CWE-287 · Improper Authentication (page 23)
Page 23 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-37931 | High | 7.3 | 2022-11-22 | A vulnerability in NetBatch-Plus software allows unauthorized access to the application. HPE has provided a workaround and fix. Please refer to HPE Security… |
CVE-2022-40602 | Critical | 9.8 | 2022-11-22 | A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an improper pre-configured… |
CVE-2022-20918 | High | 7.5 | 2022-11-15 | A vulnerability in the Simple Network Management Protocol (SNMP) access controls for Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER m… |
CVE-2022-25667 | High | 7.5 | 2022-11-15 | Information disclosure in kernel due to improper handling of ICMP requests in Snapdragon Wired Infrastructure and Networking |
CVE-2022-43690 | Medium | 6.3 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication byp… |
CVE-2022-3477 | Critical | 9.8 | 2022-11-14 | The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not prope… |
CVE-2022-34331 | Medium | 5.5 | 2022-11-11 | After performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly configured leading to desired VEPA configu… |
CVE-2022-37345 | High | 7.8 | 2022-11-11 | Improper authentication in BIOS firmware[A1] for some Intel(R) NUC Kits before version RY0386 may allow an authenticated user to potentially enable escalation… |
CVE-2022-36370 | High | 7.5 | 2022-11-11 | Improper authentication in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow a privileged user to potentially… |
CVE-2022-29893 | High | 8.1 | 2022-11-11 | Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an authenticated… |
CVE-2022-27874 | Medium | 6.8 | 2022-11-11 | Improper authentication in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable esca… |
CVE-2022-26845 | High | 8.7 | 2022-11-11 | Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an unauthenticat… |
CVE-2022-26508 | Medium | 4.3 | 2022-11-11 | Improper authentication in the Intel(R) SDP Tool before version 3.0.0 may allow an unauthenticated user to potentially enable information disclosure via networ… |
CVE-2022-21794 | High | 7.7 | 2022-11-11 | Improper authentication in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, Intel(R) NUC Kits before version HN0067… |
CVE-2021-33159 | High | 7.4 | 2022-11-11 | Improper authentication in subsystem for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow a privileged us… |
CVE-2022-39038 | High | 8.8 | 2022-11-10 | Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account t… |
CVE-2022-38119 | Critical | 9.8 | 2022-11-10 | UPSMON Pro login function has insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and get a… |
CVE-2022-44244 | Medium | 6.6 | 2022-11-09 | An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator. |
CVE-2022-39892 | Low | 3.6 | 2022-11-09 | Improper access control in Samsung Pass prior to version 4.0.05.1 allows attackers to unauthenticated access via keep open feature. |
CVE-2022-31686 | Critical | 9.8 | 2022-11-09 | VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist… |
CVE-2022-31685 | Critical | 9.8 | 2022-11-09 | VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious actor with network access to Workspace ONE Assist may b… |
CVE-2022-27510 | Critical | 9.8 | 2022-11-08 | Unauthorized access to Gateway user capabilities |
CVE-2022-39387 | Critical | 9.1 | 2022-11-04 | XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through… |
CVE-2022-43451 | High | 8.4 | 2022-11-03 | OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary dir… |
CVE-2022-32935 | Medium | 4.6 | 2022-11-01 | A lock screen issue was addressed with improved state management. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16, macOS Ventura 13… |
CVE-2022-32928 | Medium | 5.3 | 2022-11-01 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16, macOS Ventura 13, watchOS 9. A user in a privileged network position may… |
CVE-2022-2572 | Critical | 9.8 | 2022-11-01 | In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/dele… |
CVE-2022-39019 | Medium | 6.3 | 2022-10-31 | Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the applicatio… |
CVE-2022-39018 | High | 8.2 | 2022-10-31 | Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL. |
CVE-2022-41648 | Critical | 9.8 | 2022-10-28 | The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC communication for CNC machines. Authen… |
CVE-2022-39366 | Critical | 9.9 | 2022-10-28 | DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the sig… |
CVE-2022-37914 | Critical | 9.8 | 2022-10-28 | Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass aut… |
CVE-2022-37913 | Critical | 9.8 | 2022-10-28 | Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass aut… |
CVE-2022-38744 | High | 7.5 | 2022-10-27 | An unauthenticated attacker with network access to a victim's Rockwell Automation FactoryTalk Alarm and Events service could open a connection, causing the s… |
CVE-2022-40703 | Medium | 5.2 | 2022-10-26 | CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior on Android allows an unauthenticated attack… |
CVE-2022-39355 | Critical | 9.1 | 2022-10-26 | Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerab… |
CVE-2022-39360 | Medium | 6.5 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were a… |
CVE-2022-3674 | High | 7.3 | 2022-10-26 | A vulnerability has been found in SourceCodester Sanitization Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2022-26870 | High | 7.0 | 2022-10-21 | Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability… |
CVE-2022-43400 | Critical | 9.8 | 2022-10-21 | A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 (All versions < V22.2a (80)). The mobile server component of affected applicati… |
CVE-2022-42233 | Critical | 9.8 | 2022-10-20 | Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability. |
CVE-2022-37298 | Critical | 9.8 | 2022-10-20 | Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py i… |
CVE-2022-39267 | High | 8.8 | 2022-10-19 | Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Ver… |
CVE-2022-21618 | Medium | 5.3 | 2022-10-18 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Or… |
CVE-2022-40684 | Critical | 9.8 | 2022-10-18 | An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy versi… |
CVE-2022-31122 | Critical | 9.8 | 2022-10-18 | Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Confusion. If an attack… |
CVE-2022-22237 | Medium | 6.5 | 2022-10-18 | An Improper Authentication vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause an impact on con… |
CVE-2022-2533 | Medium | 6.5 | 2022-10-17 | An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions st… |
CVE-2022-23769 | High | 7.5 | 2022-10-17 | Remote code execution vulnerability due to insufficient user privilege verification in reverseWall-MDS. Remote attackers can exploit the vulnerability such as… |
CVE-2022-41436 | Critical | 9.1 | 2022-10-14 | An issue in OXHOO TP50 OXH1.50 allows unauthenticated attackers to access the administrative panel via browsing to the URL http://device_ip/index1.html. |
CVE-2022-38982 | Critical | 9.8 | 2022-10-14 | The fingerprint module has service logic errors.Successful exploitation of this vulnerability will cause the phone lock to be cracked. |
CVE-2022-42488 | High | 8.4 | 2022-10-14 | OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application instal… |
CVE-2022-42463 | High | 8.3 | 2022-10-14 | OpenHarmony-v3.1.2 and prior versions have an authenication bypass vulnerability in a callback handler function of Softbus_server in communication subsystem. A… |
CVE-2022-39229 | Medium | 4.3 | 2022-10-13 | Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's… |
CVE-2022-35135 | High | 8.8 | 2022-10-13 | Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/<uuid>. |
CVE-2021-36369 | High | 7.5 | 2022-10-12 | An issue was discovered in Dropbear through 2020.81. Due to a non-RFC-compliant check of the available authentication methods in the client-side SSH code, it i… |
CVE-2022-3465 | High | 7.3 | 2022-10-12 | A vulnerability classified as critical was found in Mediabridge Medialink. This vulnerability affects unknown code of the file /index.asp. The manipulation lea… |
CVE-2022-40664 | Critical | 9.8 | 2022-10-12 | Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher. |
CVE-2022-39290 | High | 8.0 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. In affected versions authenticated users can bypass CSRF keys by modifying th… |
CVE-2022-39289 | Critical | 9.1 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user… |
CVE-2022-21936 | High | 8.1 | 2022-10-07 | On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP… |
CVE-2022-40494 | Critical | 9.8 | 2022-10-06 | NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameter… |
CVE-2022-20662 | Medium | 6.1 | 2022-09-30 | A vulnerability in the smart card login authentication of Cisco Duo for macOS could allow an unauthenticated attacker with physical access to bypass authentica… |
CVE-2022-39254 | High | 8.6 | 2022-09-29 | matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their dev… |
CVE-2022-39252 | High | 8.6 | 2022-09-29 | matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, w… |
CVE-2022-39250 | High | 8.6 | 2022-09-29 | Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malici… |
CVE-2021-40693 | Medium | 6.5 | 2022-09-29 | An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability. |
CVE-2022-39264 | High | 8.6 | 2022-09-28 | nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which cou… |
CVE-2022-39263 | Medium | 6.8 | 2022-09-28 | `@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` E… |
CVE-2022-39257 | High | 7.5 | 2022-09-28 | Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can co… |
CVE-2022-39255 | High | 8.6 | 2022-09-28 | Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can co… |
CVE-2022-39251 | High | 8.6 | 2022-09-28 | Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construc… |
CVE-2022-39249 | High | 7.5 | 2022-09-28 | Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construc… |
CVE-2022-39248 | High | 8.6 | 2022-09-28 | matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legi… |
CVE-2022-39246 | High | 7.5 | 2022-09-28 | matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing… |
CVE-2022-22523 | High | 7.5 | 2022-09-28 | An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows… |
CVE-2022-39245 | High | 8.4 | 2022-09-26 | Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` variable can allow… |
CVE-2022-39219 | High | 8.5 | 2022-09-26 | Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to… |
CVE-2022-3119 | High | 7.5 | 2022-09-26 | The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticate… |
CVE-2022-35248 | High | 8.8 | 2022-09-23 | A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be bypassed when telling the… |
CVE-2022-30124 | Medium | 6.8 | 2022-09-23 | An improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with physical access to a mobile device to byp… |
CVE-2021-45035 | Medium | 6.3 | 2022-09-23 | Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the… |
CVE-2022-39238 | Medium | 4.2 | 2022-09-23 | Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentication Modules (PAM)… |
CVE-2022-39231 | Low | 3.7 | 2022-09-23 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, v… |
CVE-2022-40616 | High | 8.1 | 2022-09-21 | IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass authentication and obtain sensitive information or perform tasks they sh… |
CVE-2021-33076 | Medium | 5.3 | 2022-09-20 | Improper authentication in firmware for some Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physi… |
CVE-2022-28321 | Critical | 9.8 | 2022-09-19 | The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict… |
CVE-2022-40144 | Critical | 9.8 | 2022-09-19 | A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authentication by falsifyin… |
CVE-2022-3218 | Critical | 9.8 | 2022-09-19 | Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can resul… |
CVE-2022-3173 | Medium | 4.3 | 2022-09-17 | Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10. |
CVE-2022-39009 | Critical | 9.8 | 2022-09-16 | The WLAN module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause third-party apps to affect WLAN functio… |
CVE-2021-42949 | Critical | 9.8 | 2022-09-16 | The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authe… |
CVE-2022-25652 | Critical | 9.0 | 2022-09-16 | Cryptographic issues in BSP due to improper hash verification in Snapdragon Wired Infrastructure and Networking |
CVE-2022-36436 | Critical | 9.8 | 2022-09-14 | OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerability that could al… |
CVE-2022-40622 | High | 8.8 | 2022-09-13 | The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore… |
CVE-2022-39205 | Critical | 9.0 | 2022-09-13 | Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev insta… |
CVE-2022-36106 | Medium | 5.4 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset… |
CVE-2022-39801 | High | 7.5 | 2022-09-13 | SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logo… |
CVE-2022-38700 | High | 8.8 | 2022-09-09 | OpenHarmony-v3.1.1 and prior versions have a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service. |
CVE-2022-38081 | Medium | 6.2 | 2022-09-09 | OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of… |