CWE-287 · Improper Authentication (page 26)
Page 26 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-36176 | High | 7.5 | 2021-01-06 | The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until… |
CVE-2012-10001 | Critical | 9.8 | 2021-01-06 | The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to condu… |
CVE-2020-35219 | Critical | 9.8 | 2021-01-04 | The ASUS DSL-N17U modem with firmware 1.1.0.2 allows attackers to access the admin interface by changing the admin password without authentication via a POST r… |
CVE-2020-25848 | Critical | 9.8 | 2020-12-31 | HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism. |
CVE-2020-35785 | High | 8.3 | 2020-12-30 | NETGEAR DGN2200v1 devices before v1.0.0.60 mishandle HTTPd authentication (aka PSV-2020-0363, PSV-2020-0364, and PSV-2020-0365). |
CVE-2020-9207 | High | 7.8 | 2020-12-29 | There is an improper authentication vulnerability in some verisons of Huawei CloudEngine product. A module does not verify the input file properly. Attackers c… |
CVE-2020-26030 | Critical | 9.8 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO endpoint via a crafted header, when SSO is not configured. An atta… |
CVE-2020-24675 | Critical | 9.8 | 2020-12-22 | In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations History server (or standalone S+ History ser… |
CVE-2020-24579 | High | 8.8 | 2020-12-22 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to acce… |
CVE-2020-27254 | High | 7.5 | 2020-12-21 | Emerson Rosemount X-STREAM Gas AnalyzerX-STREAM enhanced XEGP, XEGK, XEFD, XEXF – all revisions, The affected products are vulnerable to improper authenticatio… |
CVE-2020-27780 | Critical | 9.8 | 2020-12-18 | A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to au… |
CVE-2020-8465 | Critical | 9.8 | 2020-12-17 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combination of CSR… |
CVE-2020-27199 | High | 7.5 | 2020-12-17 | The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the application currently has in place is a simple Use… |
CVE-2020-4747 | Critical | 9.8 | 2020-12-15 | IBM Connect:Direct for UNIX 6.1.0, 6.0.0, 4.3.0, and 4.2.0 can allow a local or remote user to obtain an authenticated CLI session due to improper authenticati… |
CVE-2020-0460 | High | 7.5 | 2020-12-14 | In createNameCredentialDialog of CertInstaller.java, there exists the possibility of improperly installed certificates due to a logic error. This could lead to… |
CVE-2020-25183 | High | 8.0 | 2020-12-14 | Medtronic MyCareLink Smart 25000 contains an authentication protocol vulnerability where the method used to authenticate between the MCL Smart Patient Reader… |
CVE-2020-16102 | High | 7.1 | 2020-12-14 | Improper Authentication vulnerability in Gallagher Command Centre Server allows an unauthenticated remote attacker to create items with invalid configuration… |
CVE-2020-29669 | High | 8.8 | 2020-12-14 | In the Macally WIFISD2-2A82 Media and Travel Router 2.000.010, the Guest user is able to reset its own password. This process has a vulnerability which can be… |
CVE-2020-35208 | Medium | 5.7 | 2020-12-12 | An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The password authentication for unlockin… |
CVE-2020-35207 | Medium | 5.7 | 2020-12-12 | An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The PIN authentication for unlocking can… |
CVE-2020-29563 | Critical | 9.8 | 2020-12-12 | An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticate… |
CVE-2020-29668 | Low | 3.7 | 2020-12-10 | Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie… |
CVE-2020-7787 | High | 8.2 | 2020-12-09 | This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh valu… |
CVE-2020-26834 | Medium | 5.4 | 2020-12-09 | SAP HANA Database, version - 2.0, does not correctly validate the username when performing SAML bearer token-based user authentication. It is possible to manip… |
CVE-2020-27408 | High | 7.5 | 2020-12-04 | OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change… |
CVE-2020-7199 | Critical | 9.8 | 2020-12-02 | A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software. The vul… |
CVE-2020-28971 | Critical | 9.8 | 2020-12-01 | An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticate… |
CVE-2020-28970 | Critical | 9.8 | 2020-12-01 | An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticate… |
CVE-2020-28940 | Critical | 9.8 | 2020-12-01 | On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allow an unauthenticate… |
CVE-2020-7533 | Critical | 9.8 | 2020-12-01 | CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending speciall… |
CVE-2020-29392 | Medium | 4.6 | 2020-11-30 | The Estil Hill Lock Password Manager Safe app 2.3 for iOS has a *#06#* backdoor password. An attacker with physical access can unlock the password manager with… |
CVE-2020-29127 | Critical | 9.8 | 2020-11-30 | An issue was discovered on Fujitsu Eternus Storage DX200 S4 devices through 2020-11-25. After logging into the portal as a root user (using any web browser), t… |
CVE-2020-29378 | High | 8.8 | 2020-11-29 | An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devic… |
CVE-2020-28333 | Critical | 9.8 | 2020-11-24 | Barco wePresent WiPG-1600W devices allow Authentication Bypass. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W web interface does not use session… |
CVE-2020-7378 | Critical | 9.1 | 2020-11-24 | CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affec… |
CVE-2020-28896 | Medium | 5.3 | 2020-11-23 | Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The c… |
CVE-2020-4771 | Medium | 5.3 | 2020-11-23 | IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.10.and 7.1.0.000 through 7.1.11 could allow a remote attacker to obtain sensitive information, cau… |
CVE-2020-1778 | Medium | 4.1 | 2020-11-23 | When OTRS uses multiple backends for user authentication (with LDAP), agents are able to login even if the account is set to invalid. This issue affects OTRS… |
CVE-2019-14553 | Medium | 4.9 | 2020-11-23 | Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access. |
CVE-2020-26236 | High | 7.5 | 2020-11-20 | In ScratchVerifier before commit a603769, an attacker can hijack the verification process to log into someone else's account on any site that uses ScratchVerif… |
CVE-2020-9049 | High | 7.1 | 2020-11-19 | A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on th… |
CVE-2019-20933 | Critical | 9.8 | 2020-11-19 | InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empt… |
CVE-2020-27558 | Medium | 6.5 | 2020-11-17 | Use of an undocumented user in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to view the video stream. |
CVE-2020-8272 | High | 7.5 | 2020-11-16 | Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8 |
CVE-2019-19562 | Medium | 4.6 | 2020-11-16 | An authentication bypass in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with physical access to device hardware to obtain system informa… |
CVE-2019-19560 | Medium | 4.6 | 2020-11-16 | An authentication bypass in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with physical access to device hardware to obtain system informa… |
CVE-2020-28638 | Critical | 9.8 | 2020-11-13 | ask_password in Tomb 2.0 through 2.7 returns a warning when pinentry-curses is used and $DISPLAY is non-empty, causing affected users' files to be encrypted wi… |
CVE-2020-25165 | High | 7.5 | 2020-11-13 | BD Alaris PC Unit, Model 8015, Versions 9.33.1 and earlier and BD Alaris Systems Manager, Versions 4.33 and earlier The affected products are vulnerable to a n… |
CVE-2020-2050 | High | 8.2 | 2020-11-12 | An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass al… |
CVE-2020-26168 | Critical | 9.8 | 2020-11-09 | The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly th… |
CVE-2020-26542 | Critical | 9.8 | 2020-11-09 | An issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server when using the SimpleLDAP authentication in conjunction with Mi… |
CVE-2020-23139 | Medium | 5.5 | 2020-11-09 | Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to… |
CVE-2020-26214 | Critical | 9.1 | 2020-11-06 | In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP a… |
CVE-2020-25592 | Critical | 9.8 | 2020-11-06 | In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH. |
CVE-2020-17510 | Critical | 9.8 | 2020-11-05 | Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. |
CVE-2020-8267 | Medium | 5.3 | 2020-11-05 | A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was using “x-token” improper… |
CVE-2020-12145 | Medium | 6.6 | 2020-11-05 | Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it po… |
CVE-2020-15949 | High | 7.5 | 2020-11-05 | Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover. |
CVE-2020-8236 | Medium | 6.8 | 2020-11-02 | A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the P… |
CVE-2020-28002 | Medium | 5.3 | 2020-11-02 | In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anony… |
CVE-2020-5425 | High | 7.9 | 2020-10-31 | Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation a… |
CVE-2020-7197 | Critical | 9.8 | 2020-10-26 | SSMC3.7.0.0 is vulnerable to remote authentication bypass. HPE StoreServ Management Console (SSMC) 3.7.0.0 is an off node multiarray manager web application an… |
CVE-2020-24848 | High | 7.8 | 2020-10-23 | FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege e… |
CVE-2020-3565 | Medium | 5.8 | 2020-10-21 | A vulnerability in the TCP Intercept functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass c… |
CVE-2020-3410 | High | 8.1 | 2020-10-21 | A vulnerability in the Common Access Card (CAC) authentication feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remo… |
CVE-2020-15240 | High | 7.4 | 2020-10-21 | omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method. Improper vali… |
CVE-2020-15269 | High | 7.4 | 2020-10-20 | In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3… |
CVE-2020-24629 | Critical | 9.8 | 2020-10-19 | A remote urlaccesscontroller authentication bypass vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E… |
CVE-2020-14299 | Medium | 6.5 | 2020-10-16 | A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain… |
CVE-2020-7591 | High | 8.8 | 2020-10-15 | A vulnerability has been identified in SIPORT MP (All versions < 3.2.1). Vulnerable versions of the device could allow an authenticated attacker to impersonate… |
CVE-2020-8350 | High | 8.8 | 2020-10-14 | An authentication bypass vulnerability was reported in Lenovo ThinkPad Stack Wireless Router firmware version 1.1.3.4 that could allow escalation of privilege. |
CVE-2020-9109 | Medium | 4.6 | 2020-10-12 | There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in cer… |
CVE-2020-4779 | High | 8.1 | 2020-10-12 | A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. By sending a specially-crafted request, an attacker could… |
CVE-2020-26921 | High | 8.3 | 2020-10-09 | Certain NETGEAR devices are affected by authentication bypass. This affects GS110EMX before 1.0.1.7, GS810EMX before 1.7.1.3, XS512EM before 1.0.1.3, and XS724… |
CVE-2020-15243 | Critical | 9.1 | 2020-10-08 | Affected versions of Smartstore have a missing WebApi Authentication attribute. This vulnerability affects Smartstore shops in version 4.0.0 & 4.0.1 which have… |
CVE-2020-10816 | High | 7.5 | 2020-10-08 | Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestProcessor servlet. |
CVE-2020-25867 | Medium | 5.3 | 2020-10-07 | SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings. It allows a bypass to get access without authentication. |
CVE-2020-12126 | Critical | 9.8 | 2020-10-02 | Multiple authentication bypass vulnerabilities in the /cgi-bin/ endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to leak router settings, c… |
CVE-2020-26511 | High | 7.5 | 2020-10-02 | The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass. |
CVE-2020-26160 | High | 7.5 | 2020-09-30 | jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specif… |
CVE-2018-11765 | High | 7.5 | 2020-09-30 | In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authen… |
CVE-2020-24563 | High | 7.8 | 2020-09-29 | A vulnerability in Trend Micro Apex One may allow a local attacker to manipulate the process of the security agent unload option (if configured), which then co… |
CVE-2020-26105 | Critical | 9.8 | 2020-09-25 | In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). |
CVE-2020-26101 | Critical | 9.8 | 2020-09-25 | In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). |
CVE-2020-15222 | High | 8.1 | 2020-09-24 | In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness o… |
CVE-2019-16028 | Critical | 9.8 | 2020-09-23 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to bypass auth… |
CVE-2019-15993 | Medium | 5.3 | 2020-09-23 | A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vuln… |
CVE-2020-8253 | High | 7.5 | 2020-09-18 | Improper authentication in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Cit… |
CVE-2020-8200 | Medium | 6.5 | 2020-09-18 | Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domain as a Ci… |
CVE-2020-7297 | Medium | 5.7 | 2020-09-16 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via i… |
CVE-2020-7296 | Medium | 5.7 | 2020-09-15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected configuration files… |
CVE-2020-7295 | Low | 3.5 | 2020-09-15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected log data… |
CVE-2020-7294 | Medium | 4.6 | 2020-09-15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected files vi… |
CVE-2020-7293 | Critical | 9.0 | 2020-09-15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user with low permissions to change the syste… |
CVE-2020-16098 | Critical | 9.8 | 2020-09-15 | It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8.20 prior to v8.20… |
CVE-2020-13303 | High | 7.1 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can acce… |
CVE-2020-15802 | Medium | 5.9 | 2020-09-11 | Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2… |
CVE-2020-16222 | High | 8.8 | 2020-09-11 | In Patient Information Center iX (PICiX) Version B.02, C.02, C.03, and PerformanceBridge Focal Point Version A.01, when an actor claims to have a given ident… |
CVE-2020-25251 | Critical | 9.1 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Cli… |
CVE-2020-15787 | Critical | 9.8 | 2020-09-09 | A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attemp… |