CWE-287 · Improper Authentication (page 28)
Page 28 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27794 | High | 7.8 | 2021-08-12 | A vulnerability in the authentication mechanism of Brocade Fabric OS versions before Brocade Fabric OS v.9.0.1a, v8.2.3a and v7.4.2h could allow a user to Logi… |
CVE-2021-3046 | Medium | 6.8 | 2021-08-11 | An improper authentication vulnerability exists in Palo Alto Networks PAN-OS software that enables a SAML authenticated attacker to impersonate any other user… |
CVE-2021-37172 | High | 7.5 | 2021-08-10 | A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (V4.5.0). Affected devices fail to authenticate against configured pa… |
CVE-2021-21564 | Critical | 9.8 | 2021-08-09 | Dell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit… |
CVE-2014-9320 | Critical | 9.8 | 2021-08-09 | SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and consequently gain SYSTEM privileges via vect… |
CVE-2021-20598 | Medium | 5.3 | 2021-08-06 | Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R08/16/32/120SFCPU all versions, R08/16/32/12… |
CVE-2021-37545 | High | 7.5 | 2021-08-06 | In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made. |
CVE-2021-32579 | High | 7.8 | 2021-08-05 | Acronis True Image prior to 2021 Update 4 for Windows and Acronis True Image prior to 2021 Update 5 for macOS allowed an unauthenticated attacker (who has a lo… |
CVE-2021-25445 | Medium | 5.3 | 2021-08-05 | Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access internal files in Samsung Internet. |
CVE-2021-3636 | Medium | 4.6 | 2021-07-30 | It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The… |
CVE-2020-16839 | High | 7.5 | 2021-07-30 | On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an unauthenticated WebSo… |
CVE-2021-21538 | Critical | 9.6 | 2021-07-29 | Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker cou… |
CVE-2021-32794 | Medium | 6.8 | 2021-07-26 | ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code `POST /Api/ASF` A… |
CVE-2020-21932 | Medium | 5.3 | 2021-07-21 | A vulnerability in /Login.html of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to bypass login and obtain a partially authorized tok… |
CVE-2021-34676 | High | 7.5 | 2021-07-19 | Basix NEX-Forms through 7.8.7 allows authentication bypass for Excel report generation. |
CVE-2021-34675 | High | 7.5 | 2021-07-19 | Basix NEX-Forms through 7.8.7 allows authentication bypass for stored PDF reports. |
CVE-2021-35964 | High | 7.3 | 2021-07-19 | The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management f… |
CVE-2020-4821 | Critical | 9.8 | 2021-07-16 | IBM InfoSphere Data Replication 11.4 and IBM InfoSphere Change Data Capture for z/OS 10.2.1, under certain configurations, could allow a user to bypass authent… |
CVE-2021-34690 | Critical | 9.8 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows authentication bypass. A remote and unauthenticated attacker can bypass cloud authentication to connect and con… |
CVE-2021-21994 | Critical | 9.8 | 2021-07-13 | SFCB (Small Footprint CIM Broker) as used in ESXi has an authentication bypass vulnerability. A malicious actor with network access to port 5989 on ESXi may ex… |
CVE-2021-20593 | High | 7.1 | 2021-07-13 | Incorrect Implementation of Authentication Algorithm in Mitsubishi Electric Air Conditioning System/Centralized Controllers (G-50A Ver.2.50 to Ver. 3.35, GB-50… |
CVE-2021-32726 | High | 7.1 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a u… |
CVE-2020-19037 | Medium | 5.3 | 2021-07-12 | Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies. |
CVE-2021-26088 | High | 7.1 | 2021-07-12 | An improper authentication vulnerability in FSSO Collector version 5.0.295 and below may allow an unauthenticated user to bypass a FSSO firewall policy and acc… |
CVE-2021-32753 | High | 8.3 | 2021-07-09 | EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fu… |
CVE-2021-25442 | High | 7.5 | 2021-07-08 | Improper MDM policy management vulnerability in KME module prior to KCS version 1.39 allows MDM users to bypass Knox Manage authentication. |
CVE-2021-25430 | Medium | 4.3 | 2021-07-08 | Improper access control vulnerability in Bluetooth application prior to SMR July-2021 Release 1 allows untrusted application to access the Bluetooth informatio… |
CVE-2021-20776 | Critical | 9.8 | 2021-07-07 | Improper authentication vulnerability in SCT-40CM01SR and AT-40CM01SR allows an attacker to bypass access restriction and execute an arbitrary command via teln… |
CVE-2021-32738 | Medium | 6.5 | 2021-07-02 | js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 Stellar Web Authent… |
CVE-2021-35029 | Critical | 9.8 | 2021-07-02 | An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP… |
CVE-2021-30648 | Critical | 9.8 | 2021-06-30 | The Symantec Advanced Secure Gateway (ASG) and ProxySG web management consoles are susceptible to an authentication bypass vulnerability. An unauthenticated at… |
CVE-2019-18906 | Critical | 9.8 | 2021-06-30 | A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the… |
CVE-2021-33539 | High | 7.2 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable authentication bypass vulnerability exists in the hostname processing. A specially c… |
CVE-2021-33895 | High | 8.1 | 2021-06-25 | ETINET BACKBOX E4.09 and H4.09 mismanages password access control. When a user uses the User ID of the process running BBSV to login to the Backbox UI applicat… |
CVE-2021-21998 | Critical | 9.8 | 2021-06-23 | VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the… |
CVE-2020-22176 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a sensitive information disclosure vulnerability in multiple areas. Remote unauthenticated users can expl… |
CVE-2021-20737 | Medium | 6.5 | 2021-06-22 | Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via… |
CVE-2021-32693 | Medium | 6.8 | 2021-06-17 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symf… |
CVE-2021-32691 | High | 8.8 | 2021-06-16 | Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access… |
CVE-2021-1571 | High | 7.2 | 2021-06-16 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: H… |
CVE-2021-1543 | High | 7.2 | 2021-06-16 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: H… |
CVE-2021-1542 | High | 7.2 | 2021-06-16 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: H… |
CVE-2021-1541 | High | 7.2 | 2021-06-16 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: H… |
CVE-2021-27610 | Critical | 9.8 | 2021-06-16 | SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal… |
CVE-2021-24359 | Medium | 5.3 | 2021-06-14 | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate use… |
CVE-2021-22764 | Medium | 5.3 | 2021-06-11 | A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notifica… |
CVE-2021-25424 | High | 8.8 | 2021-06-11 | Improper authentication vulnerability in Tizen bluetooth-frwk prior to Firmware update JUN-2021 Release allows bluetooth attacker to take over the user's bluet… |
CVE-2021-25389 | Low | 2.3 | 2021-06-11 | Improper running task check in S Secure prior to SMR MAY-2021 Release 1 allows attackers to use locked app without authentication. |
CVE-2021-34546 | Medium | 6.8 | 2021-06-10 | An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the… |
CVE-2020-24514 | Medium | 6.8 | 2021-06-09 | Improper authentication in some Intel(R) RealSense(TM) IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical access. |
CVE-2021-23847 | Critical | 9.8 | 2021-06-09 | A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings… |
CVE-2020-26136 | Medium | 6.5 | 2021-06-08 | In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication. |
CVE-2021-31251 | Critical | 9.8 | 2021-06-04 | An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileg… |
CVE-2020-15077 | Medium | 5.3 | 2021-06-04 | OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with… |
CVE-2020-14380 | High | 7.5 | 2021-06-02 | An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. A potential attacker with proper authentication to the relevant external authentication s… |
CVE-2021-3424 | Medium | 5.3 | 2021-06-01 | A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a na… |
CVE-2021-32646 | Medium | 5.3 | 2021-05-28 | Roomer is a discord bot cog (extension) which provides automatic voice channel generation as well as private voice and text channels. A vulnerability has been… |
CVE-2021-32637 | Critical | 10.0 | 2021-05-28 | Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_request_module with Authelia, it allows a… |
CVE-2021-20278 | Medium | 6.5 | 2021-05-28 | An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is enabled, Ki… |
CVE-2021-32543 | Medium | 6.5 | 2021-05-28 | The CTS Web transaction system related to authentication management is implemented incorrectly. After login, remote attackers can manipulate cookies to access… |
CVE-2021-32541 | Medium | 5.3 | 2021-05-28 | The CTS Web transaction system related to authentication and session management is implemented incorrectly, which allows remote unauthenticated attackers can s… |
CVE-2020-10709 | High | 7.1 | 2021-05-27 | A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication… |
CVE-2018-16496 | Medium | 5.3 | 2021-05-26 | In Versa Director, the un-authentication request found. |
CVE-2021-31924 | Medium | 6.8 | 2021-05-26 | Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This iss… |
CVE-2020-26558 | Medium | 4.2 | 2021-05-24 | Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey u… |
CVE-2020-26557 | High | 7.5 | 2021-05-24 | Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the AuthValue used in the provisioning protocol… |
CVE-2002-2438 | High | 7.5 | 2021-05-18 | TCP firewalls could be circumvented by sending a SYN Packets with other flags (like e.g. RST flag) set, which was not correctly discarded by the Linux TCP stac… |
CVE-2021-27734 | Critical | 9.8 | 2021-05-17 | Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing… |
CVE-2021-29047 | High | 7.5 | 2021-05-16 | The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, whi… |
CVE-2021-22155 | High | 8.8 | 2021-05-13 | An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 an… |
CVE-2020-26139 | Medium | 5.3 | 2021-05-11 | An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfull… |
CVE-2021-23008 | Critical | 9.8 | 2021-05-10 | On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD (Activ… |
CVE-2021-31520 | High | 8.1 | 2021-05-10 | A weak session token authentication bypass vulnerability in Trend Micro IM Security 1.6 and 1.6.5 could allow an remote attacker to guess currently logged-in a… |
CVE-2021-26077 | High | 8.8 | 2021-05-10 | Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot… |
CVE-2021-28152 | Critical | 9.8 | 2021-05-06 | Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser. To connect, the telnet service is used on port 5188 wit… |
CVE-2021-32030 | Critical | 9.8 | 2021-05-06 | The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when proce… |
CVE-2021-31245 | Medium | 5.9 | 2021-05-06 | omr-admin.py in openmptcprouter-vps-admin 0.57.3 and earlier compares the user provided password with the original password in a length dependent manner, which… |
CVE-2021-1468 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2020-19111 | Critical | 9.8 | 2021-05-06 | Incorrect Access Control vulnerability in Online Book Store v1.0 via admin_verify.php, which could let a remote mailicious user bypass authentication and obtai… |
CVE-2021-21544 | Low | 2.7 | 2021-04-30 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could… |
CVE-2021-27651 | Critical | 9.8 | 2021-04-29 | In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks. |
CVE-2021-20092 | High | 7.5 | 2021-04-29 | The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly restrict access to sensitive inf… |
CVE-2021-25147 | High | 8.1 | 2021-04-28 | A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released p… |
CVE-2020-21991 | Critical | 9.8 | 2021-04-28 | AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly calling the autologin GET parameter in c… |
CVE-2021-23365 | Medium | 4.8 | 2021-04-26 | The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML auth… |
CVE-2021-22893 | Critical | 10.0 | 2021-04-23 | Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure… |
CVE-2021-20590 | High | 7.5 | 2021-04-22 | Improper authentication vulnerability in GOT2000 series GT27 model VNC server versions 01.39.010 and prior, GOT2000 series GT25 model VNC server versions 01.39… |
CVE-2020-28973 | High | 7.5 | 2021-04-21 | The ABUS Secvest wireless alarm system FUAA50000 (v3.01.17) fails to properly authenticate some requests to its built-in HTTPS interface. Someone can use this… |
CVE-2020-7856 | High | 7.5 | 2021-04-20 | A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient authentication v… |
CVE-2021-26074 | Medium | 6.5 | 2021-04-16 | Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot pack… |
CVE-2021-26073 | High | 7.7 | 2021-04-16 | Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building A… |
CVE-2021-20288 | High | 7.2 | 2021-04-15 | An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_ke… |
CVE-2021-27990 | High | 7.5 | 2021-04-14 | Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet/mail.aspx can be called directly and the framework is exposed w… |
CVE-2021-21399 | Critical | 9.1 | 2021-04-13 | Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic A… |
CVE-2021-22497 | Low | 3.8 | 2021-04-12 | Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue. |
CVE-2021-20020 | Critical | 9.8 | 2021-04-10 | A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root. |
CVE-2021-25377 | Low | 3.3 | 2021-04-09 | Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(10.0) above allows attacker to execute pr… |
CVE-2021-22507 | Critical | 9.8 | 2021-04-08 | Authentication bypass vulnerability in Micro Focus Operations Bridge Manager affects versions 2019.05, 2019.11, 2020.05 and 2020.10. The vulnerability could al… |
CVE-2021-27522 | High | 8.8 | 2021-04-08 | Learnsite 1.2.5.0 contains a remote privilege escalation vulnerability in /Manager/index.aspx through the JudgIsAdmin() function. By modifying the initial lett… |
CVE-2021-28174 | Medium | 6.5 | 2021-04-08 | Mitake smart stock selection system contains a broken authentication vulnerability. By manipulating the parameters in the URL, remote attackers can gain the pr… |