CWE-287 · Improper Authentication (page 24)
Page 24 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-38064 | Medium | 6.2 | 2022-09-09 | OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information. |
CVE-2022-36093 | High | 8.5 | 2022-09-08 | XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template… |
CVE-2022-36092 | High | 7.5 | 2022-09-08 | XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normall… |
CVE-2022-37164 | Critical | 9.8 | 2022-09-08 | Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Ad… |
CVE-2022-37163 | Critical | 9.8 | 2022-09-08 | Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force a… |
CVE-2022-20923 | Medium | 4.0 | 2022-09-08 | A vulnerability in the IPSec VPN Server authentication functionality of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthent… |
CVE-2022-38399 | Medium | 6.8 | 2022-09-08 | Missing protection mechanism for alternate hardware interface in SmaCam CS-QR10 all versions and SmaCam Night Vision CS-QR20 all versions allows an attacker to… |
CVE-2022-36073 | High | 8.3 | 2022-09-07 | RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's emai… |
CVE-2022-3152 | High | 8.8 | 2022-09-07 | Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20. |
CVE-2022-26858 | Medium | 6.1 | 2022-09-06 | Dell BIOS versions contain an Improper Authentication vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sen… |
CVE-2022-31020 | High | 8.8 | 2022-09-06 | Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request hand… |
CVE-2022-36071 | High | 8.3 | 2022-09-02 | SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time… |
CVE-2022-34380 | Critical | 9.3 | 2022-09-01 | Dell CloudLink 7.1.3 and all earlier versions contain an Authentication Bypass Using an Alternate Path or Channel Vulnerability. A high privileged local attack… |
CVE-2022-34379 | Critical | 9.4 | 2022-09-01 | Dell EMC CloudLink 7.1.2 and all prior versions contain an Authentication Bypass Vulnerability. A remote attacker, with the knowledge of the active directory u… |
CVE-2022-34372 | Critical | 9.8 | 2022-09-01 | Dell PowerProtect Cyber Recovery versions before 19.11.0.2 contain an authentication bypass vulnerability. A remote unauthenticated attacker may potentially ac… |
CVE-2022-38557 | Critical | 9.8 | 2022-08-28 | D-Link DIR845L v1.00-v1.03 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh. |
CVE-2022-38556 | Critical | 9.8 | 2022-08-28 | Trendnet TEW733GR v1.03B01 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh. |
CVE-2022-36755 | Critical | 9.8 | 2022-08-28 | D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZED_GROUP=1 value, as demonstrated by a request for getcfg.php. |
CVE-2021-3632 | High | 7.5 | 2022-08-26 | A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any u… |
CVE-2021-3979 | Medium | 6.5 | 2022-08-25 | A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to c… |
CVE-2022-2031 | High | 8.8 | 2022-08-25 | A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt… |
CVE-2021-4142 | Medium | 5.5 | 2022-08-24 | The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple conten… |
CVE-2022-35726 | Medium | 4.3 | 2022-08-23 | Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress. |
CVE-2021-3827 | Medium | 6.8 | 2022-08-23 | A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can… |
CVE-2022-35203 | High | 7.2 | 2022-08-23 | An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system information. |
CVE-2022-34919 | Critical | 9.8 | 2022-08-23 | The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenticated. By uploading a crafted aspx file… |
CVE-2022-32282 | High | 8.8 | 2022-08-22 | An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash w… |
CVE-2022-34149 | Critical | 9.8 | 2022-08-22 | Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress. |
CVE-2022-22730 | Critical | 9.8 | 2022-08-18 | Improper authentication in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an unauthenticated user to potentially enable esca… |
CVE-2022-35198 | High | 7.5 | 2022-08-18 | Contract Management System v2.0 contains a weak default password which gives attackers to access database connection information. |
CVE-2022-2336 | Critical | 9.8 | 2022-08-17 | Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admi… |
CVE-2022-2662 | Critical | 9.6 | 2022-08-16 | Sequi PortBloque S has a improper authentication issues which may allow an attacker to bypass the authentication process and gain user-level access to the devi… |
CVE-2022-38368 | High | 8.8 | 2022-08-15 | An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated… |
CVE-2022-36524 | High | 7.5 | 2022-08-15 | D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Static Default Credentials via /etc/init0.d/S80telnetd.sh. |
CVE-2022-37397 | High | 8.3 | 2022-08-12 | An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticat… |
CVE-2022-2503 | Medium | 6.9 | 2022-08-12 | Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root f… |
CVE-2022-38180 | Medium | 5.3 | 2022-08-12 | In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases |
CVE-2022-2765 | Medium | 6.3 | 2022-08-11 | A vulnerability was found in SourceCodester Company Website CMS 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2022-32429 | Critical | 9.8 | 2022-08-10 | An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unaut… |
CVE-2022-29083 | Medium | 6.8 | 2022-08-09 | Prior Dell BIOS versions contain an Improper Authentication vulnerability. An unauthenticated attacker with physical access to the system could potentially exp… |
CVE-2022-36296 | Medium | 6.5 | 2022-08-05 | Broken Authentication vulnerability in JumpDEMAND Inc. ActiveDEMAND plugin <= 0.2.27 at WordPress allows unauthenticated post update/create/delete. |
CVE-2022-33732 | Medium | 6.2 | 2022-08-05 | Improper access control vulnerability in Samsung Dex for PC prior to SMR Aug-2022 Release 1 allows local attackers to scan and connect to PC by unprotected bin… |
CVE-2022-33720 | Low | 2.4 | 2022-08-05 | Improper authentication vulnerability in AppLock prior to SMR Aug-2022 Release 1 allows physical attacker to access Chrome locked by AppLock via new tap shortc… |
CVE-2022-2303 | Medium | 4.3 | 2022-08-05 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15… |
CVE-2022-2664 | High | 7.3 | 2022-08-05 | A vulnerability classified as critical has been found in Private Cloud Management Platform. Affected is an unknown function of the file /management/api/rcx_man… |
CVE-2022-35142 | High | 7.5 | 2022-08-04 | An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter. |
CVE-2022-27484 | Medium | 5.4 | 2022-08-03 | A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypass the Old Password… |
CVE-2022-35925 | Medium | 5.3 | 2022-08-02 | BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force at… |
CVE-2022-35629 | Medium | 5.4 | 2022-07-29 | Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, t… |
CVE-2016-0796 | High | 7.5 | 2022-07-28 | WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vul… |
CVE-2022-2553 | Medium | 6.5 | 2022-07-28 | The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do no… |
CVE-2022-30270 | Critical | 9.8 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 has default credentials. It exposes an SSH interface on port 22/TCP. This interface is used for remote maintenance… |
CVE-2022-36412 | Critical | 9.8 | 2022-07-26 | In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. (An API request may, in effect, be executed with… |
CVE-2022-34575 | Medium | 5.7 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing fct… |
CVE-2022-34839 | Medium | 5.9 | 2022-07-22 | Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress. |
CVE-2022-31164 | High | 7.5 | 2022-07-22 | Tovy is a a staff management system for Roblox groups. A vulnerability in versions prior to 0.7.51 allows users to log in as other users, including privileged… |
CVE-2022-28666 | Medium | 5.3 | 2022-07-21 | Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-content-toggle option… |
CVE-2022-26136 | Critical | 9.8 | 2022-07-20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impa… |
CVE-2022-2141 | Critical | 9.8 | 2022-07-20 | SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication. |
CVE-2022-34535 | High | 7.5 | 2022-07-19 | Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows unauthenticated attackers to view internal paths and scripts via web files. |
CVE-2022-30624 | Medium | 6.8 | 2022-07-18 | Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password. |
CVE-2022-30623 | Medium | 5.9 | 2022-07-18 | The server checks the user's cookie in a non-standard way, and a value is entered in the cookie value name of the status and its value is set to true to bypass… |
CVE-2021-40874 | Critical | 9.8 | 2022-07-18 | An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST password validation service (for anothe… |
CVE-2022-30550 | High | 8.8 | 2022-07-17 | An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args s… |
CVE-2022-2133 | Medium | 5.3 | 2022-07-17 | The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto th… |
CVE-2017-20133 | High | 7.3 | 2022-07-16 | A vulnerability, which was classified as critical, was found in Itech Job Portal Script 9.13. This affects an unknown part of the file /admin. The manipulation… |
CVE-2022-33689 | Medium | 6.2 | 2022-07-12 | Improper access control vulnerability in TelephonyUI prior to SMR Jul-2022 Release 1 allows attackers to change preferred network type by unprotected binder ca… |
CVE-2022-30755 | High | 7.3 | 2022-07-12 | Improper authentication vulnerability in AppLock prior to SMR Jul-2022 Release 1 allows attacker to bypass password confirm activity by hijacking the implicit… |
CVE-2022-33736 | High | 7.5 | 2022-07-12 | A vulnerability has been identified in Opcenter Quality V13.1 (All versions < V13.1.20220624), Opcenter Quality V13.2 (All versions < V13.2.20220624). The affe… |
CVE-2022-2302 | Critical | 9.8 | 2022-07-11 | Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote at… |
CVE-2015-5298 | Medium | 6.5 | 2022-07-07 | The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be… |
CVE-2022-31131 | Medium | 5.4 | 2022-07-06 | Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership… |
CVE-2022-31125 | Critical | 10.0 | 2022-07-06 | Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated… |
CVE-2021-43116 | High | 8.8 | 2022-07-05 | An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change… |
CVE-2022-28713 | Medium | 5.3 | 2022-07-04 | Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information withou… |
CVE-2021-41995 | High | 7.7 | 2022-06-30 | A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass. |
CVE-2022-2197 | Critical | 9.8 | 2022-06-30 | By using a specific credential string, an attacker with network access to the device’s web interface could circumvent the authentication scheme and perform adm… |
CVE-2022-1955 | Medium | 4.6 | 2022-06-30 | Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possib… |
CVE-2021-41506 | Critical | 9.8 | 2022-06-30 | Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.2… |
CVE-2022-29858 | Medium | 4.3 | 2022-06-28 | Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changing an existing ima… |
CVE-2022-33202 | High | 8.1 | 2022-06-27 | Authentication bypass vulnerability in the setup screen of L2Blocker(on-premise) Ver4.8.5 and earlier and L2Blocker(Cloud) Ver4.8.5 and earlier allows an adjac… |
CVE-2022-29578 | Medium | 5.3 | 2022-06-24 | Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address, and daily energy… |
CVE-2021-41638 | High | 7.5 | 2022-06-24 | The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files only by using a valid… |
CVE-2021-26638 | High | 7.3 | 2022-06-23 | Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and information exposure. Remote attackers can us… |
CVE-2021-26637 | High | 8.8 | 2022-06-23 | There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unauthorized users can… |
CVE-2022-29775 | Critical | 9.8 | 2022-06-21 | iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL. |
CVE-2022-33139 | Critical | 9.8 | 2022-06-21 | A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All ver… |
CVE-2022-1801 | High | 7.5 | 2022-06-20 | The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as… |
CVE-2022-31083 | High | 8.6 | 2022-06-17 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in… |
CVE-2022-32276 | High | 7.5 | 2022-06-17 | Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability |
CVE-2020-36548 | Medium | 5.9 | 2022-06-17 | A vulnerability classified as problematic has been found in GE Voluson S8. Affected is the file /uscgi-bin/users.cgi of the Service Browser. The manipulation l… |
CVE-2018-25043 | Medium | 5.0 | 2022-06-17 | A vulnerability classified as critical was found in uTorrent. This vulnerability affects unknown code of the component PRNG. The manipulation leads to weak aut… |
CVE-2022-33750 | Critical | 9.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an authentication error vulnerability in the Automic agent that could allow a remote attacker to potentially execut… |
CVE-2018-18907 | High | 7.5 | 2022-06-16 | An issue was discovered on D-Link DIR-850L 1.21WW devices. A partially completed WPA handshake is sufficient for obtaining full access to the wireless network… |
CVE-2022-29865 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials. |
CVE-2022-30150 | High | 7.5 | 2022-06-15 | Windows Defender Remote Credential Guard Elevation of Privilege Vulnerability |
CVE-2022-21935 | High | 7.5 | 2022-06-15 | A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change. |
CVE-2022-20798 | Critical | 9.8 | 2022-06-15 | A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA)… |
CVE-2022-20733 | Medium | 5.3 | 2022-06-15 | A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and acc… |
CVE-2022-30229 | High | 7.2 | 2022-06-14 | A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does not require authenticated access for pri… |