CWE-287 · Improper Authentication (page 31)
Page 31 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12845 | Medium | 5.3 | 2019-07-03 | The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3. |
CVE-2018-11426 | Critical | 9.8 | 2019-07-03 | A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker can brute force param… |
CVE-2017-8405 | High | 7.5 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by th… |
CVE-2019-7666 | High | 8.8 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash value of the password, which may allow an a… |
CVE-2019-10964 | High | 7.1 | 2019-06-28 | Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters… |
CVE-2018-14868 | Medium | 6.5 | 2019-06-28 | Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of o… |
CVE-2018-15556 | Critical | 9.8 | 2019-06-27 | The Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 allows login with root level access with the user "root" and an empty password by using th… |
CVE-2019-7226 | High | 8.8 | 2019-06-27 | The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to privileged functions… |
CVE-2019-11272 | High | 7.3 | 2019-06-26 | Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application usi… |
CVE-2019-10689 | Medium | 6.5 | 2019-06-24 | VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides in… |
CVE-2019-2018 | High | 8.8 | 2019-06-19 | In resetPasswordInternal of DevicePolicyManagerService.java, there is a possible bypass of password reset protection due to an unusual root cause. Remote user… |
CVE-2019-11232 | Critical | 9.8 | 2019-06-19 | EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information (Password) without being authenticated, by sending an EMP_NO element to the kw… |
CVE-2018-18877 | High | 8.8 | 2019-06-18 | In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alternative configuration page config_main.php that al… |
CVE-2019-10998 | Medium | 6.8 | 2019-06-18 | An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LTS devices. Unlimite… |
CVE-2017-9389 | High | 8.8 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device… |
CVE-2017-9383 | Critical | 9.9 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be… |
CVE-2019-7579 | High | 7.5 | 2019-06-17 | An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. An ability exists for an unauthenticated user to browse a confidential ui/1.0.99.187766/dyn… |
CVE-2019-10157 | Medium | 4.7 | 2019-06-12 | It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An… |
CVE-2019-10150 | Medium | 5.9 | 2019-06-12 | It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. A… |
CVE-2018-19999 | High | 7.8 | 2019-06-07 | The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the… |
CVE-2019-1842 | Medium | 5.4 | 2019-06-05 | A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated, remote attacker to successfully log in… |
CVE-2018-7123 | High | 7.5 | 2019-06-05 | A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2018-7121 | Critical | 9.8 | 2019-06-05 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2018-18571 | Critical | 9.1 | 2019-06-05 | An Incorrect Access Control vulnerability has been identified in Citrix XenMobile Server 10.8.0 before Rolling Patch 6 and 10.9.0 before Rolling Patch 3. An at… |
CVE-2019-5298 | Medium | 6.8 | 2019-06-04 | There is an improper authentication vulnerability in some Huawei AP products before version V200R009C00SPC800. Due to the improper implementation of authentica… |
CVE-2019-12564 | Critical | 9.8 | 2019-06-03 | In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backup/DyyyymmddThhmmss… |
CVE-2019-12530 | Critical | 9.8 | 2019-06-02 | Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and… |
CVE-2019-12440 | Critical | 9.8 | 2019-05-29 | The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard… |
CVE-2019-12395 | Medium | 5.3 | 2019-05-28 | In Webbukkit Dynmap 3.0-beta-3 or below, due to a missing login check in servlet/MapStorageHandler.java, an attacker can see a map image without login even if… |
CVE-2018-12013 | High | 7.8 | 2019-05-24 | Improper authentication in locked memory region can lead to unprivilged access to the memory in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electr… |
CVE-2018-11271 | Critical | 9.8 | 2019-05-24 | Improper authentication can happen on Remote command handling due to inappropriate handling of events in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec… |
CVE-2019-12300 | Critical | 9.8 | 2019-05-23 | Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a tok… |
CVE-2019-6814 | Critical | 9.8 | 2019-05-22 | A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impact to confidentiali… |
CVE-2018-7847 | Critical | 9.8 | 2019-05-22 | A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cau… |
CVE-2019-8443 | High | 8.1 | 2019-05-22 | The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote att… |
CVE-2019-10911 | High | 7.5 | 2019-05-16 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authent… |
CVE-2019-8978 | High | 8.1 | 2019-05-14 | An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web Tailor 8.8.3, 8.8.4, and 8.9 and Banner E… |
CVE-2019-7218 | Medium | 5.9 | 2019-05-13 | Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's o… |
CVE-2019-1867 | Critical | 10.0 | 2019-05-10 | A vulnerability in the REST API of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to bypass authentication on the REST… |
CVE-2017-12778 | High | 7.1 | 2019-05-09 | The UI Lock feature in qBittorrent version 3.3.15 is vulnerable to Authentication Bypass, which allows Attack to gain unauthorized access to qBittorrent functi… |
CVE-2018-13990 | High | 8.6 | 2019-05-06 | The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1.35 is vulnerable to brute-force attacks, because of Improper Restriction of Excessi… |
CVE-2019-1724 | High | 8.8 | 2019-05-03 | A vulnerability in the session management functionality of the web-based interface for Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could… |
CVE-2019-3927 | Critical | 9.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 anyone can change the administrator and moderator passwords via the iso.3.6.1.4.1.3212.1… |
CVE-2019-11576 | Critical | 9.8 | 2019-04-28 | Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the… |
CVE-2019-11488 | High | 8.1 | 2019-04-25 | Incorrect Access Control in the Account Access / Password Reset Link in SimplyBook.me Enterprise before 2019-04-23 allows Unauthorized Attackers to READ/WRITE… |
CVE-2018-16219 | High | 8.8 | 2019-04-25 | A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker (in the same network as the… |
CVE-2019-11081 | Critical | 9.8 | 2019-04-24 | A default username and password in Dentsply Sirona Sidexis 4.3.1 and earlier allows an attacker to gain administrative access to the application server. |
CVE-2018-1317 | High | 8.8 | 2019-04-23 | In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication. |
CVE-2019-11234 | Critical | 9.8 | 2019-04-22 | FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497. |
CVE-2019-11015 | Medium | 6.8 | 2019-04-18 | A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authentication via the Wallpap… |
CVE-2018-16877 | High | 7.8 | 2019-04-18 | A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this fla… |
CVE-2018-0382 | Medium | 5.3 | 2019-04-17 | A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow a… |
CVE-2019-10643 | Critical | 9.8 | 2019-04-17 | Contao 4.7 allows Use of a Key Past its Expiration Date. |
CVE-2018-7340 | High | 7.5 | 2019-04-17 | Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be… |
CVE-2019-9499 | High | 8.1 | 2019-04-17 | The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validat… |
CVE-2019-9498 | High | 8.1 | 2019-04-17 | The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the… |
CVE-2019-9497 | High | 8.1 | 2019-04-17 | The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerab… |
CVE-2019-9496 | High | 7.5 | 2019-04-17 | An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm messag… |
CVE-2019-3798 | Medium | 6.0 | 2019-04-17 | Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated… |
CVE-2017-11430 | High | 7.7 | 2019-04-17 | OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may… |
CVE-2017-11429 | High | 7.7 | 2019-04-17 | Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able t… |
CVE-2017-11428 | High | 7.7 | 2019-04-17 | OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be a… |
CVE-2017-11427 | High | 7.7 | 2019-04-17 | OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be… |
CVE-2019-0282 | Medium | 5.3 | 2019-04-10 | Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without use… |
CVE-2019-5426 | Medium | 4.8 | 2019-04-10 | In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwarding" (SOCKS proxy) fun… |
CVE-2019-8990 | High | 8.1 | 2019-04-09 | The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP… |
CVE-2019-11018 | Critical | 9.8 | 2019-04-08 | application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change. |
CVE-2017-7912 | Critical | 9.8 | 2019-04-08 | Hanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000_v2.16_170401, A specially crafted http request and response could allow an attacker to gai… |
CVE-2019-10884 | High | 8.8 | 2019-04-05 | Uniqkey Password Manager 1.14 contains a vulnerability because it fails to recognize the difference between domains and sub-domains. The vulnerability means th… |
CVE-2019-10273 | Medium | 4.3 | 2019-04-04 | Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due… |
CVE-2017-6049 | High | 7.5 | 2019-04-02 | Detcon Sitewatch Gateway, all versions without cellular, an attacker can edit settings on the device using a specially crafted URL. |
CVE-2017-6047 | Critical | 9.8 | 2019-04-02 | Detcon Sitewatch Gateway, all versions without cellular, Passwords are presented in plaintext in a file that is accessible without authentication. |
CVE-2017-8023 | Critical | 9.8 | 2019-04-01 | EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the Networker Client execution service (nsrexecd) when… |
CVE-2019-5890 | High | 8.8 | 2019-04-01 | An issue was discovered in OverIT Geocall 6.3 before build 2:346977. Weak authentication and session management allows an authenticated user to obtain access t… |
CVE-2019-10661 | Critical | 9.8 | 2019-03-30 | On Grandstream GXV3611IR_HD before 1.0.3.23 devices, the root account lacks a password. |
CVE-2019-6481 | High | 7.5 | 2019-03-29 | Abine Blur 7.8.2431 allows remote attackers to conduct "Second-Factor Auth Bypass" attacks by using the "Perform a right-click operation to access a forgotten… |
CVE-2017-18106 | High | 7.5 | 2019-03-29 | The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in… |
CVE-2019-1759 | Medium | 5.3 | 2019-03-28 | A vulnerability in access control list (ACL) functionality of the Gigabit Ethernet Management interface of Cisco IOS XE Software could allow an unauthenticated… |
CVE-2019-1758 | Medium | 4.7 | 2019-03-28 | A vulnerability in 802.1x function of Cisco IOS Software on the Catalyst 6500 Series Switches could allow an unauthenticated, adjacent attacker to access the n… |
CVE-2018-12551 | High | 8.1 | 2019-03-27 | When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will b… |
CVE-2019-3878 | High | 8.1 | 2019-03-26 | A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through a… |
CVE-2014-5432 | Critical | 9.8 | 2019-03-26 | Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 is remotely accessible via Port 22/SSH withou… |
CVE-2019-6441 | Critical | 9.8 | 2019-03-21 | An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices. The password reset… |
CVE-2018-19783 | Critical | 9.8 | 2019-03-21 | Kentix MultiSensor-LAN 5.63.00 devices and previous allow Authentication Bypass via an Alternate Path or Channel. |
CVE-2017-2659 | Medium | 5.3 | 2019-03-21 | It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI a… |
CVE-2018-19392 | Critical | 9.8 | 2019-03-15 | Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modification of any user accou… |
CVE-2018-18256 | High | 7.8 | 2019-03-15 | An issue was discovered in CapMon Access Manager 5.4.1.1005. A regular user can obtain local administrator privileges if they run any whitelisted application t… |
CVE-2018-18255 | High | 7.8 | 2019-03-15 | An issue was discovered in CapMon Access Manager 5.4.1.1005. The client applications of AccessManagerCoreService.exe communicate with this server through named… |
CVE-2018-12192 | Medium | 6.8 | 2019-03-14 | Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before version SPS_E5_0… |
CVE-2019-3775 | High | 7.1 | 2019-03-07 | Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by ch… |
CVE-2018-12399 | Medium | 4.3 | 2019-02-28 | When a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about which domain is registering the new protoc… |
CVE-2019-7392 | Critical | 9.1 | 2019-02-26 | An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gain sensitive informa… |
CVE-2019-9124 | Critical | 9.8 | 2019-02-25 | An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank password. |
CVE-2019-1666 | Medium | 5.3 | 2019-02-21 | A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service… |
CVE-2019-1664 | High | 7.8 | 2019-02-21 | A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluste… |
CVE-2019-1662 | High | 8.2 | 2019-02-21 | A vulnerability in the Quality of Voice Reporting (QOVR) service of Cisco Prime Collaboration Assurance (PCA) Software could allow an unauthenticated, remote a… |
CVE-2019-5909 | Critical | 9.8 | 2019-02-13 | License Manager Service of YOKOGAWA products (CENTUM VP (R5.01.00 - R6.06.00), CENTUM VP Entry Class (R5.01.00 - R6.06.00), ProSafe-RS (R3.01.00 - R4.04.00), P… |
CVE-2018-19645 | Critical | 9.8 | 2019-02-12 | An Authentication Bypass issue exists in Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. |
CVE-2019-6527 | Critical | 9.8 | 2019-02-12 | PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) may allow an attacker to be able to change the password for an admin user… |
CVE-2019-3825 | Medium | 6.3 | 2019-02-06 | A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the ti… |