CWE-287 · Improper Authentication (page 20)
Page 20 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38585 | High | 8.8 | 2023-08-23 | Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its… |
CVE-2023-25913 | High | 7.5 | 2023-08-21 | Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, u… |
CVE-2023-4373 | Critical | 9.8 | 2023-08-21 | Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a… |
CVE-2023-4415 | High | 7.3 | 2023-08-18 | A vulnerability was found in Ruijie RG-EW1200G 07161417 r483. It has been rated as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2023-39415 | High | 7.5 | 2023-08-18 | Improper authentication vulnerability in Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail… |
CVE-2023-33237 | High | 8.8 | 2023-08-17 | TN-5900 Series firmware version v3.3 and prior is vulnerable to improper-authentication vulnerability. This vulnerability arises from inadequate authentication… |
CVE-2023-39846 | Critical | 9.8 | 2023-08-16 | An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token. |
CVE-2023-32453 | Medium | 4.6 | 2023-08-16 | Dell BIOS contains an improper authentication vulnerability. A malicious user with physical access to the system may potentially exploit this vulnerability in… |
CVE-2023-35082 | Critical | 9.8 | 2023-08-15 | An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the applica… |
CVE-2023-40020 | Critical | 9.9 | 2023-08-14 | PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctl… |
CVE-2023-3263 | High | 7.5 | 2023-08-14 | The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of spec… |
CVE-2023-39380 | High | 7.5 | 2023-08-13 | Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause audio devices to perform abnormally. |
CVE-2023-40260 | Critical | 9.1 | 2023-08-11 | EmpowerID before 7.205.0.1 allows an attacker to bypass an MFA (multi factor authentication) requirement if the first factor (username and password) is known… |
CVE-2023-40253 | Medium | 6.0 | 2023-08-11 | Improper Authentication vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Authentica… |
CVE-2023-39531 | Medium | 6.5 | 2023-08-09 | Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 23.7.2, an attacker with sufficient client-sid… |
CVE-2023-4242 | Medium | 4.3 | 2023-08-09 | The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to impr… |
CVE-2023-21626 | High | 7.1 | 2023-08-08 | Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key. |
CVE-2023-36926 | Low | 3.7 | 2023-08-08 | Due to missing authentication check in SAP Host Agent - version 7.22, an unauthenticated attacker can set an undocumented parameter to a particular compatibili… |
CVE-2023-39349 | High | 8.1 | 2023-08-07 | Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token wit… |
CVE-2023-32090 | Critical | 9.8 | 2023-08-07 | Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials |
CVE-2023-0264 | Medium | 5.0 | 2023-08-04 | A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain infor… |
CVE-2023-39112 | Medium | 6.5 | 2023-08-04 | ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel. |
CVE-2023-38691 | Medium | 5.0 | 2023-08-04 | matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can… |
CVE-2023-20214 | Critical | 9.1 | 2023-08-03 | A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to g… |
CVE-2023-33363 | High | 7.5 | 2023-08-03 | An authentication bypass vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated users to access some functionality on BioStar 2 s… |
CVE-2023-34196 | High | 8.2 | 2023-08-03 | In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue… |
CVE-2023-1935 | Critical | 9.4 | 2023-08-02 | ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the devic… |
CVE-2023-3470 | Medium | 6.0 | 2023-08-02 | Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the p… |
CVE-2023-33563 | High | 8.8 | 2023-08-01 | In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attack… |
CVE-2023-3622 | Medium | 4.3 | 2023-07-26 | Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to read arbitrary resource |
CVE-2023-38555 | High | 8.8 | 2023-07-26 | Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change… |
CVE-2023-2626 | High | 7.5 | 2023-07-25 | There exists an authentication bypass vulnerability in OpenThread border router devices and implementations. This issue allows unauthenticated nodes to craft r… |
CVE-2023-35078 | Critical | 9.8 | 2023-07-25 | An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without prop… |
CVE-2023-37918 | Medium | 6.8 | 2023-07-21 | Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypas… |
CVE-2023-37471 | Critical | 9.1 | 2023-07-20 | Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Se… |
CVE-2023-3638 | Critical | 9.8 | 2023-07-19 | In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application. |
CVE-2023-27877 | Medium | 5.3 | 2023-07-19 | IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB se… |
CVE-2022-34155 | High | 8.8 | 2023-07-18 | Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Sing… |
CVE-2023-37266 | Critical | 9.8 | 2023-07-17 | CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and… |
CVE-2023-3591 | Medium | 4.8 | 2023-07-17 | Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created. |
CVE-2023-2959 | High | 7.5 | 2023-07-17 | Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users. This issue affects Ol… |
CVE-2023-35901 | Low | 2.7 | 2023-07-17 | IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could allow invalid chang… |
CVE-2023-37268 | Medium | 6.4 | 2023-07-14 | Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may au… |
CVE-2023-36466 | Low | 3.5 | 2023-07-14 | Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for t… |
CVE-2023-2975 | Medium | 5.3 | 2023-07-14 | Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequen… |
CVE-2023-30560 | Medium | 6.8 | 2023-07-13 | The configuration from the PCU can be modified without authentication using physical connection to the PCU. |
CVE-2023-30559 | Medium | 5.2 | 2023-07-13 | The firmware update package for the wireless card is not properly signed and can be modified. |
CVE-2023-34137 | Critical | 9.8 | 2023-07-13 | SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerabil… |
CVE-2023-34124 | Critical | 9.8 | 2023-07-13 | The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2… |
CVE-2023-33274 | Critical | 9.8 | 2023-07-12 | The authentication mechanism in PowerShield SNMP Web Pro 1.1 contains a vulnerability that allows unauthenticated users to directly access Common Gateway Inter… |
CVE-2023-31007 | Unrated | | 2023-07-12 | Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication dat… |
CVE-2023-3127 | High | 7.5 | 2023-07-11 | An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights. |
CVE-2023-31190 | High | 8.1 | 2023-07-11 | DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an Improper Authentication vulnerability during the firmware update procedure. Sp… |
CVE-2023-30675 | Medium | 6.2 | 2023-07-06 | Improper authentication in Samsung Pass prior to version 4.2.03.1 allows local attacker to access stored account information when Samsung Wallet is not install… |
CVE-2023-35940 | High | 7.5 | 2023-07-05 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an u… |
CVE-2023-32620 | Medium | 6.5 | 2023-06-30 | Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireles… |
CVE-2023-33190 | Critical | 9.9 | 2023-06-29 | Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration… |
CVE-2023-32222 | Critical | 9.8 | 2023-06-28 | D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method. |
CVE-2023-20199 | Medium | 6.2 | 2023-06-28 | A vulnerability in Cisco Duo Two-Factor Authentication for macOS could allow an authenticated, physical attacker to bypass secondary authentication and access… |
CVE-2023-30945 | Critical | 9.8 | 2023-06-26 | Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary… |
CVE-2023-32524 | High | 8.8 | 2023-06-26 | Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentia… |
CVE-2023-32523 | High | 8.8 | 2023-06-26 | Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentia… |
CVE-2023-35154 | High | 7.2 | 2023-06-23 | Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can register and activat… |
CVE-2023-28073 | High | 8.2 | 2023-06-23 | Dell BIOS contains an improper authentication vulnerability. A locally authenticated malicious user may potentially exploit this vulnerability by bypassing ce… |
CVE-2023-3326 | Critical | 9.8 | 2023-06-22 | pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Ce… |
CVE-2023-34340 | Critical | 9.8 | 2023-06-21 | Improper Authentication vulnerability in Apache Software Foundation Apache Accumulo. This issue affects Apache Accumulo: 2.1.0. Accumulo 2.1.0 contains a defe… |
CVE-2023-3337 | High | 7.3 | 2023-06-20 | A vulnerability was found in PuneethReddyHC Online Shopping System Advanced 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2022-48496 | High | 7.5 | 2023-06-19 | Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to bec… |
CVE-2022-48494 | High | 7.5 | 2023-06-19 | Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to bec… |
CVE-2023-30223 | High | 7.5 | 2023-06-16 | A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to send crafted TCP packets containing reques… |
CVE-2023-34367 | Medium | 6.5 | 2023-06-14 | Windows 7 is vulnerable to a full blind TCP/IP hijacking attack. The vulnerability exists in Windows 7 (any Windows until Windows 8) and in any implementation… |
CVE-2023-2638 | Medium | 5.9 | 2023-06-13 | Rockwell Automation's FactoryTalk System Services does not verify that a backup configuration archive is password protected. Improper authorization in FTS… |
CVE-2023-20867 | Low | 3.9 | 2023-06-13 | A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest… |
CVE-2023-30762 | Critical | 9.8 | 2023-06-13 | Improper authentication vulnerability exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed o… |
CVE-2023-29129 | Critical | 9.1 | 2023-06-13 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >… |
CVE-2023-32220 | High | 8.2 | 2023-06-12 | Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method. |
CVE-2023-34246 | Medium | 4.2 | 2023-06-12 | Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user con… |
CVE-2023-33553 | Critical | 9.8 | 2023-06-07 | An issue in Planet Technologies WDRT-1800AX v1.01-CP21 allows attackers to bypass authentication and escalate privileges to root via manipulation of the LoginS… |
CVE-2023-32682 | Medium | 5.4 | 2023-06-06 | Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login w… |
CVE-2022-40536 | High | 7.5 | 2023-06-06 | Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network. |
CVE-2022-40521 | High | 7.5 | 2023-06-06 | Transient DOS due to improper authorization in Modem |
CVE-2023-3065 | Critical | 9.1 | 2023-06-05 | Improper Authentication vulnerability in Mobatime mobile application AMXGT100 allows Authentication Bypass.This issue affects Mobatime mobile application AMXGT… |
CVE-2023-3069 | Critical | 9.8 | 2023-06-02 | Unverified Password Change in GitHub repository tsolucio/corebos prior to 8. |
CVE-2023-3028 | High | 8.6 | 2023-06-01 | Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles us… |
CVE-2023-2283 | Medium | 6.5 | 2023-05-26 | A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memo… |
CVE-2023-0117 | Medium | 5.3 | 2023-05-26 | The online authentication provided by the hwKitAssistant lacks strict identity verification of applications. Successful exploitation of this vulnerability may… |
CVE-2023-27388 | Critical | 9.8 | 2023-05-23 | Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to login to the prod… |
CVE-2023-25946 | High | 8.8 | 2023-05-23 | Authentication bypass vulnerability in Qrio Lock (Q-SL2) firmware version 2.0.9 and earlier allows a network-adjacent attacker to analyze the product's communi… |
CVE-2023-2586 | Critical | 9.0 | 2023-05-22 | Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices through the RMS pla… |
CVE-2023-32347 | High | 8.1 | 2023-05-22 | Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the user perspective for de… |
CVE-2023-2024 | Critical | 10.0 | 2023-05-18 | Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstanc… |
CVE-2023-0863 | High | 8.8 | 2023-05-17 | Improper Authentication vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC… |
CVE-2023-2706 | High | 8.1 | 2023-05-17 | The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes f… |
CVE-2023-2499 | Critical | 9.8 | 2023-05-16 | The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verifi… |
CVE-2023-23450 | Medium | 6.2 | 2023-05-15 | Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524… |
CVE-2023-32081 | Medium | 6.5 | 2023-05-12 | Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4… |
CVE-2023-27823 | Critical | 9.8 | 2023-05-12 | An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials. |
CVE-2023-32243 | Critical | 9.8 | 2023-05-12 | Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elemen… |
CVE-2023-29032 | High | 8.1 | 2023-05-12 | An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected… |
CVE-2023-28325 | Medium | 6.5 | 2023-05-11 | An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage metho… |