CWE-287 · Improper Authentication (page 32)
Page 32 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3820 | Medium | 4.3 | 2019-02-06 | It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to… |
CVE-2019-6521 | High | 8.6 | 2019-02-05 | WebAccess/SCADA, Version 8.3. Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain and manipulate sen… |
CVE-2019-6519 | Critical | 9.8 | 2019-02-05 | WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload… |
CVE-2018-18505 | Critical | 10.0 | 2019-02-05 | An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server pa… |
CVE-2018-19000 | Medium | 5.3 | 2019-02-05 | LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sensitive data. |
CVE-2018-17928 | Medium | 6.5 | 2019-01-31 | The product CMS-770 (Software Versions 1.7.1 and prior)is vulnerable that an attacker can read sensitive configuration files by bypassing the user authenticati… |
CVE-2018-17926 | Medium | 4.3 | 2019-01-31 | The product M2M ETHERNET (FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior) is vulnerable in that an attacker can upload a malicious language file by… |
CVE-2018-17431 | Critical | 9.8 | 2019-01-30 | Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL. |
CVE-2018-1668 | Medium | 5.3 | 2019-01-29 | IBM DataPower Gateway 7.5.0.0 through 7.5.0.19, 7.5.1.0 through 7.5.1.18, 7.5.2.0 through 7.5.2.18, and 7.6.0.0 through 7.6.0.11 appliances allows "null" login… |
CVE-2018-19023 | High | 8.8 | 2019-01-25 | Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command… |
CVE-2019-3584 | High | 7.4 | 2019-01-23 | Exploitation of Authentication vulnerability in MVision Endpoint in McAfee MVision Endpoint Prior to 1811 Update 1 (18.11.31.62) allows authenticated administr… |
CVE-2018-20735 | High | 7.8 | 2019-01-17 | An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privi… |
CVE-2018-18814 | High | 8.8 | 2019-01-16 | The TIBCO Spotfire authentication component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains… |
CVE-2018-16886 | High | 8.1 | 2019-01-14 | etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and… |
CVE-2017-13889 | Critical | 9.8 | 2019-01-11 | In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, a logic error existed in the validation of crede… |
CVE-2018-5403 | High | 8.1 | 2019-01-10 | Imperva SecureSphere gateway (GW) running v13, for both pre-First Time Login or post-First Time Login (FTL), if the attacker knows the basic authentication pas… |
CVE-2018-0676 | High | 8.8 | 2019-01-09 | BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to bypass authentication to access to the management screen and exe… |
CVE-2018-0670 | Critical | 9.8 | 2019-01-09 | INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant traffic. This is a di… |
CVE-2018-0669 | Critical | 9.8 | 2019-01-09 | INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant traffic. This is a di… |
CVE-2018-20675 | Critical | 9.8 | 2019-01-09 | D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta, and DIR-880L A* bef… |
CVE-2019-0622 | Medium | 4.6 | 2019-01-08 | An elevation of privilege vulnerability exists when Skype for Andriod fails to properly handle specific authentication requests, aka "Skype for Android Elevati… |
CVE-2019-0543 | High | 7.8 | 2019-01-08 | An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerabi… |
CVE-2018-19249 | High | 7.5 | 2019-01-03 | The Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api.stripe.com /v1/tokens XMLHttpRequest data, parsing the respon… |
CVE-2018-19505 | Medium | 6.5 | 2019-01-03 | Remedy AR System Server in BMC Remedy 7.1 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the i… |
CVE-2018-19937 | Medium | 6.6 | 2018-12-31 | A local, authenticated attacker can bypass the passcode in the VideoLAN VLC media player app before 3.1.5 for iOS by opening a URL and turning the phone. |
CVE-2018-19616 | High | 8.1 | 2018-12-26 | An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/remove administrators because access contr… |
CVE-2018-17957 | Low | 3.4 | 2018-12-26 | The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing lo… |
CVE-2018-20422 | High | 8.1 | 2018-12-24 | Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-empty #wechat#common_member_wechatmp to… |
CVE-2018-20342 | Medium | 6.8 | 2018-12-21 | The Floureon IP Camera SP012 provides a root terminal on a UART serial interface without proper access control. This allows attackers with physical access to e… |
CVE-2018-15721 | Critical | 9.8 | 2018-12-20 | The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request. Remote attackers can use thi… |
CVE-2018-1778 | High | 7.7 | 2018-12-20 | IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken Model is exposed over… |
CVE-2018-17777 | Critical | 9.8 | 2018-12-18 | An issue was discovered on D-Link DVA-5592 A1_WI_20180823 devices. If the PIN of the page "/ui/cbpc/login" is the default Parental Control PIN (0000), it is po… |
CVE-2018-13804 | High | 8.1 | 2018-12-13 | A vulnerability has been identified in SIMATIC IT LMS (All versions), SIMATIC IT Production Suite (Versions V7.1 < V7.1 Upd3), SIMATIC IT UA Discrete Manufactu… |
CVE-2018-13816 | Critical | 10.0 | 2018-12-12 | A vulnerability has been identified in TIM 1531 IRC (All version < V2.0). The devices was missing proper authentication on port 102/tcp, although configured. S… |
CVE-2018-7067 | High | 7.2 | 2018-12-07 | A Remote Authentication bypass in Aruba ClearPass Policy Manager leads to complete cluster compromise. An authentication flaw in all versions of ClearPass coul… |
CVE-2018-14709 | Critical | 9.8 | 2018-12-03 | Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token genera… |
CVE-2018-14708 | Critical | 9.8 | 2018-12-03 | An insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept network traffic. |
CVE-2018-14637 | Medium | 6.1 | 2018-11-30 | The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnera… |
CVE-2018-7958 | High | 7.4 | 2018-11-27 | There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack… |
CVE-2018-19458 | High | 7.5 | 2018-11-22 | In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2… |
CVE-2018-16160 | High | 7.8 | 2018-11-15 | SecureCore Standard Edition Version 2.x allows an attacker to bypass the product 's authentication to log in to a Windows PC. |
CVE-2018-7358 | Medium | 6.5 | 2018-11-14 | ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may al… |
CVE-2018-3696 | Medium | 5.5 | 2018-11-14 | Authentication bypass in the Intel RAID Web Console 3 for Windows before 4.186 may allow an unprivileged user to potentially gain administrative privileges via… |
CVE-2018-2483 | Medium | 4.3 | 2018-11-13 | HTTP Verb Tampering is possible in SAP BusinessObjects Business Intelligence Platform, versions 4.1 and 4.2, Central Management Console (CMC) by changing reque… |
CVE-2018-7910 | Medium | 6.8 | 2018-11-13 | Some Huawei smartphones ALP-AL00B 8.0.0.118D(C00), ALP-TL00B 8.0.0.118D(C01), BLA-AL00B 8.0.0.118D(C00), BLA-L09C 8.0.0.127(C432), 8.0.0.128(C432), 8.0.0.137(C… |
CVE-2018-19076 | Critical | 9.8 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-17918 | Critical | 9.8 | 2018-11-02 | Circontrol CirCarLife all versions prior to 4.3.1, authentication to the device can be bypassed by entering the URL of a specific page. |
CVE-2018-6908 | Critical | 9.8 | 2018-11-01 | An authentication bypass vulnerability exists in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application allowing an unauthen… |
CVE-2018-6011 | High | 8.1 | 2018-11-01 | The time-based one-time-password (TOTP) function in the application logic of the Green Electronics RainMachine Mini-8 (2nd generation) uses the administrator's… |
CVE-2018-18891 | High | 7.5 | 2018-11-01 | MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late. |
CVE-2016-2125 | Medium | 6.5 | 2018-10-31 | It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba… |
CVE-2018-16467 | Medium | 5.3 | 2018-10-30 | A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares. |
CVE-2018-16465 | Medium | 5.3 | 2018-10-30 | Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second factor failed to load. |
CVE-2018-16464 | Medium | 5.7 | 2018-10-30 | A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the pass… |
CVE-2016-10732 | Critical | 9.8 | 2018-10-29 | ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.ph… |
CVE-2018-17923 | Medium | 6.9 | 2018-10-24 | SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that an attacker with physical access to the product may able to reprogram it. |
CVE-2018-15751 | Critical | 9.8 | 2018-10-24 | SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi). |
CVE-2018-18014 | Medium | 4.8 | 2018-10-24 | * Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to private s… |
CVE-2018-12667 | Critical | 9.8 | 2018-10-19 | The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) is affected by an improper authentication vulnerability that al… |
CVE-2018-12666 | Critical | 9.8 | 2018-10-19 | SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B devices improperly identifies users only by the authentication level sent in the cookies, which allow re… |
CVE-2018-1822 | Critical | 9.8 | 2018-10-18 | IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely… |
CVE-2018-7989 | Medium | 4.6 | 2018-10-17 | Huawei Mate 10 pro smartphones with the versions before BLA-AL00B 8.1.0.326(C00) have an improper authentication vulnerability. App Lock is a function to preve… |
CVE-2018-7076 | Critical | 9.8 | 2018-10-17 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) prior to iMC PLAT 7.3 E0605P04. |
CVE-2018-10933 | Critical | 9.1 | 2018-10-17 | A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first perform… |
CVE-2018-18389 | Critical | 9.8 | 2018-10-16 | Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Accoun… |
CVE-2018-17534 | Medium | 6.8 | 2018-10-15 | Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control. This allows attackers with… |
CVE-2018-1738 | High | 7.1 | 2018-10-11 | IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0 could allow an authenticated user to obtain highly sensitive information or jeopardize system integrity due to… |
CVE-2018-18061 | High | 7.5 | 2018-10-10 | An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. Attackers can access the file manager interface that provides them with the abil… |
CVE-2018-16738 | Low | 3.7 | 2018-10-10 | tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1. |
CVE-2018-16737 | Medium | 5.3 | 2018-10-10 | tinc before 1.0.30 has a broken authentication protocol, without even a partial mitigation. |
CVE-2018-13789 | High | 7.5 | 2018-10-10 | An issue was discovered in Descor Infocad FM before 3.1.0.0. An unauthenticated web service allows the retrieval of files on the web server and on reachable SM… |
CVE-2018-12455 | High | 8.1 | 2018-10-10 | Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using "ad… |
CVE-2018-0053 | Medium | 6.8 | 2018-10-10 | An authentication bypass vulnerability in the initial boot sequence of Juniper Networks Junos OS on vSRX Series may allow an attacker to gain full control of t… |
CVE-2018-0052 | High | 7.2 | 2018-10-10 | If RSH service is enabled on Junos OS and if the PAM authentication is disabled, a remote unauthenticated attacker can obtain root access to the device. RSH se… |
CVE-2018-0044 | Critical | 9.8 | 2018-10-10 | An insecure SSHD configuration in Juniper Device Manager (JDM) and host OS on Juniper NFX Series devices may allow remote unauthenticated access if any of the… |
CVE-2018-15543 | Medium | 6.8 | 2018-10-09 | An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The FingerprintManager class for Biometric validation allows authenticati… |
CVE-2018-15542 | Medium | 6.4 | 2018-10-09 | An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The Passcode feature allows authentication bypass via runtime manipulatio… |
CVE-2018-14080 | High | 7.5 | 2018-10-09 | An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 devices. One can bypass authentication mechanisms to do… |
CVE-2012-6710 | Critical | 9.8 | 2018-10-07 | ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to… |
CVE-2018-15371 | Medium | 6.7 | 2018-10-05 | A vulnerability in the shell access request mechanism of Cisco IOS XE Software could allow an authenticated, local attacker to bypass authentication and gain u… |
CVE-2018-0435 | Critical | 9.1 | 2018-10-05 | A vulnerability in the Cisco Umbrella API could allow an authenticated, remote attacker to view and modify data across their organization and other organizatio… |
CVE-2013-7465 | Critical | 9.8 | 2018-10-05 | Ice Cold Apps Servers Ultimate 6.0.2(12) does not require authentication for TELNET, SSH, or FTP, which allows remote attackers to execute arbitrary code by up… |
CVE-2018-0505 | Medium | 6.5 | 2018-10-04 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock |
CVE-2018-12472 | High | 7.3 | 2018-10-04 | A improper authentication using the HOST header in SUSE Linux SMT allows remote attackers to spoof a sibling server. Affected releases are SUSE Linux SMT: vers… |
CVE-2018-6689 | High | 7.8 | 2018-10-03 | Authentication Bypass vulnerability in McAfee Data Loss Prevention Endpoint (DLPe) 10.0.x earlier than 10.0.510, and 11.0.x earlier than 11.0.600 allows attack… |
CVE-2018-14826 | Critical | 9.8 | 2018-10-02 | Entes EMG12 versions 2.57 and prior The application uses a web interface where it is possible for an attacker to bypass authentication with a specially crafted… |
CVE-2018-17786 | Critical | 9.8 | 2018-10-02 | On D-Link DIR-823G devices, ExportSettings.sh, upload_settings.cgi, GetDownLoadSyslog.sh, and upload_firmware.cgi do not require authentication, which allows r… |
CVE-2018-1672 | Medium | 5.0 | 2018-10-01 | IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the… |
CVE-2018-9080 | Medium | 5.9 | 2018-09-28 | For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's… |
CVE-2018-7108 | Medium | 5.9 | 2018-09-27 | HPE StorageWorks XP7 Automation Director (AutoDir) version 8.5.2-02 to earlier than 8.6.1-00 has a local and remote authentication bypass vulnerability that ex… |
CVE-2018-1539 | Medium | 5.4 | 2018-09-25 | IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication via a direct request or… |
CVE-2018-17341 | High | 8.1 | 2018-09-23 | BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonst… |
CVE-2018-12169 | High | 7.6 | 2018-09-21 | Platform sample code firmware in 4th Generation Intel Core Processor, 5th Generation Intel Core Processor, 6th Generation Intel Core Processor, 7th Generation… |
CVE-2018-14643 | Critical | 9.8 | 2018-09-21 | An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitr… |
CVE-2018-12242 | Critical | 9.8 | 2018-09-19 | The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to an authentication bypass exploit, which is a type of issue that can allow attacker… |
CVE-2017-3912 | Medium | 4.4 | 2018-09-18 | Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary comma… |
CVE-2018-16670 | Medium | 5.3 | 2018-09-18 | An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html. |
CVE-2018-16668 | Medium | 5.3 | 2018-09-18 | An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/reposit… |
CVE-2018-17153 | Critical | 9.8 | 2018-09-18 | It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker c… |
CVE-2018-11787 | High | 8.1 | 2018-09-18 | In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires aut… |