CWE-287 · Improper Authentication (page 29)
Page 29 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-8347 | High | 7.8 | 2020-02-11 | An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 and Filemaker Pro Advanced 12.04, which… |
CVE-2019-6744 | Medium | 4.3 | 2020-02-10 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Samsung Knox 1.2.02.39 on Samsung Galaxy S9 build G960… |
CVE-2019-20062 | Critical | 9.8 | 2020-02-10 | MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (the hash never expires until used). |
CVE-2017-18641 | High | 8.1 | 2020-02-10 | In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers. |
CVE-2013-3096 | Medium | 5.9 | 2020-02-07 | D-Link DIR865L v1.03 suffers from an "Unauthenticated Hardware Linking" vulnerability. |
CVE-2013-3091 | Critical | 9.8 | 2020-02-07 | An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication using "Javascript debugging." |
CVE-2012-6340 | Medium | 4.6 | 2020-02-06 | An Authentication vulnerability exists in NETGEAR WGR614 v7 and v9 due to a hardcoded credential used for serial programming, a related issue to CVE-2006-1002. |
CVE-2020-8771 | Critical | 9.8 | 2020-02-06 | The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as… |
CVE-2013-2681 | Critical | 9.8 | 2020-02-05 | Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to gain unauthorized access. |
CVE-2015-0102 | High | 8.1 | 2020-02-05 | IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this co… |
CVE-2019-15620 | Low | 2.7 | 2020-02-04 | Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the proje… |
CVE-2019-15617 | Medium | 5.4 | 2020-02-04 | A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login. |
CVE-2019-15615 | Medium | 6.1 | 2020-02-04 | A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past. |
CVE-2013-7051 | High | 8.8 | 2020-02-04 | D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters |
CVE-2020-8591 | Critical | 9.8 | 2020-02-03 | eG Manager 7.1.2 allows authentication bypass via a com.egurkha.EgLoginServlet?uname=admin&upass=&accessKey=eGm0n1t0r request. |
CVE-2020-8510 | Critical | 9.8 | 2020-02-03 | An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en (user+perms+lang), one can… |
CVE-2016-2032 | High | 7.5 | 2020-01-31 | A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the management interface of an underlying system component called RabbitMQ… |
CVE-2013-5116 | High | 7.1 | 2020-01-31 | Evernote prior to 5.5.1 has insecure password change |
CVE-2013-5114 | Medium | 6.1 | 2020-01-31 | LastPass prior to 2.5.1 allows secure wipe bypass. |
CVE-2013-5112 | Medium | 4.6 | 2020-01-31 | Evernote before 5.5.1 has insecure PIN storage |
CVE-2020-5206 | High | 8.7 | 2020-01-30 | In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if… |
CVE-2013-3317 | Critical | 9.8 | 2020-01-29 | Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass via the NtgrBak key. |
CVE-2013-3316 | Critical | 9.8 | 2020-01-29 | Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass due to the server skipping checks for URLs containing a ".jpg". |
CVE-2013-3215 | Critical | 9.8 | 2020-01-29 | vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function. |
CVE-2013-2569 | High | 7.5 | 2020-01-29 | A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, which could let a mal… |
CVE-2013-3071 | Critical | 9.8 | 2020-01-28 | NETGEAR Centria WNDR4700 devices with firmware 1.0.0.34 allow authentication bypass. |
CVE-2013-1600 | Medium | 5.3 | 2020-01-28 | An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS… |
CVE-2013-4863 | High | 8.8 | 2020-01-28 | The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute arbitrary Lua code via a RunLua action i… |
CVE-2019-15585 | Critical | 9.8 | 2020-01-28 | Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integratio… |
CVE-2019-19825 | Critical | 9.8 | 2020-01-27 | On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, lead… |
CVE-2013-4462 | Critical | 9.1 | 2020-01-27 | WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability |
CVE-2020-5224 | Medium | 6.5 | 2020-01-24 | In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify… |
CVE-2013-1596 | Medium | 5.3 | 2020-01-24 | An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554. |
CVE-2012-6451 | Critical | 9.8 | 2020-01-24 | Lorex LNC116 and LNC104 IP Cameras have a Remote Authentication Bypass Vulnerability |
CVE-2020-1788 | Medium | 5.5 | 2020-01-21 | Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability. Certain applications do not properly va… |
CVE-2020-1840 | Medium | 6.0 | 2020-01-21 | HUAWEI Mate 20 smart phones with versions earlier than 10.0.0.175(C00E70R3P8) have an insufficient authentication vulnerability. A local attacker with high pri… |
CVE-2020-7222 | Medium | 5.3 | 2020-01-18 | An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authentica… |
CVE-2019-3997 | Medium | 4.6 | 2020-01-16 | Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.0-1.3 allows a local, unauthenticated attacker to pair a rogue keypad to… |
CVE-2019-19857 | Medium | 6.5 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. An admin can change their password without providing the current p… |
CVE-2012-3824 | High | 7.5 | 2020-01-10 | In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization. |
CVE-2014-5081 | Critical | 9.8 | 2020-01-10 | sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass |
CVE-2012-2714 | Critical | 9.8 | 2020-01-09 | The BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users via the audien… |
CVE-2012-1258 | Medium | 6.5 | 2020-01-09 | cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate user permissions, which allow remote at… |
CVE-2020-1786 | Medium | 4.6 | 2020-01-09 | HUAWEI Mate 20 Pro smartphones versions earlier than 10.0.0.175(C00E69R3P8) have an improper authentication vulnerability. The software does not sufficiently v… |
CVE-2020-1787 | Medium | 6.6 | 2020-01-09 | HUAWEI Mate 20 smartphones versions earlier than 9.1.0.139(C00E133R3P1) have an improper authentication vulnerability. The system has a logic error under certa… |
CVE-2014-2651 | Critical | 9.8 | 2020-01-09 | Unify OpenStage/OpenScape Desk Phone IP SIP before V3 R3.11.0 has an authentication bypass in the default mode of the Workpoint Interface |
CVE-2019-17023 | Medium | 6.5 | 2020-01-08 | After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Mach… |
CVE-2019-19518 | Critical | 9.8 | 2020-01-08 | CA Automic Sysload 5.6.0 through 6.1.2 contains a vulnerability, related to a lack of authentication on the File Server port, that potentially allows remote at… |
CVE-2019-20360 | High | 7.5 | 2020-01-08 | A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user inf… |
CVE-2013-5122 | Critical | 9.8 | 2020-01-07 | Cisco Linksys Routers EA2700, EA3500, E4200, EA4500: A bug can cause an unsafe TCP port to open which leads to unauthenticated access |
CVE-2019-6854 | High | 7.8 | 2020-01-06 | A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -with initial releases before 1 January 20… |
CVE-2018-19834 | High | 7.5 | 2019-12-31 | The quaker function of a smart contract implementation for BOMBBA (BOMB), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contrac… |
CVE-2018-19833 | High | 7.5 | 2019-12-31 | The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because… |
CVE-2018-19832 | High | 7.5 | 2019-12-31 | The NETM() function of a smart contract implementation for NewIntelTechMedia (NETM), an tradable Ethereum ERC20 token, allows attackers to change the owner of… |
CVE-2018-19831 | High | 7.5 | 2019-12-31 | The ToOwner() function of a smart contract implementation for Cryptbond Network (CBN), an tradable Ethereum ERC20 token, allows attackers to change the owner o… |
CVE-2018-20489 | Medium | 5.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2013-4982 | Critical | 9.8 | 2019-12-27 | AVTECH AVN801 DVR has a security bypass via the administration login captcha |
CVE-2013-4976 | Critical | 9.8 | 2019-12-27 | Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials |
CVE-2013-4621 | Critical | 9.8 | 2019-12-27 | Magnolia CMS before 4.5.9 has multiple access bypass vulnerabilities |
CVE-2013-3088 | Critical | 9.8 | 2019-12-26 | Belkin N900 router (F9K1104v1) contains an Authentication Bypass using "Javascript debugging". |
CVE-2013-3085 | Critical | 9.8 | 2019-12-26 | An authentication bypass exists in the web management interface in Belkin F5D8236-4 v2. |
CVE-2012-3462 | High | 8.8 | 2019-12-26 | A flaw was found in SSSD version 1.9.0. The SSSD's access-provider logic causes the result of the HBAC rule processing to be ignored in the event that the acce… |
CVE-2019-16327 | Critical | 9.8 | 2019-12-26 | D-Link DIR-601 B1 2.00NA devices are vulnerable to authentication bypass. They do not check for authentication at the server side and rely on client-side valid… |
CVE-2019-19982 | Medium | 5.3 | 2019-12-26 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulne… |
CVE-2019-5108 | Medium | 6.5 | 2019-12-23 | An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP… |
CVE-2019-5486 | High | 8.8 | 2019-12-18 | A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an att… |
CVE-2019-8804 | Medium | 5.7 | 2019-12-18 | An inconsistency in Wi-Fi network configuration settings was addressed. This issue is fixed in iOS 13.2 and iPadOS 13.2. An attacker in physical proximity may… |
CVE-2019-8760 | Medium | 6.8 | 2019-12-18 | This issue was addressed by improving Face ID machine learning models. This issue is fixed in iOS 13. A 3D model constructed to look like the enrolled user may… |
CVE-2019-8704 | Medium | 5.5 | 2019-12-18 | An authentication issue was addressed with improved state management. This issue is fixed in tvOS 13. A local user may be able to leak sensitive user informati… |
CVE-2019-8634 | High | 8.8 | 2019-12-18 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.5. A user may be unexpectedly logged in to anot… |
CVE-2019-8533 | High | 7.8 | 2019-12-18 | A lock handling issue was addressed with improved lock handling. This issue is fixed in macOS Mojave 10.14.4. A Mac may not lock when disconnecting from an ext… |
CVE-2014-8650 | Critical | 9.8 | 2019-12-15 | python-requests-Kerberos through 0.5 does not handle mutual authentication |
CVE-2019-5252 | Low | 3.5 | 2019-12-14 | There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficie… |
CVE-2019-5253 | Medium | 5.9 | 2019-12-13 | E5572-855 with versions earlier than 8.0.1.3(H335SP1C233) has an improper authentication vulnerability. The device does not perform a sufficient authentication… |
CVE-2014-1867 | High | 7.8 | 2019-12-13 | suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code execution |
CVE-2019-5061 | Medium | 6.5 | 2019-12-12 | An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before… |
CVE-2019-18341 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Control Center Server… |
CVE-2019-18337 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains an authentication bypass v… |
CVE-2019-18332 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18322 | Critical | 9.1 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could be able to… |
CVE-2019-18321 | Critical | 9.1 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could be able to… |
CVE-2019-18320 | High | 7.5 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18319 | High | 7.5 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18318 | High | 7.5 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18317 | High | 7.5 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18315 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18314 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18312 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could be able to… |
CVE-2019-18287 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The Application Server exposes directory listings… |
CVE-2019-18286 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The Application Server exposes directory listings… |
CVE-2019-18284 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The AdminService is available without authenticati… |
CVE-2013-4593 | High | 7.5 | 2019-12-11 | RubyGem omniauth-facebook has an access token security vulnerability |
CVE-2019-14870 | Medium | 5.4 | 2019-12-10 | All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes… |
CVE-2013-2159 | Critical | 9.8 | 2019-12-10 | Monkey HTTP Daemon: broken user name authentication |
CVE-2019-18380 | Medium | 6.5 | 2019-12-09 | Symantec Industrial Control System Protection (ICSP), versions 6.x.x, may be susceptible to an unauthorized access issue that could potentially allow a threat… |
CVE-2019-15897 | Critical | 9.6 | 2019-12-05 | beegfs-ctl in ThinkParQ BeeGFS through 7.1.3 allows Authentication Bypass via communication with a BeeGFS metadata server (which is typically not exposed to ex… |
CVE-2019-17437 | High | 7.8 | 2019-12-05 | An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges an… |
CVE-2019-14910 | Critical | 9.8 | 2019-12-05 | A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (… |
CVE-2019-19598 | High | 8.8 | 2019-12-05 | D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAP_AUTH header timestamp value. In HTTP r… |
CVE-2019-19521 | Critical | 9.8 | 2019-12-05 | libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/auth_subr.c… |