CWE-287 · Improper Authentication (page 23)
Page 23 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-45917 | High | 8.0 | 2022-01-03 | The server-request receiver function of Shockwall system has an improper authentication vulnerability. An authenticated attacker of an agent computer within th… |
CVE-2021-23147 | Medium | 6.8 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is ab… |
CVE-2021-20168 | Medium | 6.8 | 2021-12-30 | Netgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface. A malicious actor with physical access to the device is able to conn… |
CVE-2021-20161 | Medium | 6.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. A malicious actor with physical access to the devic… |
CVE-2021-45379 | High | 8.8 | 2021-12-30 | Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user without its password. |
CVE-2021-38688 | High | 7.1 | 2021-12-29 | An improper authentication vulnerability has been reported to affect Android App Qfile. If exploited, this vulnerability allows attackers to compromise app and… |
CVE-2021-45890 | Critical | 9.8 | 2021-12-27 | basic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive identifier. |
CVE-2021-21952 | Critical | 9.8 | 2021-12-22 | An authentication bypass vulnerability exists in the CMD_DEVICE_GET_RSA_KEY_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h… |
CVE-2021-21902 | High | 8.1 | 2021-12-22 | An authentication bypass vulnerability exists in the CMA run_server_6877 functionality of Garrett Metal Detectors iC Module CMA Version 5.0. A properly-timed n… |
CVE-2021-27451 | High | 7.3 | 2021-12-21 | Mesa Labs AmegaView Versions 3.0 and prior’s passcode is generated by an easily reversible algorithm, which may allow an attacker to gain access to the device. |
CVE-2021-36350 | Medium | 5.9 | 2021-12-21 | Dell PowerScale OneFS, versions 8.2.2-9.3.0.x, contain an authentication bypass by primary weakness in one of the authentication factors. A remote unauthentica… |
CVE-2021-44525 | Critical | 9.8 | 2021-12-20 | Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is… |
CVE-2021-44676 | Critical | 9.8 | 2021-12-20 | Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few aspects of the appl… |
CVE-2021-44675 | Critical | 9.8 | 2021-12-20 | Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentic… |
CVE-2021-40851 | High | 7.5 | 2021-12-17 | TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability mi… |
CVE-2021-43834 | Critical | 9.1 | 2021-12-16 | eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows an attacker to authenticate… |
CVE-2021-43833 | High | 8.1 | 2021-12-16 | eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows any authenticated user to ga… |
CVE-2021-43935 | High | 8.1 | 2021-12-15 | The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accep… |
CVE-2021-4073 | Critical | 9.8 | 2021-12-14 | The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid us… |
CVE-2021-44937 | Medium | 5.3 | 2021-12-14 | glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /public_html/users.php. An attacker can register with the mailbox of any use… |
CVE-2021-44524 | Critical | 9.8 | 2021-12-14 | A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions)… |
CVE-2021-39064 | High | 7.5 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier has weak authentication and password rules and incorrectly handles default credentials for the Spectrum Co… |
CVE-2021-44514 | Critical | 9.8 | 2021-12-09 | OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories. |
CVE-2021-41265 | High | 8.1 | 2021-12-09 | Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The… |
CVE-2021-21955 | High | 7.5 | 2021-12-09 | An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. Gen… |
CVE-2021-20145 | High | 7.5 | 2021-12-09 | Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN network which exposes the… |
CVE-2021-43068 | Medium | 5.4 | 2021-12-09 | A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authentication via a RADIUS login portal. |
CVE-2021-36718 | Medium | 6.1 | 2021-12-08 | SYNEL - eharmonynew / Synel Reports - The attacker can log in to the system with default credentials and export a report of eharmony system with sensetive data… |
CVE-2021-37054 | High | 7.5 | 2021-12-08 | There is an Identity spoofing and authentication bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service con… |
CVE-2021-41311 | High | 7.5 | 2021-12-08 | Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify pr… |
CVE-2021-41309 | Medium | 5.3 | 2021-12-08 | Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of anothe… |
CVE-2021-41716 | Critical | 9.8 | 2021-12-07 | Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in… |
CVE-2021-43175 | High | 7.5 | 2021-12-07 | The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other… |
CVE-2021-37100 | High | 7.5 | 2021-12-07 | There is a Improper Authentication vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to account authentication bypassed. |
CVE-2021-37043 | High | 7.5 | 2021-12-07 | There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to malicious application proce… |
CVE-2021-43931 | Critical | 9.8 | 2021-12-06 | The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary… |
CVE-2021-39890 | Low | 3.1 | 2021-12-06 | It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above. |
CVE-2021-43786 | Critical | 9.8 | 2021-11-29 | Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed mast… |
CVE-2021-38686 | High | 8.8 | 2021-11-26 | An improper authentication vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows attackers to compromise the… |
CVE-2021-35033 | High | 7.8 | 2021-11-23 | A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an… |
CVE-2021-38376 | Medium | 5.3 | 2021-11-22 | OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call. |
CVE-2021-36308 | Medium | 5.9 | 2021-11-20 | Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an authentication bypass vulnerability. A remote unauthenticated a… |
CVE-2021-36306 | High | 8.1 | 2021-11-20 | Networking OS10, versions prior to October 2021 with RESTCONF API enabled, contains an authentication bypass vulnerability. A remote unauthenticated attacker c… |
CVE-2021-42338 | Critical | 9.8 | 2021-11-19 | 4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in… |
CVE-2021-33087 | Medium | 5.5 | 2021-11-17 | Improper authentication in the installer for the Intel(R) NUC M15 Laptop Kit Management Engine driver pack before version 15.0.10.1508 may allow an authenticat… |
CVE-2021-0096 | High | 7.8 | 2021-11-17 | Improper authentication in the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN, NUC7i7DN before version 1.78.1.1 may a… |
CVE-2021-37580 | Critical | 9.8 | 2021-11-16 | A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apac… |
CVE-2021-3788 | Medium | 6.8 | 2021-11-12 | An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access unauthorized access… |
CVE-2021-3519 | Medium | 6.4 | 2021-11-12 | A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List"… |
CVE-2021-43203 | High | 7.5 | 2021-11-09 | In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly. |
CVE-2021-24647 | High | 8.1 | 2021-11-08 | The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in t… |
CVE-2021-42072 | High | 8.8 | 2021-11-08 | An issue was discovered in Barrier before 2.4.0. The barriers component (aka the server-side implementation of Barrier) does not sufficiently verify the identi… |
CVE-2021-31602 | Medium | 5.3 | 2021-11-08 | An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has different layers of… |
CVE-2021-43414 | High | 7.0 | 2021-11-07 | An issue was discovered in GNU Hurd before 0.9 20210404-9. The use of an authentication protocol in the proc server is vulnerable to man-in-the-middle attacks… |
CVE-2021-42837 | Critical | 9.8 | 2021-11-05 | An issue was discovered in Talend Data Catalog before 7.3-20210930. After setting up SAML/OAuth, authentication is not correctly enforced on the native login p… |
CVE-2021-25506 | Medium | 4.0 | 2021-11-05 | Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial of service. |
CVE-2021-25505 | Low | 3.3 | 2021-11-05 | Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked. |
CVE-2021-38161 | High | 8.1 | 2021-11-03 | Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache Traff… |
CVE-2021-33210 | Medium | 4.3 | 2021-11-03 | An issue was discovered in Fimer Aurora Vision before 2.97.10. An attacker can (in the WebUI) obtain plant information without authentication by reading the re… |
CVE-2021-41312 | High | 7.5 | 2021-11-03 | Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Management to enable and… |
CVE-2021-22490 | Medium | 5.3 | 2021-10-28 | There is a Permission verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect the device performance. |
CVE-2021-22473 | High | 7.5 | 2021-10-28 | There is an Authentication vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-32951 | Medium | 5.3 | 2021-10-27 | WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored… |
CVE-2021-41157 | Medium | 5.3 | 2021-10-26 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2021-37624 | High | 7.5 | 2021-10-25 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2020-23058 | Medium | 4.6 | 2021-10-22 | An issue in the authentication mechanism in Nong Ge File Explorer v1.4 unauthenticated allows to access sensitive data. |
CVE-2021-30312 | High | 7.5 | 2021-10-20 | Improper authentication of sub-frames of a multicast AMSDU frame can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connecti… |
CVE-2021-30302 | High | 7.5 | 2021-10-20 | Improper authentication of EAP WAPI EAPOL frames from unauthenticated user can lead to information disclosure in Snapdragon Compute, Snapdragon Connectivity, S… |
CVE-2021-31349 | Critical | 9.8 | 2021-10-19 | The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, ma… |
CVE-2010-2496 | Medium | 5.5 | 2021-10-18 | stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the… |
CVE-2021-37123 | Critical | 9.8 | 2021-10-11 | There is an improper authentication vulnerability in Hero-CT060 before 1.0.0.200. The vulnerability is due to that when an user wants to do certain operation… |
CVE-2021-41129 | High | 8.1 | 2021-10-06 | Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmation_token`… |
CVE-2021-41126 | High | 7.2 | 2021-10-06 | October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had pre… |
CVE-2021-25490 | Medium | 6.0 | 2021-10-06 | A keyblob downgrade attack in keymaster prior to SMR Oct-2021 Release 1 allows attacker to trigger IV reuse vulnerability with privileged process. |
CVE-2021-25484 | Medium | 4.0 | 2021-10-06 | Improper authentication in InputManagerService prior to SMR Oct-2021 Release 1 allows monitoring the touch event. |
CVE-2021-0595 | High | 7.8 | 2021-10-06 | In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logging in. This could le… |
CVE-2021-39226 | Critical | 9.8 | 2021-10-05 | Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowe… |
CVE-2021-41286 | High | 7.8 | 2021-10-05 | Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-side authentication mechanism. When a user logs into the application, the validity of the password is… |
CVE-2021-39872 | Medium | 6.5 | 2021-10-05 | In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through… |
CVE-2021-23857 | Critical | 10.0 | 2021-10-04 | Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CV… |
CVE-2021-35296 | Critical | 9.8 | 2021-10-04 | An issue in the administrator authentication panel of PTCL HG150-Ub v3.0 allows attackers to bypass authentication via modification of the cookie value and Res… |
CVE-2021-20578 | Critical | 9.8 | 2021-09-30 | IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing aut… |
CVE-2021-24017 | Medium | 5.4 | 2021-09-30 | An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via… |
CVE-2021-41292 | Critical | 9.8 | 2021-09-30 | ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authenticatio… |
CVE-2021-35943 | Critical | 9.8 | 2021-09-29 | Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC45… |
CVE-2021-38299 | Critical | 9.8 | 2021-09-27 | Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an… |
CVE-2021-31606 | High | 7.5 | 2021-09-27 | furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients. |
CVE-2021-41503 | High | 8.0 | 2021-09-24 | DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices command interface all… |
CVE-2021-22869 | Critical | 9.8 | 2021-09-24 | An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had acc… |
CVE-2021-31917 | Critical | 9.8 | 2021-09-21 | A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all… |
CVE-2021-38412 | Critical | 9.6 | 2021-09-17 | Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication… |
CVE-2021-41317 | Critical | 9.8 | 2021-09-17 | XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths. |
CVE-2021-41303 | Critical | 9.8 | 2021-09-17 | Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update t… |
CVE-2021-33045 | Critical | 9.8 | 2021-09-15 | The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by… |
CVE-2021-33044 | Critical | 9.8 | 2021-09-15 | The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by… |
CVE-2021-33700 | High | 7.8 | 2021-09-15 | SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowi… |
CVE-2021-39215 | High | 7.5 | 2021-09-15 | Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to valida… |
CVE-2021-3145 | Medium | 6.7 | 2021-09-10 | In Ionic Identity Vault before 5, a local root attacker on an Android device can bypass biometric authentication. |
CVE-2021-37414 | High | 7.5 | 2021-09-10 | Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication. |
CVE-2021-25466 | Medium | 6.5 | 2021-09-09 | Improper scheme check vulnerability in Samsung Internet prior to version 15.0.2.47 allows attackers to perform Man-in-the-middle attack and obtain Samsung Acco… |