CWE-287 · Improper Authentication (page 24)
Page 24 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25451 | Low | 3.3 | 2021-09-09 | A PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI data. |
CVE-2021-39296 | Critical | 10.0 | 2021-09-09 | In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system. |
CVE-2021-28495 | High | 7.2 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authentication can be bypassed… |
CVE-2021-28494 | Critical | 9.6 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication is bypassed by unpri… |
CVE-2021-28493 | High | 8.4 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, a user may be able to execute comma… |
CVE-2021-34786 | Medium | 6.5 | 2021-09-09 | Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or… |
CVE-2021-34785 | Medium | 6.5 | 2021-09-09 | Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or… |
CVE-2021-30605 | High | 7.8 | 2021-09-08 | Inappropriate implementation in the ChromeOS Readiness Tool installer on Windows prior to 1.0.2.0 loosens DCOM access rights on two objects allowing an attacke… |
CVE-2021-30702 | Medium | 4.6 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-… |
CVE-2021-30668 | Medium | 4.6 | 2021-09-08 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4. A person with physical access to a Mac may be able to bypass Login Wi… |
CVE-2021-30667 | Medium | 5.4 | 2021-09-08 | A logic issue was addressed with improved validation. This issue is fixed in iOS 14.6 and iPadOS 14.6. An attacker in WiFi range may be able to force a client… |
CVE-2021-1863 | Low | 2.4 | 2021-09-08 | An issue existed with authenticating the action triggered by an NFC tag. The issue was addressed with improved action authentication. This issue is fixed in iO… |
CVE-2021-30770 | Medium | 5.5 | 2021-09-08 | A logic issue was addressed with improved validation. This issue is fixed in iOS 14.7, tvOS 14.7, watchOS 7.6. An attacker that has already achieved kernel cod… |
CVE-2021-30769 | Medium | 5.5 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in iOS 14.7, tvOS 14.7, watchOS 7.6. A malicious attacker with arbitrary read a… |
CVE-2021-30720 | Medium | 5.4 | 2021-09-08 | A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS… |
CVE-2020-11301 | Critical | 9.1 | 2021-09-08 | Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosure in Snapdragon Auto, Snapdragon Comput… |
CVE-2020-11264 | Critical | 9.1 | 2021-09-08 | Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network packet injection in Snapdragon Auto, Snapdra… |
CVE-2021-39196 | High | 7.7 | 2021-09-07 | pcapture is an open source dumpcap web service interface . In affected versions this vulnerability allows an authenticated but unprivileged user to use the RES… |
CVE-2021-34746 | Critical | 9.8 | 2021-09-02 | A vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow a… |
CVE-2021-40350 | Critical | 9.8 | 2021-09-01 | webctrl.cgi.elf on Christie Digital DWU850-GS V06.46 devices allows attackers to perform any desired action via a crafted query containing an unspecified Cooki… |
CVE-2021-22002 | Critical | 9.8 | 2021-08-31 | VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom hos… |
CVE-2021-22943 | Critical | 9.6 | 2021-08-31 | A vulnerability found in UniFi Protect application V1.18.1 and earlier permits a malicious actor who has already gained access to a network to subsequently con… |
CVE-2021-34578 | Critical | 9.8 | 2021-08-31 | This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed request… |
CVE-2021-39177 | High | 7.4 | 2021-08-30 | Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to… |
CVE-2021-37417 | Critical | 9.8 | 2021-08-30 | Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation. |
CVE-2021-36370 | High | 7.5 | 2021-08-30 | An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displa… |
CVE-2021-32967 | Critical | 9.8 | 2021-08-30 | Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without being authenticated or authorized, which ma… |
CVE-2021-22025 | High | 7.5 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. An unauthenticated… |
CVE-2021-39165 | High | 8.1 | 2021-08-26 | Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Atta… |
CVE-2021-32648 | High | 8.2 | 2021-08-26 | octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password… |
CVE-2021-29487 | High | 7.4 | 2021-08-26 | octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability… |
CVE-2021-30867 | Medium | 5.5 | 2021-08-24 | The issue was addressed with improved authentication. This issue is fixed in iOS 15 and iPadOS 15. A malicious application may be able to access photo metadata… |
CVE-2021-37597 | Critical | 9.8 | 2021-08-19 | WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation. |
CVE-2021-39138 | Medium | 4.8 | 2021-08-19 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to signup users and als… |
CVE-2021-1561 | Medium | 5.4 | 2021-08-18 | A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authen… |
CVE-2021-3458 | Medium | 6.1 | 2021-08-17 | The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter settings to be modified. |
CVE-2021-24527 | Critical | 9.8 | 2021-08-16 | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog… |
CVE-2021-36949 | High | 7.1 | 2021-08-12 | Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability |
CVE-2021-36921 | High | 8.8 | 2021-08-12 | AIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall (AIWAF) devices with Manager 2.1.0 has Improper Authentication. An attacker ca… |
CVE-2021-27794 | High | 7.8 | 2021-08-12 | A vulnerability in the authentication mechanism of Brocade Fabric OS versions before Brocade Fabric OS v.9.0.1a, v8.2.3a and v7.4.2h could allow a user to Logi… |
CVE-2021-3046 | Medium | 6.8 | 2021-08-11 | An improper authentication vulnerability exists in Palo Alto Networks PAN-OS software that enables a SAML authenticated attacker to impersonate any other user… |
CVE-2021-37172 | High | 7.5 | 2021-08-10 | A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (V4.5.0). Affected devices fail to authenticate against configured pa… |
CVE-2021-21564 | Critical | 9.8 | 2021-08-09 | Dell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit… |
CVE-2014-9320 | Critical | 9.8 | 2021-08-09 | SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and consequently gain SYSTEM privileges via vect… |
CVE-2021-20598 | Medium | 5.3 | 2021-08-06 | Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R08/16/32/120SFCPU all versions, R08/16/32/12… |
CVE-2021-37545 | High | 7.5 | 2021-08-06 | In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made. |
CVE-2021-32579 | High | 7.8 | 2021-08-05 | Acronis True Image prior to 2021 Update 4 for Windows and Acronis True Image prior to 2021 Update 5 for macOS allowed an unauthenticated attacker (who has a lo… |
CVE-2021-25445 | Medium | 5.3 | 2021-08-05 | Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access internal files in Samsung Internet. |
CVE-2021-3636 | Medium | 4.6 | 2021-07-30 | It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The… |
CVE-2020-16839 | High | 7.5 | 2021-07-30 | On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an unauthenticated WebSo… |
CVE-2021-21538 | Critical | 9.6 | 2021-07-29 | Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker cou… |
CVE-2021-32794 | Medium | 6.8 | 2021-07-26 | ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code `POST /Api/ASF` A… |
CVE-2020-21932 | Medium | 5.3 | 2021-07-21 | A vulnerability in /Login.html of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to bypass login and obtain a partially authorized tok… |
CVE-2021-34676 | High | 7.5 | 2021-07-19 | Basix NEX-Forms through 7.8.7 allows authentication bypass for Excel report generation. |
CVE-2021-34675 | High | 7.5 | 2021-07-19 | Basix NEX-Forms through 7.8.7 allows authentication bypass for stored PDF reports. |
CVE-2021-35964 | High | 7.3 | 2021-07-19 | The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management f… |
CVE-2020-4821 | Critical | 9.8 | 2021-07-16 | IBM InfoSphere Data Replication 11.4 and IBM InfoSphere Change Data Capture for z/OS 10.2.1, under certain configurations, could allow a user to bypass authent… |
CVE-2021-34690 | Critical | 9.8 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows authentication bypass. A remote and unauthenticated attacker can bypass cloud authentication to connect and con… |
CVE-2021-21994 | Critical | 9.8 | 2021-07-13 | SFCB (Small Footprint CIM Broker) as used in ESXi has an authentication bypass vulnerability. A malicious actor with network access to port 5989 on ESXi may ex… |
CVE-2021-20593 | High | 7.1 | 2021-07-13 | Incorrect Implementation of Authentication Algorithm in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.2.50 to Ver. 3.35, GB-50… |
CVE-2021-32726 | High | 7.1 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a u… |
CVE-2020-19037 | Medium | 5.3 | 2021-07-12 | Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies. |
CVE-2021-26088 | High | 7.1 | 2021-07-12 | An improper authentication vulnerability in FSSO Collector version 5.0.295 and below may allow an unauthenticated user to bypass a FSSO firewall policy and acc… |
CVE-2021-32753 | High | 8.3 | 2021-07-09 | EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fu… |
CVE-2021-25442 | High | 7.5 | 2021-07-08 | Improper MDM policy management vulnerability in KME module prior to KCS version 1.39 allows MDM users to bypass Knox Manage authentication. |
CVE-2021-25430 | Medium | 4.3 | 2021-07-08 | Improper access control vulnerability in Bluetooth application prior to SMR July-2021 Release 1 allows untrusted application to access the Bluetooth informatio… |
CVE-2021-20776 | Critical | 9.8 | 2021-07-07 | Improper authentication vulnerability in SCT-40CM01SR and AT-40CM01SR allows an attacker to bypass access restriction and execute an arbitrary command via teln… |
CVE-2021-32738 | Medium | 6.5 | 2021-07-02 | js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 Stellar Web Authent… |
CVE-2021-35029 | Critical | 9.8 | 2021-07-02 | An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP… |
CVE-2021-30648 | Critical | 9.8 | 2021-06-30 | The Symantec Advanced Secure Gateway (ASG) and ProxySG web management consoles are susceptible to an authentication bypass vulnerability. An unauthenticated at… |
CVE-2019-18906 | Critical | 9.8 | 2021-06-30 | A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the… |
CVE-2021-33539 | High | 7.2 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable authentication bypass vulnerability exists in the hostname processing. A specially c… |
CVE-2021-33895 | High | 8.1 | 2021-06-25 | ETINET BACKBOX E4.09 and H4.09 mismanages password access control. When a user uses the User ID of the process running BBSV to login to the Backbox UI applicat… |
CVE-2021-21998 | Critical | 9.8 | 2021-06-23 | VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the… |
CVE-2020-22176 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a sensitive information disclosure vulnerability in multiple areas. Remote unauthenticated users can expl… |
CVE-2021-20737 | Medium | 6.5 | 2021-06-22 | Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via… |
CVE-2021-32693 | Medium | 6.8 | 2021-06-17 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symf… |
CVE-2021-32691 | High | 8.8 | 2021-06-16 | Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access… |
CVE-2021-1571 | High | 7.2 | 2021-06-16 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: H… |
CVE-2021-1543 | High | 7.2 | 2021-06-16 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: H… |
CVE-2021-1542 | High | 7.2 | 2021-06-16 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: H… |
CVE-2021-1541 | High | 7.2 | 2021-06-16 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: H… |
CVE-2021-27610 | Critical | 9.8 | 2021-06-16 | SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal… |
CVE-2021-24359 | Medium | 5.3 | 2021-06-14 | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate use… |
CVE-2021-22764 | Medium | 5.3 | 2021-06-11 | A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notifica… |
CVE-2021-25424 | High | 8.8 | 2021-06-11 | Improper authentication vulnerability in Tizen bluetooth-frwk prior to Firmware update JUN-2021 Release allows bluetooth attacker to take over the user's bluet… |
CVE-2021-25389 | Low | 2.3 | 2021-06-11 | Improper running task check in S Secure prior to SMR MAY-2021 Release 1 allows attackers to use locked app without authentication. |
CVE-2021-34546 | Medium | 6.8 | 2021-06-10 | An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the… |
CVE-2020-24514 | Medium | 6.8 | 2021-06-09 | Improper authentication in some Intel(R) RealSense(TM) IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical access. |
CVE-2021-23847 | Critical | 9.8 | 2021-06-09 | A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings… |
CVE-2020-26136 | Medium | 6.5 | 2021-06-08 | In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication. |
CVE-2021-31251 | Critical | 9.8 | 2021-06-04 | An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileg… |
CVE-2020-15077 | Medium | 5.3 | 2021-06-04 | OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with… |
CVE-2020-14380 | High | 7.5 | 2021-06-02 | An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. A potential attacker with proper authentication to the relevant external authentication s… |
CVE-2021-3424 | Medium | 5.3 | 2021-06-01 | A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a na… |
CVE-2021-32646 | Medium | 5.3 | 2021-05-28 | Roomer is a discord bot cog (extension) which provides automatic voice channel generation as well as private voice and text channels. A vulnerability has been… |
CVE-2021-32637 | Critical | 10.0 | 2021-05-28 | Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_request_module with Authelia, it allows a… |
CVE-2021-20278 | Medium | 6.5 | 2021-05-28 | An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is enabled, Ki… |
CVE-2021-32543 | Medium | 6.5 | 2021-05-28 | The CTS Web transaction system related to authentication management is implemented incorrectly. After login, remote attackers can manipulate cookies to access… |
CVE-2021-32541 | Medium | 5.3 | 2021-05-28 | The CTS Web transaction system related to authentication and session management is implemented incorrectly, which allows remote unauthenticated attackers can s… |