CWE-287 · Improper Authentication (page 27)
Page 27 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-35033 | High | 7.8 | 2021-11-23 | A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an… |
CVE-2021-38376 | Medium | 5.3 | 2021-11-22 | OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call. |
CVE-2021-36308 | Medium | 5.9 | 2021-11-20 | Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an authentication bypass vulnerability. A remote unauthenticated a… |
CVE-2021-36306 | High | 8.1 | 2021-11-20 | Networking OS10, versions prior to October 2021 with RESTCONF API enabled, contains an authentication bypass vulnerability. A remote unauthenticated attacker c… |
CVE-2021-42338 | Critical | 9.8 | 2021-11-19 | 4MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication by code injection in… |
CVE-2021-33087 | Medium | 5.5 | 2021-11-17 | Improper authentication in the installer for the Intel(R) NUC M15 Laptop Kit Management Engine driver pack before version 15.0.10.1508 may allow an authenticat… |
CVE-2021-0096 | High | 7.8 | 2021-11-17 | Improper authentication in the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN, NUC7i7DN before version 1.78.1.1 may a… |
CVE-2021-37580 | Critical | 9.8 | 2021-11-16 | A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apac… |
CVE-2021-3788 | Medium | 6.8 | 2021-11-12 | An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access unauthorized access… |
CVE-2021-3519 | Medium | 6.4 | 2021-11-12 | A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List"… |
CVE-2021-43203 | High | 7.5 | 2021-11-09 | In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly. |
CVE-2021-24647 | High | 8.1 | 2021-11-08 | The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in t… |
CVE-2021-42072 | High | 8.8 | 2021-11-08 | An issue was discovered in Barrier before 2.4.0. The barriers component (aka the server-side implementation of Barrier) does not sufficiently verify the identi… |
CVE-2021-31602 | Medium | 5.3 | 2021-11-08 | An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. The Security Model has different layers of… |
CVE-2021-43414 | High | 7.0 | 2021-11-07 | An issue was discovered in GNU Hurd before 0.9 20210404-9. The use of an authentication protocol in the proc server is vulnerable to man-in-the-middle attacks… |
CVE-2021-42837 | Critical | 9.8 | 2021-11-05 | An issue was discovered in Talend Data Catalog before 7.3-20210930. After setting up SAML/OAuth, authentication is not correctly enforced on the native login p… |
CVE-2021-25506 | Medium | 4.0 | 2021-11-05 | Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial of service. |
CVE-2021-25505 | Low | 3.3 | 2021-11-05 | Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked. |
CVE-2021-38161 | High | 8.1 | 2021-11-03 | Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache Traff… |
CVE-2021-33210 | Medium | 4.3 | 2021-11-03 | An issue was discovered in Fimer Aurora Vision before 2.97.10. An attacker can (in the WebUI) obtain plant information without authentication by reading the re… |
CVE-2021-41312 | High | 7.5 | 2021-11-03 | Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Management to enable and… |
CVE-2021-22490 | Medium | 5.3 | 2021-10-28 | There is a Permission verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect the device performance. |
CVE-2021-22473 | High | 7.5 | 2021-10-28 | There is an Authentication vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2021-32951 | Medium | 5.3 | 2021-10-27 | WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored… |
CVE-2021-41157 | Medium | 5.3 | 2021-10-26 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2021-37624 | High | 7.5 | 2021-10-25 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2020-23058 | Medium | 4.6 | 2021-10-22 | An issue in the authentication mechanism in Nong Ge File Explorer v1.4 unauthenticated allows to access sensitive data. |
CVE-2021-30312 | High | 7.5 | 2021-10-20 | Improper authentication of sub-frames of a multicast AMSDU frame can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connecti… |
CVE-2021-30302 | High | 7.5 | 2021-10-20 | Improper authentication of EAP WAPI EAPOL frames from unauthenticated user can lead to information disclosure in Snapdragon Compute, Snapdragon Connectivity, S… |
CVE-2021-31349 | Critical | 9.8 | 2021-10-19 | The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, ma… |
CVE-2010-2496 | Medium | 5.5 | 2021-10-18 | stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the… |
CVE-2021-37123 | Critical | 9.8 | 2021-10-11 | There is an improper authentication vulnerability in Hero-CT060 before 1.0.0.200. The vulnerability is due to that when an user wants to do certain operation… |
CVE-2021-41129 | High | 8.1 | 2021-10-06 | Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmation_token`… |
CVE-2021-41126 | High | 7.2 | 2021-10-06 | October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had pre… |
CVE-2021-25490 | Medium | 6.0 | 2021-10-06 | A keyblob downgrade attack in keymaster prior to SMR Oct-2021 Release 1 allows attacker to trigger IV reuse vulnerability with privileged process. |
CVE-2021-25484 | Medium | 4.0 | 2021-10-06 | Improper authentication in InputManagerService prior to SMR Oct-2021 Release 1 allows monitoring the touch event. |
CVE-2021-0595 | High | 7.8 | 2021-10-06 | In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logging in. This could le… |
CVE-2021-39226 | Critical | 9.8 | 2021-10-05 | Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowe… |
CVE-2021-41286 | High | 7.8 | 2021-10-05 | Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-side authentication mechanism. When a user logs into the application, the validity of the password is… |
CVE-2021-39872 | Medium | 6.5 | 2021-10-05 | In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still access GitLab through… |
CVE-2021-23857 | Critical | 10.0 | 2021-10-04 | Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CV… |
CVE-2021-35296 | Critical | 9.8 | 2021-10-04 | An issue in the administrator authentication panel of PTCL HG150-Ub v3.0 allows attackers to bypass authentication via modification of the cookie value and Res… |
CVE-2021-20578 | Critical | 9.8 | 2021-09-30 | IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing aut… |
CVE-2021-24017 | Medium | 5.4 | 2021-09-30 | An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via… |
CVE-2021-41292 | Critical | 9.8 | 2021-09-30 | ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authenticatio… |
CVE-2021-35943 | Critical | 9.8 | 2021-09-29 | Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC45… |
CVE-2021-38299 | Critical | 9.8 | 2021-09-27 | Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an… |
CVE-2021-31606 | High | 7.5 | 2021-09-27 | furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients. |
CVE-2021-41503 | High | 8.0 | 2021-09-24 | DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices command interface all… |
CVE-2021-22869 | Critical | 9.8 | 2021-09-24 | An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had acc… |
CVE-2021-31917 | Critical | 9.8 | 2021-09-21 | A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all… |
CVE-2021-38412 | Critical | 9.6 | 2021-09-17 | Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication… |
CVE-2021-41317 | Critical | 9.8 | 2021-09-17 | XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths. |
CVE-2021-41303 | Critical | 9.8 | 2021-09-17 | Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update t… |
CVE-2021-33045 | Critical | 9.8 | 2021-09-15 | The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by… |
CVE-2021-33044 | Critical | 9.8 | 2021-09-15 | The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by… |
CVE-2021-33700 | High | 7.8 | 2021-09-15 | SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowi… |
CVE-2021-39215 | High | 7.5 | 2021-09-15 | Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to valida… |
CVE-2021-3145 | Medium | 6.7 | 2021-09-10 | In Ionic Identity Vault before 5, a local root attacker on an Android device can bypass biometric authentication. |
CVE-2021-37414 | High | 7.5 | 2021-09-10 | Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication. |
CVE-2021-25466 | Medium | 6.5 | 2021-09-09 | Improper scheme check vulnerability in Samsung Internet prior to version 15.0.2.47 allows attackers to perform Man-in-the-middle attack and obtain Samsung Acco… |
CVE-2021-25451 | Low | 3.3 | 2021-09-09 | A PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI data. |
CVE-2021-39296 | Critical | 10.0 | 2021-09-09 | In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system. |
CVE-2021-28495 | High | 7.2 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authentication can be bypassed… |
CVE-2021-28494 | Critical | 9.6 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication is bypassed by unpri… |
CVE-2021-28493 | High | 8.4 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, a user may be able to execute comma… |
CVE-2021-34786 | Medium | 6.5 | 2021-09-09 | Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or… |
CVE-2021-34785 | Medium | 6.5 | 2021-09-09 | Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or… |
CVE-2021-30605 | High | 7.8 | 2021-09-08 | Inappropriate implementation in the ChromeOS Readiness Tool installer on Windows prior to 1.0.2.0 loosens DCOM access rights on two objects allowing an attacke… |
CVE-2021-30702 | Medium | 4.6 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-… |
CVE-2021-30668 | Medium | 4.6 | 2021-09-08 | This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4. A person with physical access to a Mac may be able to bypass Login Wi… |
CVE-2021-30667 | Medium | 5.4 | 2021-09-08 | A logic issue was addressed with improved validation. This issue is fixed in iOS 14.6 and iPadOS 14.6. An attacker in WiFi range may be able to force a client… |
CVE-2021-1863 | Low | 2.4 | 2021-09-08 | An issue existed with authenticating the action triggered by an NFC tag. The issue was addressed with improved action authentication. This issue is fixed in iO… |
CVE-2021-30770 | Medium | 5.5 | 2021-09-08 | A logic issue was addressed with improved validation. This issue is fixed in iOS 14.7, tvOS 14.7, watchOS 7.6. An attacker that has already achieved kernel cod… |
CVE-2021-30769 | Medium | 5.5 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in iOS 14.7, tvOS 14.7, watchOS 7.6. A malicious attacker with arbitrary read a… |
CVE-2021-30720 | Medium | 5.4 | 2021-09-08 | A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS… |
CVE-2020-11301 | Critical | 9.1 | 2021-09-08 | Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosure in Snapdragon Auto, Snapdragon Comput… |
CVE-2020-11264 | Critical | 9.1 | 2021-09-08 | Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network packet injection in Snapdragon Auto, Snapdra… |
CVE-2021-39196 | High | 7.7 | 2021-09-07 | pcapture is an open source dumpcap web service interface . In affected versions this vulnerability allows an authenticated but unprivileged user to use the RES… |
CVE-2021-34746 | Critical | 9.8 | 2021-09-02 | A vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow a… |
CVE-2021-40350 | Critical | 9.8 | 2021-09-01 | webctrl.cgi.elf on Christie Digital DWU850-GS V06.46 devices allows attackers to perform any desired action via a crafted query containing an unspecified Cooki… |
CVE-2021-22002 | Critical | 9.8 | 2021-08-31 | VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom hos… |
CVE-2021-22943 | Critical | 9.6 | 2021-08-31 | A vulnerability found in UniFi Protect application V1.18.1 and earlier permits a malicious actor who has already gained access to a network to subsequently con… |
CVE-2021-34578 | Critical | 9.8 | 2021-08-31 | This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed request… |
CVE-2021-39177 | High | 7.4 | 2021-08-30 | Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone that can connect to… |
CVE-2021-37417 | Critical | 9.8 | 2021-08-30 | Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation. |
CVE-2021-36370 | High | 7.5 | 2021-08-30 | An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displa… |
CVE-2021-32967 | Critical | 9.8 | 2021-08-30 | Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without being authenticated or authorized, which ma… |
CVE-2021-22025 | High | 7.5 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. An unauthenticated… |
CVE-2021-39165 | High | 8.1 | 2021-08-26 | Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Atta… |
CVE-2021-32648 | High | 8.2 | 2021-08-26 | octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password… |
CVE-2021-29487 | High | 7.4 | 2021-08-26 | octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability… |
CVE-2021-30867 | Medium | 5.5 | 2021-08-24 | The issue was addressed with improved authentication. This issue is fixed in iOS 15 and iPadOS 15. A malicious application may be able to access photo metadata… |
CVE-2021-37597 | Critical | 9.8 | 2021-08-19 | WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation. |
CVE-2021-39138 | Medium | 4.8 | 2021-08-19 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to signup users and als… |
CVE-2021-1561 | Medium | 5.4 | 2021-08-18 | A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authen… |
CVE-2021-3458 | Medium | 6.1 | 2021-08-17 | The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter settings to be modified. |
CVE-2021-24527 | Critical | 9.8 | 2021-08-16 | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog… |
CVE-2021-36949 | High | 7.1 | 2021-08-12 | Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability |
CVE-2021-36921 | High | 8.8 | 2021-08-12 | AIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall (AIWAF) devices with Manager 2.1.0 has Improper Authentication. An attacker ca… |