CWE-287 · Improper Authentication (page 30)
Page 30 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26236 | High | 7.5 | 2020-11-20 | In ScratchVerifier before commit a603769, an attacker can hijack the verification process to log into someone else's account on any site that uses ScratchVerif… |
CVE-2020-9049 | High | 7.1 | 2020-11-19 | A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on th… |
CVE-2019-20933 | Critical | 9.8 | 2020-11-19 | InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empt… |
CVE-2020-27558 | Medium | 6.5 | 2020-11-17 | Use of an undocumented user in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to view the video stream. |
CVE-2020-8272 | High | 7.5 | 2020-11-16 | Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8 |
CVE-2019-19562 | Medium | 4.6 | 2020-11-16 | An authentication bypass in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with physical access to device hardware to obtain system informa… |
CVE-2019-19560 | Medium | 4.6 | 2020-11-16 | An authentication bypass in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with physical access to device hardware to obtain system informa… |
CVE-2020-28638 | Critical | 9.8 | 2020-11-13 | ask_password in Tomb 2.0 through 2.7 returns a warning when pinentry-curses is used and $DISPLAY is non-empty, causing affected users' files to be encrypted wi… |
CVE-2020-25165 | High | 7.5 | 2020-11-13 | BD Alaris PC Unit, Model 8015, Versions 9.33.1 and earlier and BD Alaris Systems Manager, Versions 4.33 and earlier The affected products are vulnerable to a n… |
CVE-2020-2050 | High | 8.2 | 2020-11-12 | An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass al… |
CVE-2020-26168 | Critical | 9.8 | 2020-11-09 | The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly th… |
CVE-2020-26542 | Critical | 9.8 | 2020-11-09 | An issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server when using the SimpleLDAP authentication in conjunction with Mi… |
CVE-2020-23139 | Medium | 5.5 | 2020-11-09 | Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to… |
CVE-2020-26214 | Critical | 9.1 | 2020-11-06 | In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP a… |
CVE-2020-25592 | Critical | 9.8 | 2020-11-06 | In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH. |
CVE-2020-17510 | Critical | 9.8 | 2020-11-05 | Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. |
CVE-2020-8267 | Medium | 5.3 | 2020-11-05 | A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was using “x-token” improper… |
CVE-2020-12145 | Medium | 6.6 | 2020-11-05 | Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it po… |
CVE-2020-15949 | High | 7.5 | 2020-11-05 | Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover. |
CVE-2020-8236 | Medium | 6.8 | 2020-11-02 | A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the P… |
CVE-2020-28002 | Medium | 5.3 | 2020-11-02 | In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anony… |
CVE-2020-5425 | High | 7.9 | 2020-10-31 | Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation a… |
CVE-2020-7197 | Critical | 9.8 | 2020-10-26 | SSMC3.7.0.0 is vulnerable to remote authentication bypass. HPE StoreServ Management Console (SSMC) 3.7.0.0 is an off node multiarray manager web application an… |
CVE-2020-24848 | High | 7.8 | 2020-10-23 | FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege e… |
CVE-2020-3565 | Medium | 5.8 | 2020-10-21 | A vulnerability in the TCP Intercept functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass c… |
CVE-2020-3410 | High | 8.1 | 2020-10-21 | A vulnerability in the Common Access Card (CAC) authentication feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remo… |
CVE-2020-15240 | High | 7.4 | 2020-10-21 | omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method. Improper vali… |
CVE-2020-15269 | High | 7.4 | 2020-10-20 | In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3… |
CVE-2020-24629 | Critical | 9.8 | 2020-10-19 | A remote urlaccesscontroller authentication bypass vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E… |
CVE-2020-14299 | Medium | 6.5 | 2020-10-16 | A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain… |
CVE-2020-7591 | High | 8.8 | 2020-10-15 | A vulnerability has been identified in SIPORT MP (All versions < 3.2.1). Vulnerable versions of the device could allow an authenticated attacker to impersonate… |
CVE-2020-8350 | High | 8.8 | 2020-10-14 | An authentication bypass vulnerability was reported in Lenovo ThinkPad Stack Wireless Router firmware version 1.1.3.4 that could allow escalation of privilege. |
CVE-2020-9109 | Medium | 4.6 | 2020-10-12 | There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in cer… |
CVE-2020-4779 | High | 8.1 | 2020-10-12 | A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. By sending a specially-crafted request, an attacker could… |
CVE-2020-26921 | High | 8.3 | 2020-10-09 | Certain NETGEAR devices are affected by authentication bypass. This affects GS110EMX before 1.0.1.7, GS810EMX before 1.7.1.3, XS512EM before 1.0.1.3, and XS724… |
CVE-2020-15243 | Critical | 9.1 | 2020-10-08 | Affected versions of Smartstore have a missing WebApi Authentication attribute. This vulnerability affects Smartstore shops in version 4.0.0 & 4.0.1 which have… |
CVE-2020-10816 | High | 7.5 | 2020-10-08 | Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestProcessor servlet. |
CVE-2020-25867 | Medium | 5.3 | 2020-10-07 | SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings. It allows a bypass to get access without authentication. |
CVE-2020-12126 | Critical | 9.8 | 2020-10-02 | Multiple authentication bypass vulnerabilities in the /cgi-bin/ endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to leak router settings, c… |
CVE-2020-26511 | High | 7.5 | 2020-10-02 | The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass. |
CVE-2020-26160 | High | 7.5 | 2020-09-30 | jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specif… |
CVE-2018-11765 | High | 7.5 | 2020-09-30 | In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authen… |
CVE-2020-24563 | High | 7.8 | 2020-09-29 | A vulnerability in Trend Micro Apex One may allow a local attacker to manipulate the process of the security agent unload option (if configured), which then co… |
CVE-2020-26105 | Critical | 9.8 | 2020-09-25 | In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). |
CVE-2020-26101 | Critical | 9.8 | 2020-09-25 | In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). |
CVE-2020-15222 | High | 8.1 | 2020-09-24 | In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness o… |
CVE-2019-16028 | Critical | 9.8 | 2020-09-23 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to bypass auth… |
CVE-2019-15993 | Medium | 5.3 | 2020-09-23 | A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vuln… |
CVE-2020-8253 | High | 7.5 | 2020-09-18 | Improper authentication in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Cit… |
CVE-2020-8200 | Medium | 6.5 | 2020-09-18 | Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domain as a Ci… |
CVE-2020-7297 | Medium | 5.7 | 2020-09-16 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via i… |
CVE-2020-7296 | Medium | 5.7 | 2020-09-15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected configuration files… |
CVE-2020-7295 | Low | 3.5 | 2020-09-15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected log data… |
CVE-2020-7294 | Medium | 4.6 | 2020-09-15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected files vi… |
CVE-2020-7293 | Critical | 9.0 | 2020-09-15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user with low permissions to change the syste… |
CVE-2020-16098 | Critical | 9.8 | 2020-09-15 | It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8.20 prior to v8.20… |
CVE-2020-13303 | High | 7.1 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can acce… |
CVE-2020-15802 | Medium | 5.9 | 2020-09-11 | Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2… |
CVE-2020-16222 | High | 8.8 | 2020-09-11 | In Patient Information Center iX (PICiX) Version B.02, C.02, C.03, and PerformanceBridge Focal Point Version A.01, when an actor claims to have a given ident… |
CVE-2020-25251 | Critical | 9.1 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Cli… |
CVE-2020-15787 | Critical | 9.8 | 2020-09-09 | A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attemp… |
CVE-2020-7323 | Medium | 6.9 | 2020-09-09 | Authentication Protection Bypass vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows physical local users… |
CVE-2019-10562 | High | 7.8 | 2020-09-08 | u'Improper authentication and signature verification of debug polices in secure boot loader will allow unverified debug policies to be loaded into secure memor… |
CVE-2020-24987 | Critical | 9.8 | 2020-09-04 | Tenda AC18 Router through V15.03.05.05_EN and through V15.03.05.19(6318) CN devices could cause a remote code execution due to incorrect authentication handlin… |
CVE-2020-24029 | Critical | 9.8 | 2020-09-02 | Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request. NOTE… |
CVE-2020-5777 | Critical | 9.8 | 2020-09-01 | MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection… |
CVE-2020-24786 | Critical | 9.8 | 2020-08-31 | An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build n… |
CVE-2020-8097 | High | 8.1 | 2020-08-30 | An improper authentication vulnerability in Bitdefender Endpoint Security Tools for Windows and Bitdefender Endpoint Security SDK allows an unprivileged local… |
CVE-2020-15164 | Critical | 10.0 | 2020-08-28 | in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated unders… |
CVE-2020-15605 | High | 8.1 | 2020-08-27 | If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Vulnerability Protection 2.0 SP2 could allow an unauthenticated a… |
CVE-2020-15601 | High | 8.1 | 2020-08-27 | If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Deep Security 10.x-12.x could allow an unauthenticated attacker w… |
CVE-2020-4167 | Medium | 6.5 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 could allow an attacker to obtain sensitive information or perform unauthorized actions due to improper authenciation mech… |
CVE-2020-3151 | Medium | 6.7 | 2020-08-26 | A vulnerability in the CLI of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to bypass r… |
CVE-2020-15482 | High | 7.8 | 2020-08-26 | An issue was discovered on Nescomed Multipara Monitor M1000 devices. The device enables an unencrypted TELNET service by default, with a blank password for the… |
CVE-2020-16251 | High | 8.2 | 2020-08-26 | HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed… |
CVE-2020-24612 | Medium | 6.7 | 2020-08-24 | An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Conseq… |
CVE-2020-19888 | Medium | 5.9 | 2020-08-24 | DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\page.php for empty cache operation. This vuln… |
CVE-2020-10123 | Medium | 5.3 | 2020-08-21 | The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host… |
CVE-2020-16239 | Medium | 4.9 | 2020-08-21 | When an actor claims to have a given identity, Philips SureSigns VS4, A.07.107 and prior does not prove or insufficiently proves the claim is correct. |
CVE-2020-15149 | Critical | 9.9 | 2020-08-20 | NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a runn… |
CVE-2020-3411 | High | 7.5 | 2020-08-17 | A vulnerability in Cisco DNA Center software could allow an unauthenticated remote attacker access to sensitive information on an affected system. The vulnerab… |
CVE-2020-9233 | Critical | 9.1 | 2020-08-17 | FusionCompute 8.0.0 have an insufficient authentication vulnerability. An attacker may exploit the vulnerability to delete some files and cause some services a… |
CVE-2020-4662 | High | 8.8 | 2020-08-14 | IBM Event Streams 10.0.0 could allow an authenticated user to perform tasks to a schema due to improper authentication validation. IBM X-Force ID: 186233. |
CVE-2020-8685 | Medium | 4.4 | 2020-08-13 | Improper authentication in subsystem for Intel (R) LED Manager for NUC before version 1.2.3 may allow privileged user to potentially enable denial of service v… |
CVE-2020-8714 | High | 7.8 | 2020-08-13 | Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially… |
CVE-2020-8713 | High | 8.8 | 2020-08-13 | Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentiall… |
CVE-2020-8709 | High | 8.8 | 2020-08-13 | Improper authentication in socket services for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow an unauthenticated… |
CVE-2020-8708 | High | 8.8 | 2020-08-13 | Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentiall… |
CVE-2020-13290 | High | 7.5 | 2020-08-12 | In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page |
CVE-2020-13292 | Critical | 9.6 | 2020-08-10 | In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow. |
CVE-2020-15063 | High | 8.8 | 2020-08-07 | DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to bypass authentication via a web-administration req… |
CVE-2020-15059 | High | 8.8 | 2020-08-07 | Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration req… |
CVE-2020-15055 | High | 8.8 | 2020-08-07 | TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to bypass authentication via a web-administration req… |
CVE-2020-16169 | Critical | 9.8 | 2020-08-07 | Authentication Bypass Using an Alternate Path or Channel in temi Robox OS prior to120, temi Android app up to 1.3.7931 allows remote attackers to gain elevated… |
CVE-2020-15136 | Medium | 6.5 | 2020-08-06 | In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS au… |
CVE-2020-13365 | High | 8.8 | 2020-08-06 | Certain Zyxel products have a locally accessible binary that allows a non-root user to generate a password for an undocumented user account that can be used fo… |
CVE-2020-5608 | Critical | 9.8 | 2020-08-05 | CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R… |
CVE-2020-5616 | Critical | 9.8 | 2020-08-04 | [Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01] [Calendar01] free edition ver1.0.0, [Calenda… |
CVE-2020-8108 | High | 8.2 | 2020-08-03 | Improper Authentication vulnerability in Bitdefender Endpoint Security for Mac allows an unprivileged process to restart the main service and potentially injec… |
CVE-2020-5384 | High | 8.4 | 2020-07-31 | Authentication Bypass Vulnerability RSA MFA Agent 2.0 for Microsoft Windows contains an Authentication Bypass vulnerability. A local unauthenticated attacker c… |