CWE-287 · Improper Authentication (page 22)
Page 22 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-1067 | Medium | 6.5 | 2022-04-11 | Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting. |
CVE-2021-46740 | High | 7.5 | 2022-04-11 | The device authentication service module has a defect vulnerability introduced in the design process.Successful exploitation of this vulnerability may affect d… |
CVE-2022-1248 | High | 7.3 | 2022-04-06 | A vulnerability was found in SAP Information System 1.0 which has been rated as critical. Affected by this issue is the file /SAP_Information_System/controller… |
CVE-2021-32984 | Critical | 9.8 | 2022-04-04 | All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU M… |
CVE-2021-32980 | Critical | 9.8 | 2022-04-04 | Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attac… |
CVE-2022-24813 | Medium | 5.3 | 2022-04-04 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:Re… |
CVE-2022-28376 | High | 8.1 | 2022-04-03 | Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a CPE admin website, e.g., at the 10.0.0… |
CVE-2022-25157 | Critical | 9.1 | 2022-04-01 | Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electr… |
CVE-2022-25155 | High | 8.1 | 2022-04-01 | Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electr… |
CVE-2021-20238 | Low | 3.7 | 2022-04-01 | It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without auth… |
CVE-2022-26562 | Critical | 9.8 | 2022-04-01 | An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to authenticate even if the user account or… |
CVE-2022-23156 | Medium | 6.0 | 2022-04-01 | Wyse Device Agent version 14.6.1.4 and below contain an Improper Authentication vulnerability. A malicious user could potentially exploit this vulnerability by… |
CVE-2021-1950 | High | 7.8 | 2022-04-01 | Improper cleaning of secure memory between authenticated users can lead to face authentication bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec… |
CVE-2021-45900 | Medium | 6.5 | 2022-03-30 | Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configuration web portlet, a VIVOH_AUTH cookie… |
CVE-2019-9564 | High | 7.5 | 2022-03-30 | A vulnerability in the authentication logic of Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to bypass login and control the devices. This issue affects… |
CVE-2022-23795 | Critical | 9.8 | 2022-03-30 | An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could unde… |
CVE-2022-22935 | Low | 3.7 | 2022-03-29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to for… |
CVE-2022-1084 | High | 7.3 | 2022-03-29 | A vulnerability classified as critical was found in SourceCodester One Church Management System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2018-25030 | Low | 3.3 | 2022-03-28 | A vulnerability classified as problematic has been found in Mirmay Secure Private Browser and File Manager up to 2.5. Affected is the Auto Lock. A race conditi… |
CVE-2022-0342 | Critical | 9.8 | 2022-03-28 | An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.5… |
CVE-2021-26598 | Medium | 5.3 | 2022-03-28 | ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have… |
CVE-2022-1049 | High | 8.8 | 2022-03-25 | A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when usi… |
CVE-2021-26620 | High | 7.5 | 2022-03-25 | An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important informa… |
CVE-2021-31326 | Critical | 9.8 | 2022-03-24 | D-Link DIR-816 A2 1.10 B05 allows unauthenticated attackers to arbitrarily reset the device via a crafted tokenid parameter to /goform/form2Reboot.cgi. |
CVE-2022-0996 | Medium | 6.5 | 2022-03-23 | A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. |
CVE-2021-4197 | High | 7.8 | 2022-03-23 | An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some les… |
CVE-2022-0862 | Low | 3.1 | 2022-03-23 | A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote… |
CVE-2021-44759 | High | 8.1 | 2022-03-23 | Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle attack. This issue aff… |
CVE-2021-46390 | Medium | 6.8 | 2022-03-21 | An access control issue in the authentication module of Lexar_F35 v1.0.34 allows attackers to access sensitive data and cause a Denial of Service (DoS). An att… |
CVE-2022-22656 | Low | 3.3 | 2022-03-18 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-00… |
CVE-2022-0547 | Critical | 9.8 | 2022-03-18 | OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred auth… |
CVE-2022-26504 | High | 8.8 | 2022-03-17 | Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) all… |
CVE-2021-45786 | Critical | 9.8 | 2022-03-16 | In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges. |
CVE-2022-24740 | Medium | 5.0 | 2022-03-14 | Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authenti… |
CVE-2021-36368 | Low | 3.7 | 2022-03-13 | An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an atta… |
CVE-2022-22729 | High | 8.8 | 2022-03-11 | CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via… |
CVE-2022-25825 | Medium | 6.2 | 2022-03-10 | Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the authcode for sign-in. |
CVE-2022-25817 | Medium | 4.0 | 2022-03-10 | Improper authentication in One UI Home prior to SMR Mar-2022 Release 1 allows attacker to generate pinned-shortcut without user consent. |
CVE-2022-25816 | Medium | 4.1 | 2022-03-10 | Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change enable/disable without authentication |
CVE-2022-24286 | High | 7.8 | 2022-03-10 | Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains a local privilege escalation vulnerability. The user process communicates w… |
CVE-2022-24285 | High | 7.8 | 2022-03-10 | Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability. The user process communicates with a service of system authori… |
CVE-2022-23383 | Critical | 9.1 | 2022-03-10 | YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge… |
CVE-2021-40376 | High | 7.8 | 2022-03-10 | otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named pipe. A remote attac… |
CVE-2022-24748 | Medium | 6.8 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modif… |
CVE-2022-0715 | Critical | 9.1 | 2022-03-09 | A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and use… |
CVE-2021-41181 | Low | 2.4 | 2022-03-08 | Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen s… |
CVE-2022-24738 | High | 8.1 | 2022-03-07 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from use… |
CVE-2022-23729 | High | 7.8 | 2022-03-04 | When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010. |
CVE-2022-0730 | Critical | 9.8 | 2022-03-03 | Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types. |
CVE-2022-0492 | High | 7.8 | 2022-03-03 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, a… |
CVE-2020-14504 | Medium | 5.3 | 2022-02-24 | The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacker can send a crafte… |
CVE-2022-23635 | High | 7.5 | 2022-02-22 | Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request proc… |
CVE-2022-23654 | High | 8.1 | 2022-02-22 | Wiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page outside the… |
CVE-2022-23652 | High | 8.8 | 2022-02-22 | capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authenti… |
CVE-2022-24047 | Critical | 9.8 | 2022-02-18 | This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to… |
CVE-2022-21196 | Critical | 10.0 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perfo… |
CVE-2020-25719 | High | 7.2 | 2022-02-18 | A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become conf… |
CVE-2016-2124 | Medium | 5.9 | 2022-02-18 | A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even i… |
CVE-2022-23317 | High | 7.5 | 2022-02-15 | CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the… |
CVE-2021-4201 | Critical | 9.6 | 2022-02-14 | Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, i… |
CVE-2021-45347 | High | 7.5 | 2022-02-14 | An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use… |
CVE-2022-24976 | Critical | 9.1 | 2022-02-14 | Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a… |
CVE-2021-22796 | High | 7.8 | 2022-02-11 | A CWE-287: Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded. Affected Product: C-Bus Toolk… |
CVE-2021-38679 | Medium | 6.5 | 2022-02-11 | An improper authentication vulnerability has been reported to affect QNAP NAS running Kazoo Server. If exploited, this vulnerability allows attackers to compro… |
CVE-2021-30317 | Critical | 9.3 | 2022-02-11 | Improper validation of program headers containing ELF metadata can lead to image verification bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect… |
CVE-2021-45331 | Critical | 9.8 | 2022-02-09 | An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA c… |
CVE-2022-23320 | High | 7.5 | 2022-02-07 | XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative creden… |
CVE-2022-24551 | High | 8.8 | 2022-02-06 | A flaw was found in StarWind Stack. The endpoint for setting a new password doesn’t check the current username and old password. An attacker could reset any lo… |
CVE-2022-22831 | Critical | 9.8 | 2022-02-06 | An issue was discovered in Servisnet Tessa 0.0.2. An attacker can add a new sysadmin user via a manipulation of the Authorization HTTP header. |
CVE-2022-23600 | Medium | 5.3 | 2022-02-04 | fleet is an open source device management, built on osquery. Versions prior to 4.9.1 expose a limited ability to spoof SAML authentication with missing audienc… |
CVE-2021-28503 | High | 7.4 | 2022-02-04 | The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows… |
CVE-2021-21965 | Critical | 9.3 | 2022-02-04 | A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted… |
CVE-2022-24259 | Critical | 9.8 | 2022-02-04 | An incorrect check in the component cdr.php of Voipmonitor GUI before v24.96 allows unauthenticated attackers to escalate privileges via a crafted request. |
CVE-2021-40404 | Medium | 6.5 | 2022-01-28 | An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP reques… |
CVE-2021-36346 | Medium | 5.3 | 2022-01-25 | Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerabi… |
CVE-2021-34865 | High | 8.8 | 2022-01-25 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers. Authentication is not requ… |
CVE-2021-3850 | Critical | 9.1 | 2022-01-25 | Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21. |
CVE-2021-43394 | Critical | 9.8 | 2022-01-24 | Unisys OS 2200 Messaging Integration Services (NTSI) 7R3B IC3 and IC4, 7R3C, and 7R3D has an Incorrect Implementation of an Authentication Algorithm. An LDAP p… |
CVE-2022-23126 | Critical | 9.8 | 2022-01-24 | TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere wi… |
CVE-2022-23807 | Medium | 4.3 | 2022-01-22 | An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their accou… |
CVE-2021-43355 | High | 7.3 | 2022-01-21 | Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the… |
CVE-2021-23196 | High | 7.3 | 2022-01-21 | The web application on Agilia Link+ version 3.0 implements authentication and session management mechanisms exclusively on the client-side and does not protect… |
CVE-2020-4879 | Critical | 9.8 | 2022-01-21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication… |
CVE-2021-44736 | Critical | 9.8 | 2022-01-20 | The initial admin account setup wizard on Lexmark devices allow unauthenticated access to the “out of service erase” feature. |
CVE-2022-21692 | Medium | 4.3 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2022-21695 | Medium | 4.3 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2021-25036 | High | 8.8 | 2022-01-17 | The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Sc… |
CVE-2022-23178 | Critical | 9.8 | 2022-01-15 | An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, u… |
CVE-2021-34993 | Critical | 9.8 | 2022-01-13 | This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell 11.22.22. Authentication is not required to… |
CVE-2021-34977 | High | 8.8 | 2022-01-13 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7000 1.0.11.116_10.2.100 routers. Authentic… |
CVE-2022-22990 | High | 7.8 | 2022-01-13 | A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cl… |
CVE-2022-21684 | Medium | 4.3 | 2022-01-13 | Discourse is an open source discussion platform. Versions prior to 2.7.13 in `stable`, 2.8.0.beta11 in `beta`, and 2.8.0.beta11 in `tests-passed` allow some us… |
CVE-2021-33046 | Critical | 9.8 | 2022-01-13 | Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specific deployments to r… |
CVE-2022-23134 | Low | 3.7 | 2022-01-13 | After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious a… |
CVE-2021-43999 | High | 8.8 | 2022-01-11 | Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malici… |
CVE-2021-44458 | High | 8.3 | 2022-01-10 | Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from th… |
CVE-2022-22289 | Medium | 5.3 | 2022-01-10 | Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information. |
CVE-2022-22284 | Medium | 5.7 | 2022-01-10 | Improper authentication vulnerability in Samsung Internet prior to 16.0.2.19 allows attackers to bypass secret mode password authentication |
CVE-2022-22283 | Low | 2.8 | 2022-01-10 | Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App. |
CVE-2021-45389 | Critical | 9.8 | 2022-01-04 | A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escala… |