CWE-287 · Improper Authentication (page 22)
Page 22 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45724 | Medium | 5.4 | 2023-02-13 | Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to an unauthenticated pag… |
CVE-2023-25559 | High | 8.2 | 2023-02-11 | DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service (… |
CVE-2023-21437 | Medium | 4.0 | 2023-02-09 | Improper access control vulnerability in Phone application prior to SMR Feb-2023 Release 1 allows local attackers to access sensitive information via implicit… |
CVE-2023-21425 | Medium | 4.3 | 2023-02-09 | Improper access control vulnerability in telecom application prior to SMR JAN-2023 Release 1 allows local attackers to get sensitive information. |
CVE-2023-21419 | Medium | 4.3 | 2023-02-09 | An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container remain unlocked under certain condition. |
CVE-2022-48294 | High | 7.5 | 2023-02-09 | The IHwAttestationService interface has a defect in authentication. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-42951 | High | 8.1 | 2023-02-06 | An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server n… |
CVE-2023-22501 | Critical | 9.1 | 2023-02-01 | An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain… |
CVE-2022-47003 | Critical | 9.8 | 2023-02-01 | A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request. |
CVE-2020-20402 | High | 7.5 | 2023-01-31 | Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation. |
CVE-2022-4441 | High | 7.6 | 2023-01-31 | Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. Thi… |
CVE-2022-4041 | Medium | 5.9 | 2023-01-31 | Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. Thi… |
CVE-2022-30421 | High | 7.8 | 2023-01-31 | Improper Authentication vulnerability in Toshiba Storage Security Software V1.2.0.7413 is that allows for sensitive information to be obtained via(local) passw… |
CVE-2022-32514 | Critical | 9.8 | 2023-01-30 | A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Produ… |
CVE-2023-24830 | High | 7.5 | 2023-01-30 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3. |
CVE-2022-43978 | Medium | 5.6 | 2023-01-27 | There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a… |
CVE-2022-48066 | Critical | 9.8 | 2023-01-27 | An issue in the component global.so of Totolink A830R V4.1.2cu.5182 allows attackers to bypass authentication via a crafted cookie. |
CVE-2023-23612 | Medium | 4.7 | 2023-01-26 | OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when th… |
CVE-2023-20924 | Medium | 6.8 | 2023-01-26 | In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure. This could lead to local escalation of privilege with physic… |
CVE-2021-43445 | Critical | 9.8 | 2023-01-23 | ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE do… |
CVE-2021-43444 | High | 7.5 | 2023-01-23 | ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing… |
CVE-2020-22657 | Critical | 9.1 | 2023-01-20 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199… |
CVE-2023-22964 | Critical | 9.1 | 2023-01-20 | Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled. |
CVE-2023-22334 | Medium | 5.3 | 2023-01-20 | Use of password hash instead of password for authentication vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote authenticated att… |
CVE-2022-45922 | High | 8.8 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The request handler for ll.KeepAliveSession sets a valid AdminPwd cookie even w… |
CVE-2021-4314 | Medium | 5.3 | 2023-01-18 | It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only… |
CVE-2023-21841 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2023-22303 | Critical | 9.8 | 2023-01-17 | TP-Link SG105PE firmware prior to 'TL-SG105PE(UN) 1.0_1.0.0 Build 20221208' contains an authentication bypass vulnerability. Under the certain conditions, an a… |
CVE-2023-22278 | Medium | 5.3 | 2023-01-17 | m-FILTER prior to Ver.5.70R01 (Ver.5 Series) and m-FILTER prior to Ver.4.87R04 (Ver.4 Series) allows a remote unauthenticated attacker to bypass authentication… |
CVE-2023-0311 | Critical | 9.8 | 2023-01-15 | Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-22497 | Medium | 6.5 | 2023-01-14 | Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. Each Netdata Agent has an automatically generated MACHINE GUID. I… |
CVE-2023-0105 | Medium | 6.5 | 2023-01-13 | A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow… |
CVE-2022-25027 | High | 7.5 | 2023-01-12 | The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by valida… |
CVE-2022-39184 | Critical | 9.8 | 2023-01-12 | EXFO - BV-10 Performance Endpoint Unit authentication bypass User can manually manipulate access enabling authentication bypass. |
CVE-2022-4874 | High | 7.5 | 2023-01-11 | Authentication bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows an unauthenticated user to access content. In order to serve static content, t… |
CVE-2022-35401 | High | 8.1 | 2023-01-10 | An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A specially-crafted HTTP re… |
CVE-2023-0036 | Medium | 6.5 | 2023-01-09 | platform_callback_stub in misc subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA relay atta… |
CVE-2023-0035 | Medium | 6.5 | 2023-01-09 | softbus_client_stub in communication subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA rela… |
CVE-2022-1101 | High | 7.3 | 2023-01-07 | A vulnerability was found in SourceCodester Royale Event Management System 1.0. It has been rated as critical. This issue affects some unknown processing of th… |
CVE-2014-125060 | High | 7.3 | 2023-01-07 | A vulnerability, which was classified as critical, was found in holdennb CollabCal. Affected is the function handleGet of the file calenderServer.cpp. The mani… |
CVE-2022-47976 | High | 7.5 | 2023-01-06 | The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this vulnerability may… |
CVE-2022-47974 | Medium | 6.5 | 2023-01-06 | The Bluetooth AVRCP module has a vulnerability that can lead to DoS attacks.Successful exploitation of this vulnerability may cause the Bluetooth process to re… |
CVE-2021-40342 | High | 7.1 | 2023-01-05 | In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive info… |
CVE-2022-43528 | Medium | 4.8 | 2023-01-05 | Under certain configurations, an attacker can login to Aruba EdgeConnect Enterprise Orchestrator without supplying a multi-factor authentication code. Successf… |
CVE-2022-39042 | Critical | 9.8 | 2023-01-03 | aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and access… |
CVE-2022-48195 | Critical | 9.8 | 2022-12-31 | An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for chan… |
CVE-2022-4861 | Medium | 4.8 | 2022-12-30 | Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another reso… |
CVE-2022-23554 | Medium | 6.5 | 2022-12-28 | Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows Authentication Filter bypass. The AuthenticationFilter relies on the request URI… |
CVE-2022-41579 | Medium | 6.5 | 2022-12-28 | There is an insufficient authentication vulnerability in some Huawei band products. Successful exploit could allow the attacker to spoof then connect to the ba… |
CVE-2022-46172 | Medium | 6.4 | 2022-12-28 | authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can… |
CVE-2022-23555 | Critical | 9.4 | 2022-12-28 | authentik is an open-source Identity Provider focused on flexibility and versatility. Versions prior to 2022.11.4 and 2022.10.4 are vulnerable to Improper Auth… |
CVE-2020-36569 | Critical | 9.1 | 2022-12-27 | Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896… |
CVE-2022-3156 | High | 7.8 | 2022-12-27 | A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software. Users are granted elevated permissions on certain prod… |
CVE-2022-4722 | High | 7.2 | 2022-12-27 | Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2020-11101 | Critical | 9.8 | 2022-12-26 | Sierra Wireless AirLink Mobility Manager (AMM) before 2.17 mishandles sessions and thus an unauthenticated attacker can obtain a login session with administrat… |
CVE-2022-47633 | High | 8.1 | 2022-12-23 | An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject uns… |
CVE-2022-46875 | Medium | 6.5 | 2022-12-22 | The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. <br>*Note: This issue onl… |
CVE-2022-35646 | Medium | 5.9 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 software component could allow an authenticated user to modify or cancel any other user's access reque… |
CVE-2022-46170 | High | 8.6 | 2022-12-22 | CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2)… |
CVE-2022-23540 | Medium | 6.4 | 2022-12-22 | In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to def… |
CVE-2022-23541 | Medium | 5.0 | 2022-12-22 | jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented k… |
CVE-2022-46316 | Critical | 9.8 | 2022-12-20 | A thread security vulnerability exists in the authentication process. Successful exploitation of this vulnerability may affect data integrity, confidentiality… |
CVE-2022-46313 | Medium | 5.3 | 2022-12-20 | The sensor privacy module has an authentication vulnerability. Successful exploitation of this vulnerability may cause unavailability of the smartphone's camer… |
CVE-2022-41590 | Medium | 5.5 | 2022-12-20 | Some smartphones have authentication-related (including session management) vulnerabilities as the setup wizard is bypassed. Successful exploitation of this vu… |
CVE-2022-46400 | Medium | 5.4 | 2022-12-19 | The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) allows attackers to bypass passkey entry in legacy pairi… |
CVE-2022-42453 | Medium | 6.9 | 2022-12-19 | There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with… |
CVE-2022-3875 | High | 7.3 | 2022-12-19 | A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown… |
CVE-2022-47209 | High | 8.8 | 2022-12-16 | A support user exists on the device and appears to be a backdoor for Technical Support staff. The default password for this account is “support” and cannot be… |
CVE-2021-35252 | High | 7.5 | 2022-12-16 | Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker… |
CVE-2022-47408 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-23501 | Medium | 5.9 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Impro… |
CVE-2022-2757 | Critical | 9.8 | 2022-12-13 | Due to the lack of adequately implemented access-control rules, all versions Kingspan TMS300 CS are vulnerable to an attacker viewing and modifying the appl… |
CVE-2022-25685 | High | 7.5 | 2022-12-13 | Denial of service in Modem module due to improper authorization while error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdrago… |
CVE-2022-23505 | Medium | 5.3 | 2022-12-13 | Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be ab… |
CVE-2022-29838 | Medium | 4.3 | 2022-12-09 | Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the… |
CVE-2022-2752 | Medium | 5.5 | 2022-12-09 | A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions. This issu… |
CVE-2022-46829 | High | 7.1 | 2022-12-08 | In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented. |
CVE-2022-45877 | High | 8.3 | 2022-12-08 | OpenHarmony-v3.1.4 and prior versions had an vulnerability. PIN code is transmitted to the peer device in plain text during cross-device authentication, which… |
CVE-2022-45118 | Medium | 6.2 | 2022-12-08 | OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission… |
CVE-2022-39901 | Medium | 6.5 | 2022-12-08 | Improper authentication in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to disable the network traffic encryption between UE and gNod… |
CVE-2022-39899 | Medium | 5.7 | 2022-12-08 | Improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1 allows attacker to send the input event using S Pen gestu… |
CVE-2022-42458 | Critical | 9.8 | 2022-12-07 | Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticated attacker to uplo… |
CVE-2022-40966 | High | 8.8 | 2022-12-07 | Authentication bypass vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to bypass authentication and access the device. The… |
CVE-2022-44620 | High | 8.8 | 2022-12-07 | Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attack… |
CVE-2022-35843 | High | 8.1 | 2022-12-06 | An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9… |
CVE-2022-38336 | High | 8.1 | 2022-12-06 | An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication. |
CVE-2022-43557 | Medium | 5.3 | 2022-12-05 | The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with physical access, speci… |
CVE-2022-43549 | Critical | 9.8 | 2022-12-05 | Improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechanisms. |
CVE-2022-40259 | High | 8.3 | 2022-12-05 | MegaRAC Default Credentials Vulnerability |
CVE-2022-40242 | High | 7.5 | 2022-12-05 | MegaRAC Default Credentials Vulnerability |
CVE-2022-43504 | Medium | 5.3 | 2022-12-05 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who… |
CVE-2022-46411 | High | 8.8 | 2022-12-04 | An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. A default password is persisted after installation an… |
CVE-2022-46145 | High | 8.1 | 2022-12-02 | authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account tak… |
CVE-2022-43900 | Medium | 5.3 | 2022-12-01 | IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.2 could provide a weaker than expected security. A local attacker can create an outbound netwo… |
CVE-2022-36960 | High | 8.8 | 2022-11-29 | SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to e… |
CVE-2022-46146 | Medium | 6.2 | 2022-11-29 | Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and… |
CVE-2021-45036 | High | 8.7 | 2022-11-28 | Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed password to spoof the victim's id against the… |
CVE-2022-41912 | Critical | 9.1 | 2022-11-28 | The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion eleme… |
CVE-2022-36133 | Critical | 9.1 | 2022-11-25 | The WebConfig functionality of Epson TM-C3500 and TM-C7500 devices with firmware version WAM31500 allows authentication bypass. |
CVE-2022-37774 | Medium | 5.3 | 2022-11-23 | There is a broken access control vulnerability in the Maarch RM 2.8.3 solution. When accessing some specific document (pdf, email) from an archive, a preview i… |