CWE-287 · Improper Authentication (page 30)
Page 30 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-19519 | High | 7.8 | 2019-12-05 | In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the main function in s… |
CVE-2019-14909 | High | 8.3 | 2019-12-04 | A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accept… |
CVE-2019-19507 | Medium | 5.3 | 2019-12-02 | In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name… |
CVE-2019-12394 | Critical | 9.8 | 2019-12-02 | Anviz access control devices allow unverified password change which allows remote attackers to change the administrator password without prior authentication. |
CVE-2019-5218 | High | 8.8 | 2019-11-29 | There is an insufficient authentication vulnerability in Huawei Band 2 and Honor Band 3. The band does not sufficiently authenticate the device try to connect… |
CVE-2019-16201 | High | 7.5 | 2019-11-26 | WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/b… |
CVE-2019-6675 | Critical | 9.8 | 2019-11-26 | BIG-IP configurations using Active Directory, LDAP, or Client Certificate LDAP for management authentication with multiple servers are exposed to a vulnerabili… |
CVE-2019-14856 | Medium | 6.5 | 2019-11-26 | ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None |
CVE-2019-15987 | Medium | 5.3 | 2019-11-26 | A vulnerability in web interface of the Cisco Webex Event Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center could… |
CVE-2019-18250 | Critical | 9.8 | 2019-11-26 | In all versions of ABB Power Generation Information Manager (PGIM) and Plant Connect, the affected product is vulnerable to authentication bypass, which may al… |
CVE-2019-18374 | Critical | 9.8 | 2019-11-25 | Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a type of is… |
CVE-2019-16286 | Medium | 6.8 | 2019-11-22 | An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by changing browser preferences to launch a sep… |
CVE-2019-3654 | Medium | 5.3 | 2019-11-22 | Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web tra… |
CVE-2014-2904 | High | 7.5 | 2019-11-21 | wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication. |
CVE-2019-19006 | Critical | 9.8 | 2019-11-21 | Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. |
CVE-2019-15803 | Critical | 9.1 | 2019-11-14 | An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Through an undocumented sequence of keypresses, undocumented functionality… |
CVE-2013-3072 | Critical | 9.8 | 2019-11-14 | An Authentication Bypass vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34 in http://<router_ip>/apply.cgi?/hdd_usr_setup.htm that when visite… |
CVE-2019-11170 | High | 7.8 | 2019-11-14 | Authentication bypass in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure, esca… |
CVE-2013-3367 | Critical | 9.8 | 2019-11-13 | Undocumented TELNET service in TRENDnet TEW-691GR and TEW-692GR when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg_… |
CVE-2019-5233 | High | 8.8 | 2019-11-13 | Huawei smartphones with versions earlier than Taurus-AL00B 10.0.0.41(SP2C00E41R3P2) have an improper authentication vulnerability. Successful exploitation may… |
CVE-2019-5213 | Low | 2.4 | 2019-11-12 | Honor play smartphones with versions earlier than Cornell-AL00A 9.1.0.321(C00E320R1P1T8) have an insufficient authentication vulnerability. The system has a lo… |
CVE-2019-18848 | High | 7.5 | 2019-11-12 | The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string. |
CVE-2019-13531 | Medium | 4.8 | 2019-11-08 | In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not… |
CVE-2011-4628 | Critical | 9.8 | 2019-11-06 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted re… |
CVE-2019-8108 | Medium | 6.5 | 2019-11-05 | Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated us… |
CVE-2013-5123 | Medium | 5.9 | 2019-11-05 | The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-… |
CVE-2019-1980 | Medium | 5.3 | 2019-11-05 | A vulnerability in the protocol detection component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower… |
CVE-2019-1877 | Medium | 6.5 | 2019-11-05 | A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sess… |
CVE-2019-18661 | High | 7.5 | 2019-11-02 | Fastweb FASTGate 1.0.1b devices allow partial authentication bypass by changing a certain check_pwd return value from 0 to 1. An attack does not achieve admini… |
CVE-2018-4064 | High | 7.1 | 2019-10-31 | An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A speciall… |
CVE-2013-1391 | High | 7.5 | 2019-10-30 | Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remot… |
CVE-2016-2359 | Critical | 9.8 | 2019-10-25 | Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultaneously making a req… |
CVE-2019-17627 | Medium | 6.5 | 2019-10-16 | The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy (BLE) traffic during one authorized u… |
CVE-2019-14510 | Medium | 6.7 | 2019-10-11 | An issue was discovered in Kaseya VSA RMM through 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local account FSAdminxxxxxxxx… |
CVE-2019-9531 | Critical | 9.8 | 2019-10-10 | The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated… |
CVE-2019-17372 | High | 8.1 | 2019-10-09 | Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for ex… |
CVE-2019-17134 | Critical | 9.1 | 2019-10-08 | Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certif… |
CVE-2019-16929 | High | 7.5 | 2019-10-08 | Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens. |
CVE-2019-13336 | Critical | 9.8 | 2019-10-08 | The dbell Wi-Fi Smart Video Doorbell DB01-S Gen 1 allows remote attackers to launch commands with no authentication verification via TCP port 81, because the l… |
CVE-2019-11733 | Critical | 9.8 | 2019-09-27 | When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that local… |
CVE-2019-12664 | High | 7.5 | 2019-09-25 | A vulnerability in the Dialer interface feature for ISDN connections in Cisco IOS XE Software for Cisco 4000 Series Integrated Services Routers (ISRs) could al… |
CVE-2019-14239 | Medium | 6.6 | 2019-09-24 | On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeat… |
CVE-2019-14238 | Medium | 6.6 | 2019-09-24 | On STMicroelectronics STM32F7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated with a debug probe via th… |
CVE-2019-16649 | Critical | 10.0 | 2019-09-21 | On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of… |
CVE-2019-6832 | High | 8.3 | 2019-09-17 | A CWE-287: Authentication vulnerability exists in spaceLYnk (all versions before 2.4.0) and Wiser for KNX (all versions before 2.4.0 - formerly known as homeLY… |
CVE-2016-10983 | Medium | 6.5 | 2019-09-17 | The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data. |
CVE-2019-16261 | Critical | 9.1 | 2019-09-12 | Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the ma… |
CVE-2019-16250 | High | 7.5 | 2019-09-11 | includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Shee… |
CVE-2019-16190 | Critical | 9.8 | 2019-09-09 | SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 devices allows Authentication Bypass, as… |
CVE-2019-5473 | High | 7.2 | 2019-09-09 | An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4. |
CVE-2019-12405 | Critical | 9.8 | 2019-09-09 | Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Given a u… |
CVE-2019-13188 | Critical | 9.8 | 2019-09-05 | In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application. |
CVE-2019-13361 | Medium | 6.5 | 2019-09-05 | Smanos W100 1.0.0 devices have Insecure Permissions, exploitable by an attacker on the same Wi-Fi network. |
CVE-2019-13190 | Medium | 5.3 | 2019-09-05 | In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup page. |
CVE-2019-13526 | High | 8.8 | 2019-08-30 | Datalogic AV7000 Linear barcode scanner all versions prior to 4.6.0.0 is vulnerable to authentication bypass, which may allow an attacker to remotely execute a… |
CVE-2019-11064 | Critical | 9.8 | 2019-08-29 | A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is… |
CVE-2019-12643 | Critical | 10.0 | 2019-08-28 | A vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass authenticat… |
CVE-2019-15648 | Medium | 6.5 | 2019-08-27 | The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber. |
CVE-2019-13423 | High | 8.8 | 2019-08-23 | Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user wh… |
CVE-2014-10389 | Critical | 9.8 | 2019-08-22 | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication. |
CVE-2019-1974 | Critical | 9.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Ex… |
CVE-2019-1938 | Critical | 9.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote… |
CVE-2019-1937 | Critical | 9.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Ex… |
CVE-2019-6143 | Critical | 9.1 | 2019-08-20 | Forcepoint Next Generation Firewall (Forcepoint NGFW) 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has a serious authentication vulnerability… |
CVE-2019-11187 | Critical | 9.8 | 2019-08-15 | Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-in… |
CVE-2018-14008 | Medium | 6.5 | 2019-08-15 | Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled. |
CVE-2019-15046 | High | 7.5 | 2019-08-14 | Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-7998… |
CVE-2019-5223 | High | 7.8 | 2019-08-13 | PCManager 9.1.3.1 has an improper authentication vulnerability. The certain driver interface of the software does not perform a validation of user-mode data pr… |
CVE-2019-14985 | Critical | 9.8 | 2019-08-13 | eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because t… |
CVE-2018-20954 | High | 7.5 | 2019-08-08 | The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys. |
CVE-2019-1946 | Medium | 6.5 | 2019-08-08 | A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker t… |
CVE-2019-14432 | High | 8.8 | 2019-08-07 | Incorrect authentication of application WebSocket connections in Loom Desktop for Mac up to 0.16.0 allows remote code execution from either malicious JavaScrip… |
CVE-2019-14705 | High | 7.2 | 2019-08-06 | An Incorrect Access Control issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5 because any valid cookie can be used to make… |
CVE-2019-5679 | High | 7.8 | 2019-08-06 | NVIDIA Shield TV Experience prior to v8.0, NVIDIA Tegra bootloader contains a vulnerability in nvtboot where the Trusted OS image is improperly authenticated… |
CVE-2019-7163 | Critical | 9.8 | 2019-08-02 | The web interface of Alcatel LINKZONE MW40-V-V1.0 MW40_LU_02.00_02 devices is vulnerable to an authentication bypass that allows an unauthenticated user to hav… |
CVE-2018-1987 | High | 7.8 | 2019-08-02 | IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect node password may be displayed in plain te… |
CVE-2016-10826 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93). |
CVE-2018-20937 | Medium | 4.3 | 2019-08-01 | cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321). |
CVE-2016-10835 | Medium | 4.3 | 2019-08-01 | cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107). |
CVE-2016-10833 | High | 7.5 | 2019-08-01 | cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104). |
CVE-2016-10832 | Medium | 6.5 | 2019-08-01 | cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102). |
CVE-2016-10831 | High | 7.2 | 2019-08-01 | cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101). |
CVE-2018-20924 | Medium | 5.5 | 2019-08-01 | cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads (SEC-378). |
CVE-2016-10836 | Medium | 6.5 | 2019-08-01 | cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108). |
CVE-2019-3884 | Medium | 5.4 | 2019-08-01 | A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from another namespace is abl… |
CVE-2018-20888 | Medium | 5.5 | 2019-08-01 | cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authentication (SEC-424). |
CVE-2019-5455 | Medium | 6.8 | 2019-07-30 | Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process. |
CVE-2019-5453 | Medium | 6.1 | 2019-07-30 | Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to… |
CVE-2019-5449 | Medium | 4.3 | 2019-07-30 | A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events. |
CVE-2019-11202 | Critical | 9.8 | 2019-07-30 | An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher s… |
CVE-2018-17213 | High | 8.8 | 2019-07-29 | An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. A user without valid credentials can bypass the authentication process, obtain… |
CVE-2019-1020018 | High | 7.3 | 2019-07-29 | Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link. |
CVE-2018-13927 | High | 7.8 | 2019-07-22 | Debug policy with invalid signature can be loaded when the debug policy functionality is disabled by using the parallel image loading in Snapdragon Auto, Snapd… |
CVE-2015-7882 | High | 8.1 | 2019-07-19 | Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access. |
CVE-2019-1917 | Critical | 9.1 | 2019-07-17 | A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on… |
CVE-2018-18095 | Medium | 6.8 | 2019-07-11 | Improper authentication in firmware for Intel(R) SSD DC S4500 Series and Intel(R) SSD DC S4600 Series before SCV10150 may allow an unprivileged user to potenti… |
CVE-2019-10966 | Medium | 5.3 | 2019-07-10 | In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected via an added unsecured terminal server to a TCP/IP… |
CVE-2019-9629 | Critical | 9.8 | 2019-07-08 | Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials). |
CVE-2019-13372 | Critical | 9.8 | 2019-07-06 | /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via… |
CVE-2019-5964 | High | 8.8 | 2019-07-05 | iDoors Reader 2.10.17 and earlier allows an attacker on the same network segment to bypass authentication to access the management console and operate the prod… |