CWE-287 · Improper Authentication (page 26)
Page 26 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24286 | High | 7.8 | 2022-03-10 | Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains a local privilege escalation vulnerability. The user process communicates w… |
CVE-2022-24285 | High | 7.8 | 2022-03-10 | Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability. The user process communicates with a service of system authori… |
CVE-2022-23383 | Critical | 9.1 | 2022-03-10 | YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge… |
CVE-2021-40376 | High | 7.8 | 2022-03-10 | otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named pipe. A remote attac… |
CVE-2022-24748 | Medium | 6.8 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modif… |
CVE-2022-0715 | Critical | 9.1 | 2022-03-09 | A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and use… |
CVE-2021-41181 | Low | 2.4 | 2022-03-08 | Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen s… |
CVE-2022-24738 | High | 8.1 | 2022-03-07 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from use… |
CVE-2022-23729 | High | 7.8 | 2022-03-04 | When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010. |
CVE-2022-0730 | Critical | 9.8 | 2022-03-03 | Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types. |
CVE-2022-0492 | High | 7.8 | 2022-03-03 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, a… |
CVE-2020-14504 | Medium | 5.3 | 2022-02-24 | The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacker can send a crafte… |
CVE-2022-23635 | High | 7.5 | 2022-02-22 | Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request proc… |
CVE-2022-23654 | High | 8.1 | 2022-02-22 | Wiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page outside the… |
CVE-2022-23652 | High | 8.8 | 2022-02-22 | capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authenti… |
CVE-2022-24047 | Critical | 9.8 | 2022-02-18 | This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to… |
CVE-2022-21196 | Critical | 10.0 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perfo… |
CVE-2020-25719 | High | 7.2 | 2022-02-18 | A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become conf… |
CVE-2016-2124 | Medium | 5.9 | 2022-02-18 | A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even i… |
CVE-2022-23317 | High | 7.5 | 2022-02-15 | CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the… |
CVE-2021-4201 | Critical | 9.6 | 2022-02-14 | Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, i… |
CVE-2021-45347 | High | 7.5 | 2022-02-14 | An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use… |
CVE-2022-24976 | Critical | 9.1 | 2022-02-14 | Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a… |
CVE-2021-22796 | High | 7.8 | 2022-02-11 | A CWE-287: Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded. Affected Product: C-Bus Toolk… |
CVE-2021-38679 | Medium | 6.5 | 2022-02-11 | An improper authentication vulnerability has been reported to affect QNAP NAS running Kazoo Server. If exploited, this vulnerability allows attackers to compro… |
CVE-2021-30317 | Critical | 9.3 | 2022-02-11 | Improper validation of program headers containing ELF metadata can lead to image verification bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect… |
CVE-2021-45331 | Critical | 9.8 | 2022-02-09 | An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA c… |
CVE-2022-23320 | High | 7.5 | 2022-02-07 | XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative creden… |
CVE-2022-24551 | High | 8.8 | 2022-02-06 | A flaw was found in StarWind Stack. The endpoint for setting a new password doesn’t check the current username and old password. An attacker could reset any lo… |
CVE-2022-22831 | Critical | 9.8 | 2022-02-06 | An issue was discovered in Servisnet Tessa 0.0.2. An attacker can add a new sysadmin user via a manipulation of the Authorization HTTP header. |
CVE-2022-23600 | Medium | 5.3 | 2022-02-04 | fleet is an open source device management, built on osquery. Versions prior to 4.9.1 expose a limited ability to spoof SAML authentication with missing audienc… |
CVE-2021-28503 | High | 7.4 | 2022-02-04 | The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows… |
CVE-2021-21965 | Critical | 9.3 | 2022-02-04 | A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted… |
CVE-2022-24259 | Critical | 9.8 | 2022-02-04 | An incorrect check in the component cdr.php of Voipmonitor GUI before v24.96 allows unauthenticated attackers to escalate privileges via a crafted request. |
CVE-2021-40404 | Medium | 6.5 | 2022-01-28 | An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP reques… |
CVE-2021-36346 | Medium | 5.3 | 2022-01-25 | Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerabi… |
CVE-2021-34865 | High | 8.8 | 2022-01-25 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers. Authentication is not requ… |
CVE-2021-3850 | Critical | 9.1 | 2022-01-25 | Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21. |
CVE-2021-43394 | Critical | 9.8 | 2022-01-24 | Unisys OS 2200 Messaging Integration Services (NTSI) 7R3B IC3 and IC4, 7R3C, and 7R3D has an Incorrect Implementation of an Authentication Algorithm. An LDAP p… |
CVE-2022-23126 | Critical | 9.8 | 2022-01-24 | TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere wi… |
CVE-2022-23807 | Medium | 4.3 | 2022-01-22 | An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their accou… |
CVE-2021-43355 | High | 7.3 | 2022-01-21 | Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the… |
CVE-2021-23196 | High | 7.3 | 2022-01-21 | The web application on Agilia Link+ version 3.0 implements authentication and session management mechanisms exclusively on the client-side and does not protect… |
CVE-2020-4879 | Critical | 9.8 | 2022-01-21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication… |
CVE-2021-44736 | Critical | 9.8 | 2022-01-20 | The initial admin account setup wizard on Lexmark devices allow unauthenticated access to the “out of service erase” feature. |
CVE-2022-21692 | Medium | 4.3 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2022-21695 | Medium | 4.3 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2021-25036 | High | 8.8 | 2022-01-17 | The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Sc… |
CVE-2022-23178 | Critical | 9.8 | 2022-01-15 | An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, u… |
CVE-2021-34993 | Critical | 9.8 | 2022-01-13 | This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell 11.22.22. Authentication is not required to… |
CVE-2021-34977 | High | 8.8 | 2022-01-13 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7000 1.0.11.116_10.2.100 routers. Authentic… |
CVE-2022-22990 | High | 7.8 | 2022-01-13 | A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cl… |
CVE-2022-21684 | Medium | 4.3 | 2022-01-13 | Discourse is an open source discussion platform. Versions prior to 2.7.13 in `stable`, 2.8.0.beta11 in `beta`, and 2.8.0.beta11 in `tests-passed` allow some us… |
CVE-2021-33046 | Critical | 9.8 | 2022-01-13 | Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specific deployments to r… |
CVE-2022-23134 | Low | 3.7 | 2022-01-13 | After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious a… |
CVE-2021-43999 | High | 8.8 | 2022-01-11 | Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malici… |
CVE-2021-44458 | High | 8.3 | 2022-01-10 | Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from th… |
CVE-2022-22289 | Medium | 5.3 | 2022-01-10 | Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information. |
CVE-2022-22284 | Medium | 5.7 | 2022-01-10 | Improper authentication vulnerability in Samsung Internet prior to 16.0.2.19 allows attackers to bypass secret mode password authentication |
CVE-2022-22283 | Low | 2.8 | 2022-01-10 | Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App. |
CVE-2021-45389 | Critical | 9.8 | 2022-01-04 | A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escala… |
CVE-2021-45917 | High | 8.0 | 2022-01-03 | The server-request receiver function of Shockwall system has an improper authentication vulnerability. An authenticated attacker of an agent computer within th… |
CVE-2021-23147 | Medium | 6.8 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is ab… |
CVE-2021-20168 | Medium | 6.8 | 2021-12-30 | Netgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface. A malicious actor with physical access to the device is able to conn… |
CVE-2021-20161 | Medium | 6.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. A malicious actor with physical access to the devic… |
CVE-2021-45379 | High | 8.8 | 2021-12-30 | Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user without its password. |
CVE-2021-38688 | High | 7.1 | 2021-12-29 | An improper authentication vulnerability has been reported to affect Android App Qfile. If exploited, this vulnerability allows attackers to compromise app and… |
CVE-2021-45890 | Critical | 9.8 | 2021-12-27 | basic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive identifier. |
CVE-2021-21952 | Critical | 9.8 | 2021-12-22 | An authentication bypass vulnerability exists in the CMD_DEVICE_GET_RSA_KEY_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h… |
CVE-2021-21902 | High | 8.1 | 2021-12-22 | An authentication bypass vulnerability exists in the CMA run_server_6877 functionality of Garrett Metal Detectors iC Module CMA Version 5.0. A properly-timed n… |
CVE-2021-27451 | High | 7.3 | 2021-12-21 | Mesa Labs AmegaView Versions 3.0 and prior’s passcode is generated by an easily reversible algorithm, which may allow an attacker to gain access to the device. |
CVE-2021-36350 | Medium | 5.9 | 2021-12-21 | Dell PowerScale OneFS, versions 8.2.2-9.3.0.x, contain an authentication bypass by primary weakness in one of the authentication factors. A remote unauthentica… |
CVE-2021-44525 | Critical | 9.8 | 2021-12-20 | Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is… |
CVE-2021-44676 | Critical | 9.8 | 2021-12-20 | Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few aspects of the appl… |
CVE-2021-44675 | Critical | 9.8 | 2021-12-20 | Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentic… |
CVE-2021-40851 | High | 7.5 | 2021-12-17 | TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability mi… |
CVE-2021-43834 | Critical | 9.1 | 2021-12-16 | eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows an attacker to authenticate… |
CVE-2021-43833 | High | 8.1 | 2021-12-16 | eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows any authenticated user to ga… |
CVE-2021-43935 | High | 8.1 | 2021-12-15 | The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accep… |
CVE-2021-4073 | Critical | 9.8 | 2021-12-14 | The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid us… |
CVE-2021-44937 | Medium | 5.3 | 2021-12-14 | glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /public_html/users.php. An attacker can register with the mailbox of any use… |
CVE-2021-44524 | Critical | 9.8 | 2021-12-14 | A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions)… |
CVE-2021-39064 | High | 7.5 | 2021-12-13 | IBM Spectrum Copy Data Management 2.2.13 and earlier has weak authentication and password rules and incorrectly handles default credentials for the Spectrum Co… |
CVE-2021-44514 | Critical | 9.8 | 2021-12-09 | OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories. |
CVE-2021-41265 | High | 8.1 | 2021-12-09 | Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The… |
CVE-2021-21955 | High | 7.5 | 2021-12-09 | An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. Gen… |
CVE-2021-20145 | High | 7.5 | 2021-12-09 | Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN network which exposes the… |
CVE-2021-43068 | Medium | 5.4 | 2021-12-09 | A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authentication via a RADIUS login portal. |
CVE-2021-36718 | Medium | 6.1 | 2021-12-08 | SYNEL - eharmonynew / Synel Reports - The attacker can log in to the system with default credentials and export a report of eharmony system with sensetive data… |
CVE-2021-37054 | High | 7.5 | 2021-12-08 | There is an Identity spoofing and authentication bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service con… |
CVE-2021-41311 | High | 7.5 | 2021-12-08 | Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify pr… |
CVE-2021-41309 | Medium | 5.3 | 2021-12-08 | Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of anothe… |
CVE-2021-41716 | Critical | 9.8 | 2021-12-07 | Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in… |
CVE-2021-43175 | High | 7.5 | 2021-12-07 | The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other… |
CVE-2021-37100 | High | 7.5 | 2021-12-07 | There is a Improper Authentication vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to account authentication bypassed. |
CVE-2021-37043 | High | 7.5 | 2021-12-07 | There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to malicious application proce… |
CVE-2021-43931 | Critical | 9.8 | 2021-12-06 | The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary… |
CVE-2021-39890 | Low | 3.1 | 2021-12-06 | It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above. |
CVE-2021-43786 | Critical | 9.8 | 2021-11-29 | Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed mast… |
CVE-2021-38686 | High | 8.8 | 2021-11-26 | An improper authentication vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows attackers to compromise the… |