CWE-287 · Improper Authentication (page 25)
Page 25 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-35094 | High | 7.8 | 2022-06-14 | Improper verification of timeout-based authentication in identity credential can lead to invalid authorization in HLOS in Snapdragon Auto, Snapdragon Compute… |
CVE-2022-22259 | Medium | 6.8 | 2022-06-13 | There is an improper authentication vulnerability in FLMG-10 10.0.1.0(H100SP22C00). Successful exploitation of this vulnerability may lead to a control of the… |
CVE-2022-30749 | Low | 3.3 | 2022-06-07 | Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity. |
CVE-2020-36533 | Low | 3.7 | 2022-06-07 | A vulnerability was found in Klapp App and classified as problematic. This issue affects some unknown processing of the JSON Web Token Handler. The manipulatio… |
CVE-2020-36528 | Medium | 5.5 | 2022-06-07 | A vulnerability, which was classified as critical, was found in Platinum Mobile 1.0.4.850. Affected is /MobileHandler.ashx which leads to broken access control… |
CVE-2022-30238 | High | 8.3 | 2022-06-02 | A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacks a session. Affecte… |
CVE-2022-31463 | High | 8.2 | 2022-06-02 | Owl Labs Meeting Owl 5.2.0.15 does not require a password for Bluetooth commands, because only client-side authentication is used. |
CVE-2022-30034 | High | 8.6 | 2022-06-02 | Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then acc… |
CVE-2022-26975 | High | 7.5 | 2022-06-02 | Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing log files without authentication. |
CVE-2022-31013 | Critical | 9.1 | 2022-05-31 | Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token… |
CVE-2022-31011 | High | 7.8 | 2022-05-31 | TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) workloads. Under certain conditions, an attacker can… |
CVE-2022-26724 | Medium | 5.5 | 2022-05-26 | An authentication issue was addressed with improved state management. This issue is fixed in tvOS 15.5. A local user may be able to enable iCloud Photos withou… |
CVE-2022-22576 | High | 8.1 | 2022-05-26 | An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properl… |
CVE-2022-26865 | Medium | 6.8 | 2022-05-26 | Dell Support Assist OS Recovery versions before 5.5.2 contain an Authentication Bypass vulnerability. An unauthenticated attacker with physical access to the s… |
CVE-2022-24422 | Critical | 9.6 | 2022-05-26 | Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker may pote… |
CVE-2021-4230 | Low | 3.7 | 2022-05-24 | A vulnerability has been found in Airfield Online and classified as problematic. This vulnerability affects the path /backups/ of the MySQL backup handler. An… |
CVE-2013-10004 | Medium | 6.5 | 2022-05-24 | A vulnerability classified as critical was found in Telecommunication Software SAMwin Contact Center Suite 5.1. This vulnerability affects the function passwor… |
CVE-2022-29237 | Medium | 5.4 | 2022-05-24 | Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users could pass along URL… |
CVE-2022-0910 | Medium | 6.5 | 2022-05-24 | A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 thro… |
CVE-2022-29165 | Critical | 10.0 | 2022-05-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 a… |
CVE-2021-30028 | High | 7.2 | 2022-05-20 | SOOTEWAY Wi-Fi Range Extender v1.5 was discovered to use default credentials (the admin password for the admin account) to access the TELNET service, allowing… |
CVE-2022-29883 | Medium | 5.3 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not restrict unauthenticated access to certain pages of the web inter… |
CVE-2022-28106 | Critical | 9.8 | 2022-05-20 | Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request. |
CVE-2021-42849 | Medium | 6.8 | 2022-05-18 | A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attack… |
CVE-2022-28955 | High | 7.5 | 2022-05-18 | An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php. |
CVE-2022-1349 | Medium | 4.3 | 2022-05-16 | The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_… |
CVE-2022-22796 | High | 7.0 | 2022-05-12 | Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click… |
CVE-2021-33083 | Medium | 4.4 | 2022-05-12 | Improper authentication in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products may allow an privil… |
CVE-2021-0193 | High | 7.2 | 2022-05-12 | Improper authentication in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of pr… |
CVE-2022-1681 | High | 7.2 | 2022-05-12 | Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions |
CVE-2022-1426 | Low | 2.0 | 2022-05-11 | An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions sta… |
CVE-2019-12254 | Critical | 9.8 | 2022-05-06 | In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for savi… |
CVE-2021-26253 | High | 8.1 | 2022-05-06 | A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6… |
CVE-2022-21934 | High | 8.0 | 2022-05-06 | Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 version… |
CVE-2021-44057 | High | 7.1 | 2022-05-05 | An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows attackers to co… |
CVE-2021-44056 | High | 7.1 | 2022-05-05 | An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to co… |
CVE-2022-24901 | High | 7.5 | 2022-05-04 | Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication, making the server v… |
CVE-2022-28790 | Medium | 4.0 | 2022-05-03 | Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device. The patch adds proper caller signature check l… |
CVE-2022-0916 | High | 8.4 | 2022-05-03 | An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks duri… |
CVE-2022-23723 | High | 7.7 | 2022-05-02 | An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow. |
CVE-2022-23722 | Medium | 6.5 | 2022-05-02 | When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authenticatio… |
CVE-2021-41992 | High | 7.7 | 2022-04-30 | A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass. |
CVE-2022-0985 | Medium | 4.3 | 2022-04-29 | Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete c… |
CVE-2022-24885 | Low | 2.0 | 2022-04-27 | Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.1, users can bypass a lock on the Nextclo… |
CVE-2022-24883 | High | 7.4 | 2022-04-26 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be success… |
CVE-2022-24882 | Critical | 9.1 | 2022-04-26 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort… |
CVE-2021-36460 | High | 7.8 | 2022-04-25 | VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the ba… |
CVE-2021-45841 | High | 8.1 | 2022-04-25 | In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's passw… |
CVE-2022-29534 | High | 7.5 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/jso… |
CVE-2022-0540 | Critical | 9.8 | 2022-04-20 | A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atl… |
CVE-2021-26627 | High | 7.5 | 2022-04-19 | Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerability could allow to remote attackers to se… |
CVE-2022-1065 | High | 8.1 | 2022-04-19 | A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus… |
CVE-2021-3652 | Medium | 6.5 | 2022-04-18 | A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any passwor… |
CVE-2022-24857 | High | 7.3 | 2022-04-15 | django-mfa3 is a library that implements multi factor authentication for the django web framework. It achieves this by modifying the regular login view. Django… |
CVE-2022-20695 | Critical | 10.0 | 2022-04-15 | A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to bypass a… |
CVE-2022-26034 | Critical | 9.1 | 2022-04-15 | Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Smal… |
CVE-2022-22956 | Critical | 9.8 | 2022-04-13 | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may… |
CVE-2022-27839 | Low | 3.3 | 2022-04-11 | Improper authentication vulnerability in SecretMode in Samsung Internet prior to version 16.2.1 allows attackers to access bookmark tab without proper credenti… |
CVE-2022-26091 | Medium | 5.7 | 2022-04-11 | Improper access control vulnerability in Knox Manage prior to SMR Apr-2022 Release 1 allows that physical attackers can bypass Knox Manage using a function key… |
CVE-2022-25833 | Low | 3.3 | 2022-04-11 | Improper authentication in ImsService prior to SMR Apr-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE permission. |
CVE-2022-25832 | Medium | 4.0 | 2022-04-11 | Improper authentication vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to use locked Myfiles app without authentication. |
CVE-2022-1067 | Medium | 6.5 | 2022-04-11 | Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting. |
CVE-2021-46740 | High | 7.5 | 2022-04-11 | The device authentication service module has a defect vulnerability introduced in the design process.Successful exploitation of this vulnerability may affect d… |
CVE-2022-1248 | High | 7.3 | 2022-04-06 | A vulnerability was found in SAP Information System 1.0 which has been rated as critical. Affected by this issue is the file /SAP_Information_System/controller… |
CVE-2021-32984 | Critical | 9.8 | 2022-04-04 | All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU M… |
CVE-2021-32980 | Critical | 9.8 | 2022-04-04 | Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attac… |
CVE-2022-24813 | Medium | 5.3 | 2022-04-04 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:Re… |
CVE-2022-28376 | High | 8.1 | 2022-04-03 | Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a CPE admin website, e.g., at the 10.0.0… |
CVE-2022-25157 | Critical | 9.1 | 2022-04-01 | Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electr… |
CVE-2022-25155 | High | 8.1 | 2022-04-01 | Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electr… |
CVE-2021-20238 | Low | 3.7 | 2022-04-01 | It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without auth… |
CVE-2022-26562 | Critical | 9.8 | 2022-04-01 | An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to authenticate even if the user account or… |
CVE-2022-23156 | Medium | 6.0 | 2022-04-01 | Wyse Device Agent version 14.6.1.4 and below contain an Improper Authentication vulnerability. A malicious user could potentially exploit this vulnerability by… |
CVE-2021-1950 | High | 7.8 | 2022-04-01 | Improper cleaning of secure memory between authenticated users can lead to face authentication bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec… |
CVE-2021-45900 | Medium | 6.5 | 2022-03-30 | Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configuration web portlet, a VIVOH_AUTH cookie… |
CVE-2019-9564 | High | 7.5 | 2022-03-30 | A vulnerability in the authentication logic of Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to bypass login and control the devices. This issue affects… |
CVE-2022-23795 | Critical | 9.8 | 2022-03-30 | An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could unde… |
CVE-2022-22935 | Low | 3.7 | 2022-03-29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to for… |
CVE-2022-1084 | High | 7.3 | 2022-03-29 | A vulnerability classified as critical was found in SourceCodester One Church Management System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2018-25030 | Low | 3.3 | 2022-03-28 | A vulnerability classified as problematic has been found in Mirmay Secure Private Browser and File Manager up to 2.5. Affected is the Auto Lock. A race conditi… |
CVE-2022-0342 | Critical | 9.8 | 2022-03-28 | An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.5… |
CVE-2021-26598 | Medium | 5.3 | 2022-03-28 | ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have… |
CVE-2022-1049 | High | 8.8 | 2022-03-25 | A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when usi… |
CVE-2021-26620 | High | 7.5 | 2022-03-25 | An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important informa… |
CVE-2021-31326 | Critical | 9.8 | 2022-03-24 | D-Link DIR-816 A2 1.10 B05 allows unauthenticated attackers to arbitrarily reset the device via a crafted tokenid parameter to /goform/form2Reboot.cgi. |
CVE-2022-0996 | Medium | 6.5 | 2022-03-23 | A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. |
CVE-2021-4197 | High | 7.8 | 2022-03-23 | An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some les… |
CVE-2022-0862 | Low | 3.1 | 2022-03-23 | A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote… |
CVE-2021-44759 | High | 8.1 | 2022-03-23 | Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle attack. This issue aff… |
CVE-2021-46390 | Medium | 6.8 | 2022-03-21 | An access control issue in the authentication module of Lexar_F35 v1.0.34 allows attackers to access sensitive data and cause a Denial of Service (DoS). An att… |
CVE-2022-22656 | Low | 3.3 | 2022-03-18 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-00… |
CVE-2022-0547 | Critical | 9.8 | 2022-03-18 | OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred auth… |
CVE-2022-26504 | High | 8.8 | 2022-03-17 | Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) all… |
CVE-2021-45786 | Critical | 9.8 | 2022-03-16 | In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges. |
CVE-2022-24740 | Medium | 5.0 | 2022-03-14 | Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authenti… |
CVE-2021-36368 | Low | 3.7 | 2022-03-13 | An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an atta… |
CVE-2022-22729 | High | 8.8 | 2022-03-11 | CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via… |
CVE-2022-25825 | Medium | 6.2 | 2022-03-10 | Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the authcode for sign-in. |
CVE-2022-25817 | Medium | 4.0 | 2022-03-10 | Improper authentication in One UI Home prior to SMR Mar-2022 Release 1 allows attacker to generate pinned-shortcut without user consent. |
CVE-2022-25816 | Medium | 4.1 | 2022-03-10 | Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change enable/disable without authentication |