CWE-287 · Improper Authentication (page 25)
Page 25 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-10709 | High | 7.1 | 2021-05-27 | A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication… |
CVE-2018-16496 | Medium | 5.3 | 2021-05-26 | In Versa Director, the un-authentication request found. |
CVE-2021-31924 | Medium | 6.8 | 2021-05-26 | Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This iss… |
CVE-2020-26558 | Medium | 4.2 | 2021-05-24 | Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey u… |
CVE-2020-26557 | High | 7.5 | 2021-05-24 | Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the AuthValue used in the provisioning protocol… |
CVE-2002-2438 | High | 7.5 | 2021-05-18 | TCP firewalls could be circumvented by sending a SYN Packets with other flags (like e.g. RST flag) set, which was not correctly discarded by the Linux TCP stac… |
CVE-2021-27734 | Critical | 9.8 | 2021-05-17 | Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing… |
CVE-2021-29047 | High | 7.5 | 2021-05-16 | The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, whi… |
CVE-2021-22155 | High | 8.8 | 2021-05-13 | An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 an… |
CVE-2020-26139 | Medium | 5.3 | 2021-05-11 | An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfull… |
CVE-2021-23008 | Critical | 9.8 | 2021-05-10 | On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD (Activ… |
CVE-2021-31520 | High | 8.1 | 2021-05-10 | A weak session token authentication bypass vulnerability in Trend Micro IM Security 1.6 and 1.6.5 could allow an remote attacker to guess currently logged-in a… |
CVE-2021-26077 | High | 8.8 | 2021-05-10 | Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot… |
CVE-2021-28152 | Critical | 9.8 | 2021-05-06 | Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser. To connect, the telnet service is used on port 5188 wit… |
CVE-2021-32030 | Critical | 9.8 | 2021-05-06 | The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when proce… |
CVE-2021-31245 | Medium | 5.9 | 2021-05-06 | omr-admin.py in openmptcprouter-vps-admin 0.57.3 and earlier compares the user provided password with the original password in a length dependent manner, which… |
CVE-2021-1468 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2020-19111 | Critical | 9.8 | 2021-05-06 | Incorrect Access Control vulnerability in Online Book Store v1.0 via admin_verify.php, which could let a remote mailicious user bypass authentication and obtai… |
CVE-2021-21544 | Low | 2.7 | 2021-04-30 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could… |
CVE-2021-27651 | Critical | 9.8 | 2021-04-29 | In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks. |
CVE-2021-20092 | High | 7.5 | 2021-04-29 | The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly restrict access to sensitive inf… |
CVE-2021-25147 | High | 8.1 | 2021-04-28 | A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released p… |
CVE-2020-21991 | Critical | 9.8 | 2021-04-28 | AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly calling the autologin GET parameter in c… |
CVE-2021-23365 | Medium | 4.8 | 2021-04-26 | The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML auth… |
CVE-2021-22893 | Critical | 10.0 | 2021-04-23 | Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure… |
CVE-2021-20590 | High | 7.5 | 2021-04-22 | Improper authentication vulnerability in GOT2000 series GT27 model VNC server versions 01.39.010 and prior, GOT2000 series GT25 model VNC server versions 01.39… |
CVE-2020-28973 | High | 7.5 | 2021-04-21 | The ABUS Secvest wireless alarm system FUAA50000 (v3.01.17) fails to properly authenticate some requests to its built-in HTTPS interface. Someone can use this… |
CVE-2020-7856 | High | 7.5 | 2021-04-20 | A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient authentication v… |
CVE-2021-26074 | Medium | 6.5 | 2021-04-16 | Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot pack… |
CVE-2021-26073 | High | 7.7 | 2021-04-16 | Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building A… |
CVE-2021-20288 | High | 7.2 | 2021-04-15 | An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_ke… |
CVE-2021-27990 | High | 7.5 | 2021-04-14 | Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet/mail.aspx can be called directly and the framework is exposed w… |
CVE-2021-21399 | Critical | 9.1 | 2021-04-13 | Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic A… |
CVE-2021-22497 | Low | 3.8 | 2021-04-12 | Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue. |
CVE-2021-20020 | Critical | 9.8 | 2021-04-10 | A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root. |
CVE-2021-25377 | Low | 3.3 | 2021-04-09 | Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(10.0) above allows attacker to execute pr… |
CVE-2021-22507 | Critical | 9.8 | 2021-04-08 | Authentication bypass vulnerability in Micro Focus Operations Bridge Manager affects versions 2019.05, 2019.11, 2020.05 and 2020.10. The vulnerability could al… |
CVE-2021-27522 | High | 8.8 | 2021-04-08 | Learnsite 1.2.5.0 contains a remote privilege escalation vulnerability in /Manager/index.aspx through the JudgIsAdmin() function. By modifying the initial lett… |
CVE-2021-28174 | Medium | 6.5 | 2021-04-08 | Mitake smart stock selection system contains a broken authentication vulnerability. By manipulating the parameters in the URL, remote attackers can gain the pr… |
CVE-2021-1472 | Medium | 5.3 | 2021-04-08 | Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary comma… |
CVE-2021-30158 | Medium | 5.3 | 2021-04-06 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has secu… |
CVE-2021-24175 | Critical | 9.8 | 2021-04-05 | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing… |
CVE-2019-20464 | High | 7.5 | 2021-04-02 | An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. By default, a mobile application is used to stream over UDP. Howev… |
CVE-2021-29012 | Critical | 9.8 | 2021-04-02 | DMA Softlab Radius Manager 4.4.0 assigns the same session cookie to every admin session. The cookie is valid when the admin is logged in, but is invalid (tempo… |
CVE-2021-23923 | High | 8.1 | 2021-04-01 | An issue was discovered in Devolutions Server before 2020.3. There is Broken Authentication with Windows domain users. |
CVE-2021-21982 | Critical | 9.1 | 2021-04-01 | VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with network access to… |
CVE-2019-5317 | Medium | 6.8 | 2021-03-29 | A local authentication bypass vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4… |
CVE-2021-21403 | High | 7.5 | 2021-03-26 | In github.com/kongchuanhujiao/server before version 1.3.21 there is an authentication Bypass by Primary Weakness vulnerability. All users are impacted. This is… |
CVE-2021-3153 | Medium | 6.5 | 2021-03-26 | HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor au… |
CVE-2021-25368 | Low | 3.3 | 2021-03-25 | Hijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is executed. |
CVE-2021-22496 | High | 7.5 | 2021-03-25 | Authentication Bypass Vulnerability in Micro Focus Access Manager Product, affects all version prior to version 4.5.3.3. The vulnerability could cause informat… |
CVE-2021-26070 | High | 7.2 | 2021-03-22 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken… |
CVE-2021-24148 | Critical | 9.8 | 2021-03-18 | A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated… |
CVE-2021-22860 | Critical | 9.8 | 2021-03-17 | EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to ob… |
CVE-2021-20018 | Medium | 4.9 | 2021-03-13 | A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address. This vulnerability i… |
CVE-2021-21378 | High | 8.2 | 2021-03-11 | Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token wit… |
CVE-2020-35231 | High | 8.8 | 2021-03-10 | The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an authentication issue that allows an attacker to bypass acces… |
CVE-2020-27838 | Medium | 6.5 | 2021-03-08 | A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret… |
CVE-2021-21335 | Medium | 5.3 | 2021-03-08 | In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed… |
CVE-2021-21329 | High | 8.7 | 2021-03-08 | RATCF is an open-source framework for hosting Cyber-Security Capture the Flag events. In affected versions of RATCF users with multi factor authentication enab… |
CVE-2020-28050 | Critical | 9.1 | 2021-03-05 | Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the server. |
CVE-2020-5148 | High | 8.2 | 2021-03-05 | SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a potential attacker to ca… |
CVE-2021-25347 | Medium | 5.3 | 2021-03-04 | Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to intercept when the provider is executed. |
CVE-2021-25343 | Medium | 4.0 | 2021-03-04 | Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.13 (in Android P(9.0) and above) allows… |
CVE-2021-25342 | Medium | 4.0 | 2021-03-04 | Calling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of service attack by hijacking the provider. |
CVE-2021-25341 | Medium | 4.0 | 2021-03-04 | Calling of non-existent provider in S Assistant prior to version 6.5.01.22 allows unauthorized actions including denial of service attack by hijacking the prov… |
CVE-2021-25315 | Critical | 9.8 | 2021-03-03 | CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary c… |
CVE-2021-21513 | High | 8.6 | 2021-03-02 | Dell EMC OpenManage Server Administrator (OMSA) version 9.5 Microsoft Windows installations with Distributed Web Server (DWS) enabled configuration contains an… |
CVE-2021-3332 | Medium | 5.3 | 2021-03-01 | WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via post_password. |
CVE-2021-25281 | Critical | 9.8 | 2021-02-27 | An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can re… |
CVE-2021-21308 | Medium | 6.1 | 2021-02-26 | PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is ab… |
CVE-2020-26200 | Medium | 6.8 | 2021-02-26 | A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorp… |
CVE-2021-3339 | Medium | 4.3 | 2021-02-19 | ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the Search Screen and the Profile Screen. |
CVE-2020-10254 | Medium | 5.9 | 2021-02-19 | An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its preview. |
CVE-2021-22858 | High | 8.8 | 2021-02-17 | Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining use… |
CVE-2020-27866 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2… |
CVE-2020-27865 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version 1.04B03 WiFi exten… |
CVE-2020-27863 | Medium | 6.5 | 2021-02-12 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A routers. Auth… |
CVE-2020-13185 | Medium | 6.5 | 2021-02-11 | Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the need to specify auth… |
CVE-2021-21502 | Critical | 9.8 | 2021-02-09 | Dell PowerScale OneFS versions 8.1.0 – 9.1.0 contain a "use of SSH key past account expiration" vulnerability. A user on the network with the ISI_PRIV_AUTH_SSH… |
CVE-2020-10048 | Medium | 5.5 | 2021-02-09 | A vulnerability has been identified in SIMATIC PCS 7 (All versions), SIMATIC WinCC (All versions < V7.5 SP2). Due to an insecure password verification process… |
CVE-2021-26905 | Medium | 6.5 | 2021-02-08 | 1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key. |
CVE-2020-10539 | Critical | 9.8 | 2021-02-05 | An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort() function that, upon user login, checks the submitted password a… |
CVE-2020-17523 | Critical | 9.8 | 2021-02-03 | Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. |
CVE-2021-3282 | High | 7.5 | 2021-02-01 | HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in… |
CVE-2020-15835 | Critical | 9.8 | 2021-02-01 | An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function contains undocumented code that provides the ability to… |
CVE-2020-13859 | Critical | 9.8 | 2021-02-01 | An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Confi… |
CVE-2021-25910 | High | 8.0 | 2021-01-29 | Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several p… |
CVE-2021-26117 | High | 7.5 | 2021-01-27 | The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to versio… |
CVE-2021-3297 | High | 7.8 | 2021-01-26 | On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access. |
CVE-2021-25863 | High | 8.8 | 2021-01-26 | Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. |
CVE-2020-28874 | High | 7.5 | 2021-01-26 | reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly conside… |
CVE-2020-4983 | High | 7.8 | 2021-01-20 | IBM Spectrum LSF 10.1 and IBM Spectrum LSF Suite 10.2 could allow a user on the local network who has privileges to submit LSF jobs to execute arbitrary comman… |
CVE-2020-27266 | Medium | 6.5 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A m… |
CVE-2020-24641 | High | 7.5 | 2021-01-15 | In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if successfully exploited ca… |
CVE-2021-22171 | High | 7.3 | 2021-01-15 | Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a malic… |
CVE-2020-27488 | Critical | 9.8 | 2021-01-13 | Loxone Miniserver devices with firmware before 11.1 (aka 11.1.9.3) are unable to use an authentication method that is based on the "signature of the update pac… |
CVE-2020-5686 | High | 7.5 | 2021-01-13 | Incorrect implementation of authentication algorithm issue in UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to access… |
CVE-2020-5633 | Critical | 9.8 | 2021-01-13 | Multiple NEC products (Express5800/T110j, Express5800/T110j-S, Express5800/T110j (2nd-Gen), Express5800/T110j-S (2nd-Gen), iStorage NS100Ti, and Express5800/GT… |
CVE-2021-1725 | Medium | 5.5 | 2021-01-12 | Bot Framework SDK Information Disclosure Vulnerability |