CWE-287 · Improper Authentication (page 31)
Page 31 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-14158 | Critical | 9.1 | 2020-07-30 | The ABUS Secvest FUMO50110 hybrid module does not have any security mechanism that ensures confidentiality or integrity of RF packets that are exchanged with a… |
CVE-2020-8206 | High | 8.1 | 2020-07-30 | An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bypass the Google TO… |
CVE-2019-20033 | Critical | 9.8 | 2020-07-29 | On Aspire-derived NEC PBXes, including all versions of SV8100 devices, a set of documented, static login credentials may be used to access the DIM interface. |
CVE-2019-20027 | Critical | 9.8 | 2020-07-29 | Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if incorrectly configure… |
CVE-2020-16088 | Critical | 9.8 | 2020-07-28 | iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches. |
CVE-2020-9077 | Low | 3.3 | 2020-07-27 | HUAWEI P30 smart phones with versions earlier than 10.1.0.160(C00E160R2P11) have an information exposure vulnerability. The system does not properly authentica… |
CVE-2020-12812 | Critical | 9.8 | 2020-07-24 | An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully wi… |
CVE-2020-8207 | High | 8.8 | 2020-07-24 | Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the automatic updater servi… |
CVE-2020-15921 | Critical | 9.8 | 2020-07-24 | Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execu… |
CVE-2020-12638 | Medium | 6.8 | 2020-07-23 | An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices throu… |
CVE-2020-10918 | High | 7.5 | 2020-07-23 | This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Auth… |
CVE-2020-15896 | High | 7.5 | 2020-07-22 | An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directly accessible by any… |
CVE-2020-6871 | Critical | 9.8 | 2020-07-20 | The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of the server and execute… |
CVE-2020-14494 | Critical | 9.8 | 2020-07-20 | OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect agains… |
CVE-2020-14485 | Critical | 9.8 | 2020-07-20 | OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with lim… |
CVE-2020-9259 | Medium | 6.5 | 2020-07-17 | Huawei Honor V30 smartphones with versions earlier than 10.1.0.212(C00E210R5P1) have an improper authentication vulnerability. The system does not sufficiently… |
CVE-2020-3388 | High | 7.8 | 2020-07-16 | A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with ro… |
CVE-2020-3197 | Medium | 5.3 | 2020-07-16 | A vulnerability in the API subsystem of Cisco Meetings App could allow an unauthenticated, remote attacker to retain and reuse the Traversal Using Relay NAT (T… |
CVE-2020-3144 | Critical | 9.8 | 2020-07-16 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Router, RV130W Wireless-N Multifunction VPN Router… |
CVE-2020-15027 | Critical | 9.8 | 2020-07-16 | ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts. This… |
CVE-2020-10288 | Critical | 9.8 | 2020-07-15 | IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you can input whatever… |
CVE-2020-8196 | Medium | 4.3 | 2020-07-10 | Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP… |
CVE-2020-8193 | Medium | 6.5 | 2020-07-10 | Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP… |
CVE-2020-1838 | Medium | 5.5 | 2020-07-06 | HUAWEI Mate 30 Pro with versions earlier than 10.1.0.150(C00E136R5P3) have is an improper authentication vulnerability. The device does not sufficiently valida… |
CVE-2020-4074 | High | 8.9 | 2020-07-02 | In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute adm… |
CVE-2020-3297 | Critical | 9.8 | 2020-07-02 | A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote att… |
CVE-2020-14070 | Critical | 9.8 | 2020-06-29 | An issue was discovered in MK-AUTH 19.01. There is authentication bypass in the web login functionality because guessable credentials to admin/executar_login.p… |
CVE-2020-12035 | Medium | 4.9 | 2020-06-29 | Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The PrismaFlex device contains a hard-coded service password that provides access to biomedi… |
CVE-2019-18252 | Medium | 4.3 | 2020-06-29 | BIOTRONIK CardioMessenger II, The affected products allow credential reuse for multiple authentication purposes. An attacker with adjacent access to the Cardio… |
CVE-2019-18246 | Medium | 4.3 | 2020-06-29 | BIOTRONIK CardioMessenger II, The affected products do not properly enforce mutual authentication with the BIOTRONIK Remote Communication infrastructure. |
CVE-2019-20412 | Medium | 5.3 | 2020-06-29 | The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information… |
CVE-2020-14477 | Low | 3.6 | 2020-06-26 | In Philips Ultrasound ClearVue Versions 3.2 and prior, Ultrasound CX Versions 5.0.2 and prior, Ultrasound EPIQ/Affiniti Versions VM5.0 and prior, Ultrasound Sp… |
CVE-2020-10278 | Medium | 4.6 | 2020-06-24 | The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order. This can be leveraged… |
CVE-2017-18919 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation. |
CVE-2017-18908 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address. |
CVE-2017-18906 | High | 8.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's accou… |
CVE-2016-11074 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused. |
CVE-2016-11072 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled. |
CVE-2019-20879 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not require credential re-entry. |
CVE-2019-20875 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proceed while an e-mail address is being cha… |
CVE-2018-21263 | High | 8.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML re… |
CVE-2020-14455 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.4.0. Prompting for HTTP Basic Authentication is mishandled, allowing phishing, aka MMSA-2020-0007. |
CVE-2020-3361 | High | 8.1 | 2020-06-18 | A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to gain unauthorized access to a vulner… |
CVE-2018-21246 | Critical | 9.8 | 2020-06-15 | Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode. |
CVE-2020-9076 | Medium | 6.8 | 2020-06-15 | HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B smartphones with versions earlier than 10.1.0.135(C00E135R2P11); versions earlier than 10.1.0.135(C00E135R2P8), versions e… |
CVE-2020-4494 | High | 7.5 | 2020-06-15 | IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 thr… |
CVE-2020-10754 | Medium | 4.3 | 2020-06-08 | It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when creating a new profi… |
CVE-2020-9099 | Critical | 9.8 | 2020-06-08 | Huawei products IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospace USG6300; Secospace USG6500; Secospace USG6600; USG9500 with versions of V500R001C… |
CVE-2020-12848 | Medium | 5.4 | 2020-06-05 | In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backen… |
CVE-2019-20833 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.10. It has mishandling of cloud credentials, as demonstrated by Google Drive. |
CVE-2018-21235 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit E-mail advertising system before September 2018. It allows authentication bypass and information disclosure, related to Inters… |
CVE-2020-3216 | Medium | 6.8 | 2020-06-03 | A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, physical attacker to bypass authentication and gain unrestricted access to the… |
CVE-2020-1833 | Low | 2.4 | 2020-05-29 | Honor 9X smartphones with versions earlier than 9.1.1.172(C00E170R8P1) have an improper authentication vulnerability. A logic error occurs when handling clock… |
CVE-2020-1798 | Medium | 4.6 | 2020-05-29 | HUAWEI P30 smartphones with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. A logic error occurs when handling NF… |
CVE-2020-8606 | Critical | 9.8 | 2020-05-27 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Tr… |
CVE-2020-6091 | Critical | 9.1 | 2020-05-22 | An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303… |
CVE-2020-11551 | High | 8.8 | 2020-05-18 | An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-B… |
CVE-2020-9073 | Low | 2.4 | 2020-05-15 | Huawei P20 smartphones with versions earlier than 10.0.0.156(C00E156R1P4) have an improper authentication vulnerability. The vulnerability is due to that when… |
CVE-2020-12874 | Critical | 9.8 | 2020-05-14 | Veritas APTARE versions prior to 10.4 included code that bypassed the normal login process when specific authentication credentials were provided to the server. |
CVE-2020-2018 | Critical | 9.0 | 2020-05-13 | An authentication bypass vulnerability in the Panorama context switching feature allows an attacker with network access to a Panorama's management interface to… |
CVE-2020-1718 | High | 7.1 | 2020-05-12 | A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the applicatio… |
CVE-2020-10916 | High | 8.0 | 2020-05-07 | This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of TP-Link TL-WA855RE Firmware Ver: 855rev4-up-ver1-0-1-P… |
CVE-2020-4427 | Critical | 9.8 | 2020-05-07 | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML auth… |
CVE-2020-3125 | Critical | 9.8 | 2020-05-06 | A vulnerability in the Kerberos authentication feature of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to i… |
CVE-2020-5727 | Medium | 4.6 | 2020-05-02 | Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to pair a rogue keypad to an a… |
CVE-2020-11020 | High | 8.5 | 2020-04-29 | Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vul… |
CVE-2016-11057 | High | 7.5 | 2020-04-28 | Certain NETGEAR devices are affected by mishandling of repeated URL calls. This affects JNR1010v2 before 2017-01-06, WNR614 before 2017-01-06, WNR618 before 20… |
CVE-2017-18862 | Medium | 6.5 | 2020-04-28 | Certain NETGEAR devices are affected by authentication bypass. This affects JGS516PE before 2017-05-11, JGS524Ev2 before 2017-05-11, JGS524PE before 2017-05-11… |
CVE-2020-5567 | High | 7.5 | 2020-04-28 | Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in Application Menu. |
CVE-2020-5563 | Medium | 5.3 | 2020-04-28 | Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in the affected product via the API. |
CVE-2020-9294 | Critical | 9.8 | 2020-04-27 | An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthentica… |
CVE-2020-9068 | Critical | 9.8 | 2020-04-27 | Huawei AR3200 products with versions of V200R007C00SPC900, V200R007C00SPCa00, V200R007C00SPCb00, V200R007C00SPCc00, V200R009C00SPC500 have an improper authenti… |
CVE-2019-18823 | Critical | 9.8 | 2020-04-27 | HTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect Access Control. It is possible to use a different authentication me… |
CVE-2017-18720 | High | 8.8 | 2020-04-24 | Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2… |
CVE-2017-18733 | High | 8.8 | 2020-04-23 | Certain NETGEAR devices are affected by authentication bypass. This affects D6220 before 1.0.0.28, D6400 before 1.0.0.60, D8500 before 1.0.3.29, R6250 before 1… |
CVE-2017-18732 | High | 8.8 | 2020-04-23 | Certain NETGEAR devices are affected by authentication bypass. This affects R6300v2 before 1.0.4.8, PLW1000v2 before 1.0.0.14, and PLW1010v2 before 1.0.0.14. |
CVE-2017-18743 | High | 8.8 | 2020-04-23 | Certain NETGEAR devices are affected by authentication bypass. This affects R6300v2 before 1.0.4.8, R6400 before 1.0.1.20, R6700 before 1.0.1.20, R6900 before… |
CVE-2018-21128 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by authentication bypass. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17. |
CVE-2018-21125 | High | 8.8 | 2020-04-22 | NETGEAR WAC510 devices before 5.0.0.17 are affected by authentication bypass. |
CVE-2018-21121 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by authentication bypass. This affects GS810EMX before 1.0.0.5, XS512EM before 1.0.0.6, and XS724EM before 1.0.0.6. |
CVE-2018-21118 | High | 8.8 | 2020-04-22 | NETGEAR XR500 devices before 2.3.2.32 are affected by authentication bypass. |
CVE-2019-19104 | Critical | 9.1 | 2020-04-22 | The web server in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows access to different endpoints of the application without authe… |
CVE-2017-18776 | High | 8.4 | 2020-04-22 | Certain NETGEAR devices are affected by authentication bypass. This affects D6100 before V1.0.0.55, D7000 before V1.0.1.50, D7800 before V1.0.1.24, JNR1010v2 b… |
CVE-2017-18772 | High | 8.8 | 2020-04-22 | Certain NETGEAR devices are affected by authentication bypass. This affects EX3700 before 1.0.0.64, EX3800 before 1.0.0.64, EX6120 before 1.0.0.32, EX6130 befo… |
CVE-2020-11796 | Critical | 9.8 | 2020-04-22 | In JetBrains Space through 2020-04-22, the password authentication implementation was insecure. |
CVE-2020-5268 | Medium | 6.5 | 2020-04-21 | In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some c… |
CVE-2020-11965 | Critical | 9.8 | 2020-04-21 | In IQrouter through 3.3.1, there is a root user without a password, which allows attackers to gain full remote access via SSH. Note: The vendor claims that thi… |
CVE-2020-11964 | High | 7.5 | 2020-04-21 | In IQrouter through 3.3.1, the Lua function diag_set_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendo… |
CVE-2020-9277 | Critical | 9.8 | 2020-04-20 | An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administ… |
CVE-2020-9070 | Medium | 5.5 | 2020-04-20 | Huawei smartphones Taurus-AL00B with versions earlier than 10.0.0.205(C00E201R7P2) have an improper authentication vulnerability. The software insufficiently v… |
CVE-2020-1803 | Medium | 5.3 | 2020-04-20 | Huawei smartphones Honor V20 with versions earlier than 10.0.0.179(C636E3R4P3),versions earlier than 10.0.0.180(C185E3R3P3),versions earlier than 10.0.0.180(C4… |
CVE-2017-18850 | High | 8.4 | 2020-04-20 | Certain NETGEAR devices are affected by authentication bypass. This affects D6220 before 1.0.0.26, D6400 before 1.0.0.60, D8500 before 1.0.3.29, R6250 before 1… |
CVE-2019-20786 | Critical | 9.8 | 2020-04-19 | handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary un… |
CVE-2020-7276 | Medium | 6.4 | 2020-04-15 | Authentication bypass vulnerability in MfeUpgradeTool in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update allows administrator user… |
CVE-2020-8148 | Medium | 5.3 | 2020-04-13 | UniFi Cloud Key firmware < 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request. T… |
CVE-2020-1801 | Medium | 5.5 | 2020-04-10 | There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller's… |
CVE-2020-8828 | High | 8.8 | 2020-04-08 | As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for… |
CVE-2020-1637 | High | 7.2 | 2020-04-08 | A vulnerability in Juniper Networks SRX Series device configured as a Junos OS Enforcer device may allow a user to access network resources that are not permit… |
CVE-2020-1618 | Medium | 6.3 | 2020-04-08 | On Juniper Networks EX and QFX Series, an authentication bypass vulnerability may allow a user connected to the console port to login as root without any passw… |
CVE-2018-21062 | Medium | 4.6 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. When biometric authentication is disabled, an attacker can view Streams cont… |