view internal paths and scripts via web files. |
CVE-2022-30624 | Medium | 6.8 | 2022-07-18 | Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password. |
CVE-2022-30623 | Medium | 5.9 | 2022-07-18 | The server checks the user's cookie in a non-standard way, and a value is entered in the cookie value name of the status and its value is set to true to bypass… |
CVE-2021-40874 | Critical | 9.8 | 2022-07-18 | An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST password validation service (for anothe… |
CVE-2022-30550 | High | 8.8 | 2022-07-17 | An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args s… |