CWE-287 · Improper Authentication (page 21)
Page 21 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2133 | Medium | 5.3 | 2022-07-17 | The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto th… |
CVE-2017-20133 | High | 7.3 | 2022-07-16 | A vulnerability, which was classified as critical, was found in Itech Job Portal Script 9.13. This affects an unknown part of the file /admin. The manipulation… |
CVE-2022-33689 | Medium | 6.2 | 2022-07-12 | Improper access control vulnerability in TelephonyUI prior to SMR Jul-2022 Release 1 allows attackers to change preferred network type by unprotected binder ca… |
CVE-2022-30755 | High | 7.3 | 2022-07-12 | Improper authentication vulnerability in AppLock prior to SMR Jul-2022 Release 1 allows attacker to bypass password confirm activity by hijacking the implicit… |
CVE-2022-33736 | High | 7.5 | 2022-07-12 | A vulnerability has been identified in Opcenter Quality V13.1 (All versions < V13.1.20220624), Opcenter Quality V13.2 (All versions < V13.2.20220624). The affe… |
CVE-2022-2302 | Critical | 9.8 | 2022-07-11 | Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote at… |
CVE-2015-5298 | Medium | 6.5 | 2022-07-07 | The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be… |
CVE-2022-31131 | Medium | 5.4 | 2022-07-06 | Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership… |
CVE-2022-31125 | Critical | 10.0 | 2022-07-06 | Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated… |
CVE-2021-43116 | High | 8.8 | 2022-07-05 | An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change… |
CVE-2022-28713 | Medium | 5.3 | 2022-07-04 | Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information withou… |
CVE-2021-41995 | High | 7.7 | 2022-06-30 | A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass. |
CVE-2022-2197 | Critical | 9.8 | 2022-06-30 | By using a specific credential string, an attacker with network access to the device’s web interface could circumvent the authentication scheme and perform adm… |
CVE-2022-1955 | Medium | 4.6 | 2022-06-30 | Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possib… |
CVE-2021-41506 | Critical | 9.8 | 2022-06-30 | Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.2… |
CVE-2022-29858 | Medium | 4.3 | 2022-06-28 | Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changing an existing ima… |
CVE-2022-33202 | High | 8.1 | 2022-06-27 | Authentication bypass vulnerability in the setup screen of L2Blocker(on-premise) Ver4.8.5 and earlier and L2Blocker(Cloud) Ver4.8.5 and earlier allows an adjac… |
CVE-2022-29578 | Medium | 5.3 | 2022-06-24 | Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address, and daily energy… |
CVE-2021-41638 | High | 7.5 | 2022-06-24 | The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files only by using a valid… |
CVE-2021-26638 | High | 7.3 | 2022-06-23 | Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and information exposure. Remote attackers can us… |
CVE-2021-26637 | High | 8.8 | 2022-06-23 | There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unauthorized users can… |
CVE-2022-29775 | Critical | 9.8 | 2022-06-21 | iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL. |
CVE-2022-33139 | Critical | 9.8 | 2022-06-21 | A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All ver… |
CVE-2022-1801 | High | 7.5 | 2022-06-20 | The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as… |
CVE-2022-31083 | High | 8.6 | 2022-06-17 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in… |
CVE-2022-32276 | High | 7.5 | 2022-06-17 | Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability |
CVE-2020-36548 | Medium | 5.9 | 2022-06-17 | A vulnerability classified as problematic has been found in GE Voluson S8. Affected is the file /uscgi-bin/users.cgi of the Service Browser. The manipulation l… |
CVE-2018-25043 | Medium | 5.0 | 2022-06-17 | A vulnerability classified as critical was found in uTorrent. This vulnerability affects unknown code of the component PRNG. The manipulation leads to weak aut… |
CVE-2022-33750 | Critical | 9.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an authentication error vulnerability in the Automic agent that could allow a remote attacker to potentially execut… |
CVE-2018-18907 | High | 7.5 | 2022-06-16 | An issue was discovered on D-Link DIR-850L 1.21WW devices. A partially completed WPA handshake is sufficient for obtaining full access to the wireless network… |
CVE-2022-29865 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials. |
CVE-2022-30150 | High | 7.5 | 2022-06-15 | Windows Defender Remote Credential Guard Elevation of Privilege Vulnerability |
CVE-2022-21935 | High | 7.5 | 2022-06-15 | A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change. |
CVE-2022-20798 | Critical | 9.8 | 2022-06-15 | A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA)… |
CVE-2022-20733 | Medium | 5.3 | 2022-06-15 | A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and acc… |
CVE-2022-30229 | High | 7.2 | 2022-06-14 | A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does not require authenticated access for pri… |
CVE-2021-35094 | High | 7.8 | 2022-06-14 | Improper verification of timeout-based authentication in identity credential can lead to invalid authorization in HLOS in Snapdragon Auto, Snapdragon Compute… |
CVE-2022-22259 | Medium | 6.8 | 2022-06-13 | There is an improper authentication vulnerability in FLMG-10 10.0.1.0(H100SP22C00). Successful exploitation of this vulnerability may lead to a control of the… |
CVE-2022-30749 | Low | 3.3 | 2022-06-07 | Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity. |
CVE-2020-36533 | Low | 3.7 | 2022-06-07 | A vulnerability was found in Klapp App and classified as problematic. This issue affects some unknown processing of the JSON Web Token Handler. The manipulatio… |
CVE-2020-36528 | Medium | 5.5 | 2022-06-07 | A vulnerability, which was classified as critical, was found in Platinum Mobile 1.0.4.850. Affected is /MobileHandler.ashx which leads to broken access control… |
CVE-2022-30238 | High | 8.3 | 2022-06-02 | A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacks a session. Affecte… |
CVE-2022-31463 | High | 8.2 | 2022-06-02 | Owl Labs Meeting Owl 5.2.0.15 does not require a password for Bluetooth commands, because only client-side authentication is used. |
CVE-2022-30034 | High | 8.6 | 2022-06-02 | Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then acc… |
CVE-2022-26975 | High | 7.5 | 2022-06-02 | Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing log files without authentication. |
CVE-2022-31013 | Critical | 9.1 | 2022-05-31 | Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token… |
CVE-2022-31011 | High | 7.8 | 2022-05-31 | TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) workloads. Under certain conditions, an attacker can… |
CVE-2022-26724 | Medium | 5.5 | 2022-05-26 | An authentication issue was addressed with improved state management. This issue is fixed in tvOS 15.5. A local user may be able to enable iCloud Photos withou… |
CVE-2022-22576 | High | 8.1 | 2022-05-26 | An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properl… |
CVE-2022-26865 | Medium | 6.8 | 2022-05-26 | Dell Support Assist OS Recovery versions before 5.5.2 contain an Authentication Bypass vulnerability. An unauthenticated attacker with physical access to the s… |
CVE-2022-24422 | Critical | 9.6 | 2022-05-26 | Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker may pote… |
CVE-2021-4230 | Low | 3.7 | 2022-05-24 | A vulnerability has been found in Airfield Online and classified as problematic. This vulnerability affects the path /backups/ of the MySQL backup handler. An… |
CVE-2013-10004 | Medium | 6.5 | 2022-05-24 | A vulnerability classified as critical was found in Telecommunication Software SAMwin Contact Center Suite 5.1. This vulnerability affects the function passwor… |
CVE-2022-29237 | Medium | 5.4 | 2022-05-24 | Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users could pass along URL… |
CVE-2022-0910 | Medium | 6.5 | 2022-05-24 | A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 thro… |
CVE-2022-29165 | Critical | 10.0 | 2022-05-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 a… |
CVE-2021-30028 | High | 7.2 | 2022-05-20 | SOOTEWAY Wi-Fi Range Extender v1.5 was discovered to use default credentials (the admin password for the admin account) to access the TELNET service, allowing… |
CVE-2022-29883 | Medium | 5.3 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not restrict unauthenticated access to certain pages of the web inter… |
CVE-2022-28106 | Critical | 9.8 | 2022-05-20 | Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request. |
CVE-2021-42849 | Medium | 6.8 | 2022-05-18 | A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attack… |
CVE-2022-28955 | High | 7.5 | 2022-05-18 | An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php. |
CVE-2022-1349 | Medium | 4.3 | 2022-05-16 | The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_… |
CVE-2022-22796 | High | 7.0 | 2022-05-12 | Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click… |
CVE-2021-33083 | Medium | 4.4 | 2022-05-12 | Improper authentication in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products may allow an privil… |
CVE-2021-0193 | High | 7.2 | 2022-05-12 | Improper authentication in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of pr… |
CVE-2022-1681 | High | 7.2 | 2022-05-12 | Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions |
CVE-2022-1426 | Low | 2.0 | 2022-05-11 | An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions sta… |
CVE-2019-12254 | Critical | 9.8 | 2022-05-06 | In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for savi… |
CVE-2021-26253 | High | 8.1 | 2022-05-06 | A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6… |
CVE-2022-21934 | High | 8.0 | 2022-05-06 | Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 version… |
CVE-2021-44057 | High | 7.1 | 2022-05-05 | An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows attackers to co… |
CVE-2021-44056 | High | 7.1 | 2022-05-05 | An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to co… |
CVE-2022-24901 | High | 7.5 | 2022-05-04 | Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication, making the server v… |
CVE-2022-28790 | Medium | 4.0 | 2022-05-03 | Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device. The patch adds proper caller signature check l… |
CVE-2022-0916 | High | 8.4 | 2022-05-03 | An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks duri… |
CVE-2022-23723 | High | 7.7 | 2022-05-02 | An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow. |
CVE-2022-23722 | Medium | 6.5 | 2022-05-02 | When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authenticatio… |
CVE-2021-41992 | High | 7.7 | 2022-04-30 | A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass. |
CVE-2022-0985 | Medium | 4.3 | 2022-04-29 | Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete c… |
CVE-2022-24885 | Low | 2.0 | 2022-04-27 | Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.1, users can bypass a lock on the Nextclo… |
CVE-2022-24883 | High | 7.4 | 2022-04-26 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be success… |
CVE-2022-24882 | Critical | 9.1 | 2022-04-26 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort… |
CVE-2021-36460 | High | 7.8 | 2022-04-25 | VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the ba… |
CVE-2021-45841 | High | 8.1 | 2022-04-25 | In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's passw… |
CVE-2022-29534 | High | 7.5 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/jso… |
CVE-2022-0540 | Critical | 9.8 | 2022-04-20 | A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atl… |
CVE-2021-26627 | High | 7.5 | 2022-04-19 | Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerability could allow to remote attackers to se… |
CVE-2022-1065 | High | 8.1 | 2022-04-19 | A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus… |
CVE-2021-3652 | Medium | 6.5 | 2022-04-18 | A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any passwor… |
CVE-2022-24857 | High | 7.3 | 2022-04-15 | django-mfa3 is a library that implements multi factor authentication for the django web framework. It achieves this by modifying the regular login view. Django… |
CVE-2022-20695 | Critical | 10.0 | 2022-04-15 | A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to bypass a… |
CVE-2022-26034 | Critical | 9.1 | 2022-04-15 | Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Smal… |
CVE-2022-22956 | Critical | 9.8 | 2022-04-13 | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may… |
CVE-2022-27839 | Low | 3.3 | 2022-04-11 | Improper authentication vulnerability in SecretMode in Samsung Internet prior to version 16.2.1 allows attackers to access bookmark tab without proper credenti… |
CVE-2022-26091 | Medium | 5.7 | 2022-04-11 | Improper access control vulnerability in Knox Manage prior to SMR Apr-2022 Release 1 allows that physical attackers can bypass Knox Manage using a function key… |
CVE-2022-25833 | Low | 3.3 | 2022-04-11 | Improper authentication in ImsService prior to SMR Apr-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE permission. |
CVE-2022-25832 | Medium | 4.0 | 2022-04-11 | Improper authentication vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to use locked Myfiles app without authentication. |
CVE-2022-1067 | Medium | 6.5 | 2022-04-11 | Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting. |
CVE-2021-46740 | High | 7.5 | 2022-04-11 | The device authentication service module has a defect vulnerability introduced in the design process.Successful exploitation of this vulnerability may affect d… |
CVE-2022-1248 | High | 7.3 | 2022-04-06 | A vulnerability was found in SAP Information System 1.0 which has been rated as critical. Affected by this issue is the file /SAP_Information_System/controller… |