CWE-287 · Improper Authentication (page 29)
Page 29 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-1472 | Medium | 5.3 | 2021-04-08 | Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary comma… |
CVE-2021-30158 | Medium | 5.3 | 2021-04-06 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has secu… |
CVE-2021-24175 | Critical | 9.8 | 2021-04-05 | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing… |
CVE-2019-20464 | High | 7.5 | 2021-04-02 | An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. By default, a mobile application is used to stream over UDP. Howev… |
CVE-2021-29012 | Critical | 9.8 | 2021-04-02 | DMA Softlab Radius Manager 4.4.0 assigns the same session cookie to every admin session. The cookie is valid when the admin is logged in, but is invalid (tempo… |
CVE-2021-23923 | High | 8.1 | 2021-04-01 | An issue was discovered in Devolutions Server before 2020.3. There is Broken Authentication with Windows domain users. |
CVE-2021-21982 | Critical | 9.1 | 2021-04-01 | VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with network access to… |
CVE-2019-5317 | Medium | 6.8 | 2021-03-29 | A local authentication bypass vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4… |
CVE-2021-21403 | High | 7.5 | 2021-03-26 | In github.com/kongchuanhujiao/server before version 1.3.21 there is an authentication Bypass by Primary Weakness vulnerability. All users are impacted. This is… |
CVE-2021-3153 | Medium | 6.5 | 2021-03-26 | HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor au… |
CVE-2021-25368 | Low | 3.3 | 2021-03-25 | Hijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is executed. |
CVE-2021-22496 | High | 7.5 | 2021-03-25 | Authentication Bypass Vulnerability in Micro Focus Access Manager Product, affects all version prior to version 4.5.3.3. The vulnerability could cause informat… |
CVE-2021-26070 | High | 7.2 | 2021-03-22 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken… |
CVE-2021-24148 | Critical | 9.8 | 2021-03-18 | A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated… |
CVE-2021-22860 | Critical | 9.8 | 2021-03-17 | EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to ob… |
CVE-2021-20018 | Medium | 4.9 | 2021-03-13 | A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address. This vulnerability i… |
CVE-2021-21378 | High | 8.2 | 2021-03-11 | Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token wit… |
CVE-2020-35231 | High | 8.8 | 2021-03-10 | The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an authentication issue that allows an attacker to bypass acces… |
CVE-2020-27838 | Medium | 6.5 | 2021-03-08 | A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret… |
CVE-2021-21335 | Medium | 5.3 | 2021-03-08 | In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed… |
CVE-2021-21329 | High | 8.7 | 2021-03-08 | RATCF is an open-source framework for hosting Cyber-Security Capture the Flag events. In affected versions of RATCF users with multi factor authentication enab… |
CVE-2020-28050 | Critical | 9.1 | 2021-03-05 | Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the server. |
CVE-2020-5148 | High | 8.2 | 2021-03-05 | SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a potential attacker to ca… |
CVE-2021-25347 | Medium | 5.3 | 2021-03-04 | Hijacking vulnerability in Samsung Email application version prior to SMR Feb-2021 Release 1 allows attackers to intercept when the provider is executed. |
CVE-2021-25343 | Medium | 4.0 | 2021-03-04 | Calling of non-existent provider in Samsung Members prior to version 2.4.81.13 (in Android O(8.1) and below) and 3.8.00.13 (in Android P(9.0) and above) allows… |
CVE-2021-25342 | Medium | 4.0 | 2021-03-04 | Calling of non-existent provider in SMP sdk prior to version 3.0.9 allows unauthorized actions including denial of service attack by hijacking the provider. |
CVE-2021-25341 | Medium | 4.0 | 2021-03-04 | Calling of non-existent provider in S Assistant prior to version 6.5.01.22 allows unauthorized actions including denial of service attack by hijacking the prov… |
CVE-2021-25315 | Critical | 9.8 | 2021-03-03 | CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary c… |
CVE-2021-21513 | High | 8.6 | 2021-03-02 | Dell EMC OpenManage Server Administrator (OMSA) version 9.5 Microsoft Windows installations with Distributed Web Server (DWS) enabled configuration contains an… |
CVE-2021-3332 | Medium | 5.3 | 2021-03-01 | WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via post_password. |
CVE-2021-25281 | Critical | 9.8 | 2021-02-27 | An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can re… |
CVE-2021-21308 | Medium | 6.1 | 2021-02-26 | PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is ab… |
CVE-2020-26200 | Medium | 6.8 | 2021-02-26 | A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorp… |
CVE-2021-3339 | Medium | 4.3 | 2021-02-19 | ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the Search Screen and the Profile Screen. |
CVE-2020-10254 | Medium | 5.9 | 2021-02-19 | An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its preview. |
CVE-2021-22858 | High | 8.8 | 2021-02-17 | Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining use… |
CVE-2020-27866 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2… |
CVE-2020-27865 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version 1.04B03 WiFi exten… |
CVE-2020-27863 | Medium | 6.5 | 2021-02-12 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A routers. Auth… |
CVE-2020-13185 | Medium | 6.5 | 2021-02-11 | Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the need to specify auth… |
CVE-2021-21502 | Critical | 9.8 | 2021-02-09 | Dell PowerScale OneFS versions 8.1.0 – 9.1.0 contain a "use of SSH key past account expiration" vulnerability. A user on the network with the ISI_PRIV_AUTH_SSH… |
CVE-2020-10048 | Medium | 5.5 | 2021-02-09 | A vulnerability has been identified in SIMATIC PCS 7 (All versions), SIMATIC WinCC (All versions < V7.5 SP2). Due to an insecure password verification process… |
CVE-2021-26905 | Medium | 6.5 | 2021-02-08 | 1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key. |
CVE-2020-10539 | Critical | 9.8 | 2021-02-05 | An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort() function that, upon user login, checks the submitted password a… |
CVE-2020-17523 | Critical | 9.8 | 2021-02-03 | Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. |
CVE-2021-3282 | High | 7.5 | 2021-02-01 | HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in… |
CVE-2020-15835 | Critical | 9.8 | 2021-02-01 | An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function contains undocumented code that provides the ability to… |
CVE-2020-13859 | Critical | 9.8 | 2021-02-01 | An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Confi… |
CVE-2021-25910 | High | 8.0 | 2021-01-29 | Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several p… |
CVE-2021-26117 | High | 7.5 | 2021-01-27 | The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to versio… |
CVE-2021-3297 | High | 7.8 | 2021-01-26 | On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access. |
CVE-2021-25863 | High | 8.8 | 2021-01-26 | Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. |
CVE-2020-28874 | High | 7.5 | 2021-01-26 | reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly conside… |
CVE-2020-4983 | High | 7.8 | 2021-01-20 | IBM Spectrum LSF 10.1 and IBM Spectrum LSF Suite 10.2 could allow a user on the local network who has privileges to submit LSF jobs to execute arbitrary comman… |
CVE-2020-27266 | Medium | 6.5 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A m… |
CVE-2020-24641 | High | 7.5 | 2021-01-15 | In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if successfully exploited ca… |
CVE-2021-22171 | High | 7.3 | 2021-01-15 | Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a malic… |
CVE-2020-27488 | Critical | 9.8 | 2021-01-13 | Loxone Miniserver devices with firmware before 11.1 (aka 11.1.9.3) are unable to use an authentication method that is based on the "signature of the update pac… |
CVE-2020-5686 | High | 7.5 | 2021-01-13 | Incorrect implementation of authentication algorithm issue in UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to access… |
CVE-2020-5633 | Critical | 9.8 | 2021-01-13 | Multiple NEC products (Express5800/T110j, Express5800/T110j-S, Express5800/T110j (2nd-Gen), Express5800/T110j-S (2nd-Gen), iStorage NS100Ti, and Express5800/GT… |
CVE-2021-1725 | Medium | 5.5 | 2021-01-12 | Bot Framework SDK Information Disclosure Vulnerability |
CVE-2020-36176 | High | 7.5 | 2021-01-06 | The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until… |
CVE-2012-10001 | Critical | 9.8 | 2021-01-06 | The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to condu… |
CVE-2020-35219 | Critical | 9.8 | 2021-01-04 | The ASUS DSL-N17U modem with firmware 1.1.0.2 allows attackers to access the admin interface by changing the admin password without authentication via a POST r… |
CVE-2020-25848 | Critical | 9.8 | 2020-12-31 | HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism. |
CVE-2020-35785 | High | 8.3 | 2020-12-30 | NETGEAR DGN2200v1 devices before v1.0.0.60 mishandle HTTPd authentication (aka PSV-2020-0363, PSV-2020-0364, and PSV-2020-0365). |
CVE-2020-9207 | High | 7.8 | 2020-12-29 | There is an improper authentication vulnerability in some verisons of Huawei CloudEngine product. A module does not verify the input file properly. Attackers c… |
CVE-2020-26030 | Critical | 9.8 | 2020-12-28 | An issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO endpoint via a crafted header, when SSO is not configured. An atta… |
CVE-2020-24675 | Critical | 9.8 | 2020-12-22 | In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations History server (or standalone S+ History ser… |
CVE-2020-24579 | High | 8.8 | 2020-12-22 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to acce… |
CVE-2020-27254 | High | 7.5 | 2020-12-21 | Emerson Rosemount X-STREAM Gas AnalyzerX-STREAM enhanced XEGP, XEGK, XEFD, XEXF – all revisions, The affected products are vulnerable to improper authenticatio… |
CVE-2020-27780 | Critical | 9.8 | 2020-12-18 | A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to au… |
CVE-2020-8465 | Critical | 9.8 | 2020-12-17 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combination of CSR… |
CVE-2020-27199 | High | 7.5 | 2020-12-17 | The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the application currently has in place is a simple Use… |
CVE-2020-4747 | Critical | 9.8 | 2020-12-15 | IBM Connect:Direct for UNIX 6.1.0, 6.0.0, 4.3.0, and 4.2.0 can allow a local or remote user to obtain an authenticated CLI session due to improper authenticati… |
CVE-2020-0460 | High | 7.5 | 2020-12-14 | In createNameCredentialDialog of CertInstaller.java, there exists the possibility of improperly installed certificates due to a logic error. This could lead to… |
CVE-2020-25183 | High | 8.0 | 2020-12-14 | Medtronic MyCareLink Smart 25000 contains an authentication protocol vulnerability where the method used to authenticate between the MCL Smart Patient Reader… |
CVE-2020-16102 | High | 7.1 | 2020-12-14 | Improper Authentication vulnerability in Gallagher Command Centre Server allows an unauthenticated remote attacker to create items with invalid configuration… |
CVE-2020-29669 | High | 8.8 | 2020-12-14 | In the Macally WIFISD2-2A82 Media and Travel Router 2.000.010, the Guest user is able to reset its own password. This process has a vulnerability which can be… |
CVE-2020-35208 | Medium | 5.7 | 2020-12-12 | An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The password authentication for unlockin… |
CVE-2020-35207 | Medium | 5.7 | 2020-12-12 | An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The PIN authentication for unlocking can… |
CVE-2020-29563 | Critical | 9.8 | 2020-12-12 | An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticate… |
CVE-2020-29668 | Low | 3.7 | 2020-12-10 | Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie… |
CVE-2020-7787 | High | 8.2 | 2020-12-09 | This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh valu… |
CVE-2020-26834 | Medium | 5.4 | 2020-12-09 | SAP HANA Database, version - 2.0, does not correctly validate the username when performing SAML bearer token-based user authentication. It is possible to manip… |
CVE-2020-27408 | High | 7.5 | 2020-12-04 | OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change… |
CVE-2020-7199 | Critical | 9.8 | 2020-12-02 | A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software. The vul… |
CVE-2020-28971 | Critical | 9.8 | 2020-12-01 | An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticate… |
CVE-2020-28970 | Critical | 9.8 | 2020-12-01 | An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticate… |
CVE-2020-28940 | Critical | 9.8 | 2020-12-01 | On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allow an unauthenticate… |
CVE-2020-7533 | Critical | 9.8 | 2020-12-01 | CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending speciall… |
CVE-2020-29392 | Medium | 4.6 | 2020-11-30 | The Estil Hill Lock Password Manager Safe app 2.3 for iOS has a *#06#* backdoor password. An attacker with physical access can unlock the password manager with… |
CVE-2020-29127 | Critical | 9.8 | 2020-11-30 | An issue was discovered on Fujitsu Eternus Storage DX200 S4 devices through 2020-11-25. After logging into the portal as a root user (using any web browser), t… |
CVE-2020-29378 | High | 8.8 | 2020-11-29 | An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devic… |
CVE-2020-28333 | Critical | 9.8 | 2020-11-24 | Barco wePresent WiPG-1600W devices allow Authentication Bypass. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W web interface does not use session… |
CVE-2020-7378 | Critical | 9.1 | 2020-11-24 | CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affec… |
CVE-2020-28896 | Medium | 5.3 | 2020-11-23 | Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The c… |
CVE-2020-4771 | Medium | 5.3 | 2020-11-23 | IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.10.and 7.1.0.000 through 7.1.11 could allow a remote attacker to obtain sensitive information, cau… |
CVE-2020-1778 | Medium | 4.1 | 2020-11-23 | When OTRS uses multiple backends for user authentication (with LDAP), agents are able to login even if the account is set to invalid. This issue affects OTRS… |
CVE-2019-14553 | Medium | 4.9 | 2020-11-23 | Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access. |