CWE-287 · Improper Authentication (page 21)
Page 21 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0858 | Low | 3.1 | 2023-05-11 | Improper Authentication of RemoteUI of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to… |
CVE-2023-31152 | Medium | 4.0 | 2023-05-10 | An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC)… |
CVE-2022-41985 | High | 8.6 | 2023-05-10 | An authentication bypass vulnerability exists in the Authentication functionality of Weston Embedded uC-FTPs v 1.98.00. A specially crafted set of network pack… |
CVE-2022-44610 | Medium | 5.4 | 2023-05-10 | Improper authentication in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via netwo… |
CVE-2023-27919 | Medium | 5.3 | 2023-05-10 | Authentication bypass vulnerability in NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) all versions allows a remote unauthenticated attacker to alter t… |
CVE-2023-28125 | Medium | 5.9 | 2023-05-09 | An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to the server by regi… |
CVE-2023-31127 | Critical | 9.0 | 2023-05-08 | libspdm is a sample implementation that follows the DMTF SPDM specifications. A vulnerability has been identified in SPDM session establishment in libspdm prio… |
CVE-2023-31123 | Critical | 9.1 | 2023-05-08 | `effectindex/tripreporter` is a community-powered, universal platform for submitting and analyzing trip reports. Prior to commit bd80ba833b9023d39ca22e29874296… |
CVE-2023-28182 | Medium | 6.5 | 2023-05-08 | The issue was addressed with improved authentication. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS… |
CVE-2023-30328 | Critical | 9.8 | 2023-05-04 | An issue in the helper tool of Mailbutler GmbH Shimo VPN Client for macOS v5.0.4 allows attackers to bypass authentication via PID re-use. |
CVE-2023-21487 | Medium | 5.1 | 2023-05-04 | Improper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows local attackers to change a call setting. |
CVE-2023-21484 | Medium | 5.1 | 2023-05-04 | Improper access control vulnerability in AppLock prior to SMR May-2023 Release 1 allows local attackers without proper permission to execute a privileged opera… |
CVE-2022-45860 | Medium | 5.3 | 2023-05-03 | A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versi… |
CVE-2022-30995 | High | 7.5 | 2023-05-03 | Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29… |
CVE-2023-30869 | Critical | 9.8 | 2023-05-02 | Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1… |
CVE-2022-35898 | Critical | 9.8 | 2023-05-01 | OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation. This allows any authenticated user to change the p… |
CVE-2023-30063 | High | 7.5 | 2023-05-01 | D-Link DIR-890L FW1.10 A1 is vulnerable to Authentication bypass. |
CVE-2023-30061 | High | 7.5 | 2023-05-01 | D-Link DIR-879 v105A1 is vulnerable to Authentication Bypass via phpcgi. |
CVE-2023-1477 | High | 7.2 | 2023-04-28 | Improper Authentication vulnerability in HYPR Keycloak Authenticator Extension allows Authentication Abuse.This issue affects HYPR Keycloak Authenticator Exten… |
CVE-2023-28473 | Low | 3.3 | 2023-04-28 | Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section. |
CVE-2023-1778 | Critical | 10.0 | 2023-04-27 | This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default credentials which allows… |
CVE-2023-2297 | Critical | 9.8 | 2023-04-27 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and includi… |
CVE-2023-30845 | High | 8.2 | 2023-04-26 | ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 contains an authentication… |
CVE-2022-45456 | High | 7.5 | 2023-04-26 | Denial of service due to unauthenticated API endpoint. The following products are affected: Acronis Agent (Windows, macOS, Linux) before build 30161. |
CVE-2022-40723 | Medium | 6.5 | 2023-04-25 | The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations. |
CVE-2023-25131 | Critical | 9.4 | 2023-04-24 | Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and… |
CVE-2023-0209 | High | 8.2 | 2023-04-22 | NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary… |
CVE-2023-27351 | High | 7.5 | 2023-04-20 | This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not requir… |
CVE-2023-25601 | Medium | 4.3 | 2023-04-20 | On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack wit… |
CVE-2023-22893 | High | 7.5 | 2023-04-19 | Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A rem… |
CVE-2023-25556 | High | 8.3 | 2023-04-18 | A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the at… |
CVE-2021-40507 | Critical | 9.8 | 2023-04-18 | An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not being updated corre… |
CVE-2021-40506 | Critical | 9.8 | 2023-04-18 | An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not being updated for t… |
CVE-2023-28973 | High | 7.1 | 2023-04-17 | An Improper Authorization vulnerability in the 'sysmanctl' shell command of Juniper Networks Junos OS Evolved allows a local, authenticated attacker to execute… |
CVE-2023-28963 | Medium | 5.3 | 2023-04-17 | An Improper Authentication vulnerability in cert-mgmt.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based at… |
CVE-2023-28962 | Medium | 5.3 | 2023-04-17 | An Improper Authentication vulnerability in upload-file.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based… |
CVE-2023-24831 | Critical | 9.8 | 2023-04-17 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3… |
CVE-2022-48314 | Medium | 6.5 | 2023-04-16 | The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect co… |
CVE-2023-2027 | Critical | 9.8 | 2023-04-15 | The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is due to insufficient v… |
CVE-2023-25597 | Medium | 5.9 | 2023-04-14 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a cra… |
CVE-2023-1833 | Critical | 9.8 | 2023-04-14 | Authentication Bypass by Primary Weakness vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass. This issue affects Redline Ro… |
CVE-2023-1803 | Critical | 9.8 | 2023-04-14 | Authentication Bypass by Alternate Name vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass. This issue affects Redline Rout… |
CVE-2022-45174 | Critical | 9.8 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication for SAML Users can occur under the /login/backup_cod… |
CVE-2022-45173 | Critical | 9.8 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /api/v1/vdeskintegration/challen… |
CVE-2023-1617 | Critical | 9.8 | 2023-04-14 | Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based… |
CVE-2023-28121 | Critical | 9.8 | 2023-04-12 | An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated u… |
CVE-2023-1980 | Medium | 6.5 | 2023-04-11 | Two factor authentication bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to cancel the two factor authentication via… |
CVE-2023-23761 | High | 7.7 | 2023-04-07 | An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users' secret gists by a… |
CVE-2023-27091 | High | 7.2 | 2023-04-04 | An unauthorized access issue found in XiaoBingby TeaCMS 2.3.3 allows attackers to escalate privileges via the id and keywords parameter(s). |
CVE-2023-1752 | High | 8.1 | 2023-04-04 | The listed versions of Nexx Smart Home devices could allow any user to register an already registered alarm or associated device with only the device’s MAC add… |
CVE-2021-28235 | Critical | 9.8 | 2023-04-04 | Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function. |
CVE-2023-1784 | Medium | 5.3 | 2023-03-31 | A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The ma… |
CVE-2023-28862 | Critical | 9.8 | 2023-03-31 | An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password ch… |
CVE-2023-28727 | Critical | 9.6 | 2023-03-31 | Panasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass authentication due to mishandling of X-Forwarded-For headers. |
CVE-2023-27538 | Medium | 5.5 | 2023-03-30 | An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH o… |
CVE-2023-27536 | Medium | 5.9 | 2023-03-30 | An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect… |
CVE-2023-27535 | Medium | 5.9 | 2023-03-30 | An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subs… |
CVE-2023-28647 | Medium | 4.4 | 2023-03-30 | Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access… |
CVE-2023-28646 | Medium | 4.4 | 2023-03-30 | Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has acc… |
CVE-2023-28503 | Critical | 9.8 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication… |
CVE-2022-43620 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not… |
CVE-2023-28398 | Critical | 9.8 | 2023-03-28 | Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication, thereby gaining unauthorized access to… |
CVE-2022-4126 | Critical | 9.6 | 2023-03-27 | Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: befo… |
CVE-2023-21027 | High | 7.5 | 2023-03-24 | In multiple functions of PasspointXmlUtils.java, there is a possible authentication misconfiguration due to a logic error in the code. This could lead to remot… |
CVE-2022-45124 | High | 7.5 | 2023-03-20 | An information disclosure vulnerability exists in the User authentication functionality of WellinTech KingHistorian 35.01.00.05. A specially crafted network pa… |
CVE-2023-28609 | Critical | 9.8 | 2023-03-18 | api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication. |
CVE-2023-1464 | High | 7.3 | 2023-03-17 | A vulnerability, which was classified as critical, was found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file Users.php?… |
CVE-2023-1460 | Medium | 6.5 | 2023-03-17 | A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admi… |
CVE-2023-21460 | Medium | 4.4 | 2023-03-16 | Improper authentication in SecSettings prior to SMR Mar-2023 Release 1 allows attacker to reset the setting. |
CVE-2023-21455 | Medium | 5.9 | 2023-03-16 | Improper authorization implementation in Exynos baseband prior to SMR Mar-2023 Release 1 allows incorrect handling of unencrypted message. |
CVE-2023-28461 | Critical | 9.8 | 2023-03-15 | Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using… |
CVE-2022-46773 | Medium | 4.3 | 2023-03-15 | IBM Robotic Process Automation 21.0.0 - 21.0.7 and 23.0.0 is vulnerable to client-side validation bypass for credential pools. Invalid credential pools may be… |
CVE-2022-46774 | Medium | 5.4 | 2023-03-15 | IBM Manage Application 8.8.0 and 8.9.0 in the IBM Maximo Application Suite is vulnerable to incorrect default permissions which could give access to a user to… |
CVE-2023-1327 | Critical | 9.8 | 2023-03-14 | Netgear RAX30 (AX2400), prior to version 1.0.6.74, was affected by an authentication bypass vulnerability, allowing an unauthenticated attacker to gain adminis… |
CVE-2023-25957 | Critical | 9.1 | 2023-03-14 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >… |
CVE-2023-23857 | Critical | 9.9 | 2023-03-14 | Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use o… |
CVE-2023-27582 | Critical | 9.1 | 2023-03-13 | maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL author… |
CVE-2022-44574 | High | 7.5 | 2023-03-10 | An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port. |
CVE-2022-33242 | High | 7.8 | 2023-03-10 | Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD. |
CVE-2023-27482 | Critical | 10.0 | 2023-03-08 | homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Ho… |
CVE-2022-48364 | Medium | 4.3 | 2023-03-06 | The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative ac… |
CVE-2023-0228 | High | 8.8 | 2023-03-02 | Improper Authentication vulnerability in ABB Symphony Plus S+ Operations.This issue affects Symphony Plus S+ Operations: from 2.X through 2.1 SP2, 2.2, from 3… |
CVE-2023-25931 | Medium | 6.4 | 2023-03-01 | Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requi… |
CVE-2023-1065 | Medium | 6.5 | 2023-02-28 | This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relev… |
CVE-2023-25264 | High | 7.5 | 2023-02-28 | An issue was discovered in Docmosis Tornado prior to version 2.9.5. An unauthenticated attacker can bypass the authentication check filter completely by introd… |
CVE-2023-23493 | Low | 3.3 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.2, macOS Monterey 12.6.3. An encrypted volume may be unmoun… |
CVE-2022-48305 | Medium | 5.5 | 2023-02-27 | There is an identity authentication bypass vulnerability in Huawei Children Smart Watch (Simba-AL00) 1.1.1.274. Successful exploitation of this vulnerability m… |
CVE-2022-48254 | Medium | 4.6 | 2023-02-27 | There is a data processing error vulnerability in Leia-B29 2.0.0.49(M03). Successful exploitation could bypass lock screen authentication. |
CVE-2022-34908 | High | 8.2 | 2023-02-27 | An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It possesses an authentication mechanism; however, some features do not requ… |
CVE-2023-20012 | Medium | 5.3 | 2023-02-23 | A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender (FEX) when used in UCS Fabric Interconnect deployments c… |
CVE-2023-24093 | Critical | 9.8 | 2023-02-22 | An access control issue in H3C A210-G A210-GV100R005 allows attackers to authenticate without a password. |
CVE-2015-10083 | Medium | 6.3 | 2023-02-21 | A vulnerability has been found in harrystech Dynosaur-Rails and classified as critical. Affected by this vulnerability is the function basic_auth of the file a… |
CVE-2023-0905 | High | 7.3 | 2023-02-18 | A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file change… |
CVE-2022-33946 | Medium | 5.6 | 2023-02-16 | Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2022-32971 | Low | 3.1 | 2023-02-16 | Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow a privileged user to potentially enable escalation of privilege via netw… |
CVE-2022-32570 | Medium | 6.7 | 2023-02-16 | Improper authentication in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of pri… |
CVE-2023-23460 | Critical | 9.1 | 2023-02-15 | Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass. |
CVE-2022-47508 | High | 7.5 | 2023-02-15 | Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were querying for data via IP a… |
CVE-2023-21817 | High | 7.8 | 2023-02-14 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2023-21721 | Medium | 6.5 | 2023-02-14 | Microsoft OneNote Elevation of Privilege Vulnerability |