CWE-287 · Improper Authentication (page 28)
Page 28 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-10916 | High | 8.0 | 2020-05-07 | This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of TP-Link TL-WA855RE Firmware Ver: 855rev4-up-ver1-0-1-P… |
CVE-2020-4427 | Critical | 9.8 | 2020-05-07 | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML auth… |
CVE-2020-3125 | Critical | 9.8 | 2020-05-06 | A vulnerability in the Kerberos authentication feature of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to i… |
CVE-2020-5727 | Medium | 4.6 | 2020-05-02 | Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to pair a rogue keypad to an a… |
CVE-2020-11020 | High | 8.5 | 2020-04-29 | Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vul… |
CVE-2016-11057 | High | 7.5 | 2020-04-28 | Certain NETGEAR devices are affected by mishandling of repeated URL calls. This affects JNR1010v2 before 2017-01-06, WNR614 before 2017-01-06, WNR618 before 20… |
CVE-2017-18862 | Medium | 6.5 | 2020-04-28 | Certain NETGEAR devices are affected by authentication bypass. This affects JGS516PE before 2017-05-11, JGS524Ev2 before 2017-05-11, JGS524PE before 2017-05-11… |
CVE-2020-5567 | High | 7.5 | 2020-04-28 | Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in Application Menu. |
CVE-2020-5563 | Medium | 5.3 | 2020-04-28 | Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in the affected product via the API. |
CVE-2020-9294 | Critical | 9.8 | 2020-04-27 | An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthentica… |
CVE-2020-9068 | Critical | 9.8 | 2020-04-27 | Huawei AR3200 products with versions of V200R007C00SPC900, V200R007C00SPCa00, V200R007C00SPCb00, V200R007C00SPCc00, V200R009C00SPC500 have an improper authenti… |
CVE-2019-18823 | Critical | 9.8 | 2020-04-27 | HTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect Access Control. It is possible to use a different authentication me… |
CVE-2017-18720 | High | 8.8 | 2020-04-24 | Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2… |
CVE-2017-18733 | High | 8.8 | 2020-04-23 | Certain NETGEAR devices are affected by authentication bypass. This affects D6220 before 1.0.0.28, D6400 before 1.0.0.60, D8500 before 1.0.3.29, R6250 before 1… |
CVE-2017-18732 | High | 8.8 | 2020-04-23 | Certain NETGEAR devices are affected by authentication bypass. This affects R6300v2 before 1.0.4.8, PLW1000v2 before 1.0.0.14, and PLW1010v2 before 1.0.0.14. |
CVE-2017-18743 | High | 8.8 | 2020-04-23 | Certain NETGEAR devices are affected by authentication bypass. This affects R6300v2 before 1.0.4.8, R6400 before 1.0.1.20, R6700 before 1.0.1.20, R6900 before… |
CVE-2018-21128 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by authentication bypass. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17. |
CVE-2018-21125 | High | 8.8 | 2020-04-22 | NETGEAR WAC510 devices before 5.0.0.17 are affected by authentication bypass. |
CVE-2018-21121 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by authentication bypass. This affects GS810EMX before 1.0.0.5, XS512EM before 1.0.0.6, and XS724EM before 1.0.0.6. |
CVE-2018-21118 | High | 8.8 | 2020-04-22 | NETGEAR XR500 devices before 2.3.2.32 are affected by authentication bypass. |
CVE-2019-19104 | Critical | 9.1 | 2020-04-22 | The web server in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows access to different endpoints of the application without authe… |
CVE-2017-18776 | High | 8.4 | 2020-04-22 | Certain NETGEAR devices are affected by authentication bypass. This affects D6100 before V1.0.0.55, D7000 before V1.0.1.50, D7800 before V1.0.1.24, JNR1010v2 b… |
CVE-2017-18772 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by authentication bypass. This affects EX3700 before 1.0.0.64, EX3800 before 1.0.0.64, EX6120 before 1.0.0.32, EX6130 befo… |
CVE-2020-11796 | Critical | 9.8 | 2020-04-22 | In JetBrains Space through 2020-04-22, the password authentication implementation was insecure. |
CVE-2020-5268 | Medium | 6.5 | 2020-04-21 | In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some c… |
CVE-2020-11965 | Critical | 9.8 | 2020-04-21 | In IQrouter through 3.3.1, there is a root user without a password, which allows attackers to gain full remote access via SSH. Note: The vendor claims that thi… |
CVE-2020-11964 | High | 7.5 | 2020-04-21 | In IQrouter through 3.3.1, the Lua function diag_set_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendo… |
CVE-2020-9277 | Critical | 9.8 | 2020-04-20 | An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administ… |
CVE-2020-9070 | Medium | 5.5 | 2020-04-20 | Huawei smartphones Taurus-AL00B with versions earlier than 10.0.0.205(C00E201R7P2) have an improper authentication vulnerability. The software insufficiently v… |
CVE-2020-1803 | Medium | 5.3 | 2020-04-20 | Huawei smartphones Honor V20 with versions earlier than 10.0.0.179(C636E3R4P3),versions earlier than 10.0.0.180(C185E3R3P3),versions earlier than 10.0.0.180(C4… |
CVE-2017-18850 | High | 8.4 | 2020-04-20 | Certain NETGEAR devices are affected by authentication bypass. This affects D6220 before 1.0.0.26, D6400 before 1.0.0.60, D8500 before 1.0.3.29, R6250 before 1… |
CVE-2019-20786 | Critical | 9.8 | 2020-04-19 | handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary un… |
CVE-2020-7276 | Medium | 6.4 | 2020-04-15 | Authentication bypass vulnerability in MfeUpgradeTool in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update allows administrator user… |
CVE-2020-8148 | Medium | 5.3 | 2020-04-13 | UniFi Cloud Key firmware < 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request. T… |
CVE-2020-1801 | Medium | 5.5 | 2020-04-10 | There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller's… |
CVE-2020-8828 | High | 8.8 | 2020-04-08 | As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for… |
CVE-2020-1637 | High | 7.2 | 2020-04-08 | A vulnerability in Juniper Networks SRX Series device configured as a Junos OS Enforcer device may allow a user to access network resources that are not permit… |
CVE-2020-1618 | Medium | 6.3 | 2020-04-08 | On Juniper Networks EX and QFX Series, an authentication bypass vulnerability may allow a user connected to the console port to login as root without any passw… |
CVE-2018-21062 | Medium | 4.6 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. When biometric authentication is disabled, an attacker can view Streams cont… |
CVE-2018-21038 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) software. The Secure Folder app's startup logic allows authentication bypass. The Samsung ID is S… |
CVE-2017-18646 | Medium | 4.6 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. An attacker can bypass the password requirement for tablet user switching by… |
CVE-2017-18654 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0, 7.1) software. An unauthenticated attacker can register a new security certificate. Th… |
CVE-2016-11042 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. There is a SIM Lock bypass. The Samsung ID is SVE-2016-5381 (June 2016). |
CVE-2016-11041 | Medium | 4.6 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4) software. Attackers can bypass the lockscreen by sending an AT command over USB. The Samsung ID… |
CVE-2020-11542 | Critical | 9.8 | 2020-04-04 | 3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpret… |
CVE-2019-14880 | Critical | 9.1 | 2020-03-31 | A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not verify users' email… |
CVE-2020-5860 | High | 8.1 | 2020-03-27 | On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, in a High Ava… |
CVE-2020-9066 | High | 7.8 | 2020-03-26 | Huawei smartphones OxfordP-AN10B with versions earlier than 10.0.1.169(C00E166R4P1) have an improper authentication vulnerability. The Application doesn't perf… |
CVE-2019-15796 | Medium | 4.7 | 2020-03-26 | Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache… |
CVE-2020-10965 | High | 8.1 | 2020-03-25 | Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the default admin accoun… |
CVE-2020-10888 | Critical | 9.8 | 2020-03-25 | This vulnerability allows remote attackers to bypass authentication on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authent… |
CVE-2019-20620 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. The Settings application allows unauthenticated changes. The Samsung IDs are SVE-2019-1… |
CVE-2019-20618 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. The Pin Window feature allows unauthenticated unpinning of an app. The Samsung ID is SV… |
CVE-2019-20565 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) software. Attackers can change the USB configuration without authentication. The Samsu… |
CVE-2020-10847 | Medium | 6.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) (Galaxy S8 and Note8) software. Facial recognition can be spoofed. The Samsung ID is SVE-2019-166… |
CVE-2020-10846 | Medium | 5.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.x) and Q(10.x) software. Attackers can enable the OEM unlock feature on a KG-enrolled devices, leadi… |
CVE-2019-20533 | Low | 3.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (released in China or India) software. The S Secure app can launch masked app… |
CVE-2020-8863 | High | 8.8 | 2020-03-23 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with fi… |
CVE-2020-1878 | Medium | 5.5 | 2020-03-20 | Huawei smartphone OxfordS-AN00A with versions earlier than 10.0.1.152D(C735E152R3P3),versions earlier than 10.0.1.160(C00E160R4P1) have an improper authenticat… |
CVE-2020-1864 | High | 8.1 | 2020-03-20 | Some Huawei products have a security vulnerability due to improper authentication. A remote attacker needs to obtain some information and forge the peer device… |
CVE-2020-1794 | Medium | 4.6 | 2020-03-20 | There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient authentication in certain scenarios, succes… |
CVE-2020-1793 | Medium | 4.6 | 2020-03-20 | There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient authentication in certain scenarios, succes… |
CVE-2020-10669 | High | 7.5 | 2020-03-19 | The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated att… |
CVE-2020-4205 | Medium | 6.3 | 2020-03-19 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass security restrictions, and continue to access the server even a… |
CVE-2020-6988 | High | 7.5 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2018-13060 | Medium | 6.5 | 2020-03-16 | Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue. |
CVE-2020-10594 | Critical | 9.1 | 2020-03-15 | An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via t… |
CVE-2020-9064 | Medium | 5.5 | 2020-03-12 | Huawei smartphone Honor V30 with versions earlier than OxfordS-AN00A 10.0.1.167(C00E166R4P1) have an improper authentication vulnerability. Authentication to t… |
CVE-2020-8994 | Medium | 6.8 | 2020-03-05 | An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. Attackers can get root shell by accessing the UART interface and then they can rea… |
CVE-2020-8664 | Medium | 5.3 | 2020-03-04 | CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many res… |
CVE-2020-5536 | High | 8.8 | 2020-03-04 | OpenBlocks IoT VX2 prior to Ver.4.0.0 (Ver.3 Series) allows an attacker on the same network segment to bypass authentication and to initialize the device via u… |
CVE-2018-15819 | High | 7.5 | 2020-03-02 | EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js. |
CVE-2019-20489 | Critical | 9.8 | 2020-03-02 | An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and other problems that ul… |
CVE-2020-3923 | High | 8.1 | 2020-02-27 | DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET, contain misconfigured authentication mechanism. Attackers can crack the default passw… |
CVE-2019-5165 | High | 7.2 | 2020-02-25 | An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware version 1.13. A specially configured device… |
CVE-2018-14705 | Critical | 9.8 | 2020-02-24 | In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device o… |
CVE-2019-20481 | Critical | 9.8 | 2020-02-24 | In MIELE XGW 3000 ZigBee Gateway before 2.4.0, the Password Change Function does not require knowledge of the old password. This can be exploited in conjunctio… |
CVE-2019-15299 | High | 8.8 | 2020-02-24 | An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the contact_autologin_key field in the database… |
CVE-2020-8862 | High | 8.8 | 2020-02-22 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authent… |
CVE-2020-8861 | High | 8.8 | 2020-02-22 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders… |
CVE-2020-3944 | High | 8.6 | 2020-02-19 | vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) has an improper trust store configuration leading to authentication byp… |
CVE-2011-2054 | Medium | 4.3 | 2020-02-19 | A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authent… |
CVE-2014-3879 | Critical | 9.8 | 2020-02-18 | OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, which causes… |
CVE-2013-4454 | Critical | 9.1 | 2020-02-18 | WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities |
CVE-2020-1842 | Medium | 6.8 | 2020-02-18 | Huawei HEGE-560 version 1.0.1.20(SP2); OSCA-550 and OSCA-550A version 1.0.0.71(SP1); and OSCA-550AX and OSCA-550X version 1.0.0.71(SP2) have an insufficient au… |
CVE-2020-1812 | High | 7.8 | 2020-02-18 | HUAWEI P30 smartphones with versions earlier than 10.0.0.173(C00E73R1P11) have an improper authentication vulnerability. Due to improperly validation of certai… |
CVE-2020-1789 | Medium | 6.8 | 2020-02-18 | Huawei OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X products with version 1.0.1.21(SP3) have an insufficient authentication vulnerability. The software does… |
CVE-2015-6922 | Critical | 9.8 | 2020-02-17 | Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authe… |
CVE-2019-20046 | Critical | 9.8 | 2020-02-14 | The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. The affected product does not requi… |
CVE-2020-5532 | Medium | 4.3 | 2020-02-14 | ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker on the same network segment to bypass au… |
CVE-2013-6360 | High | 7.5 | 2020-02-13 | TRENDnet TS-S402 has a backdoor to enable TELNET. |
CVE-2019-3998 | Medium | 5.5 | 2020-02-13 | Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to modify the Wi-Fi network th… |
CVE-2019-14598 | Medium | 6.7 | 2020-02-13 | Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 1… |
CVE-2014-4198 | Critical | 9.1 | 2020-02-13 | A Two-Factor Authentication Bypass Vulnerability exists in BS-Client Private Client 2.4 and 2.5 via an XML request that neglects the use of ADPswID and AD para… |
CVE-2020-8953 | Critical | 9.8 | 2020-02-13 | OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication). |
CVE-2011-4338 | High | 7.8 | 2020-02-12 | Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root p… |
CVE-2020-8595 | High | 7.3 | 2020-02-12 | Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matc… |
CVE-2020-0688 | High | 8.8 | 2020-02-11 | A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchan… |
CVE-2013-2120 | High | 8.4 | 2020-02-11 | The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allo… |
CVE-2013-5582 | High | 7.8 | 2020-02-11 | Ammyy Admin 3.2 and earlier stores the client ID at a fixed memory location, which might make it easier for user-assisted remote attackers to bypass authentica… |