CWE-287 · Improper Authentication (page 32)
Page 32 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-21038 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) software. The Secure Folder app's startup logic allows authentication bypass. The Samsung ID is S… |
CVE-2017-18646 | Medium | 4.6 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. An attacker can bypass the password requirement for tablet user switching by… |
CVE-2017-18654 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0, 7.1) software. An unauthenticated attacker can register a new security certificate. Th… |
CVE-2016-11042 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. There is a SIM Lock bypass. The Samsung ID is SVE-2016-5381 (June 2016). |
CVE-2016-11041 | Medium | 4.6 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4) software. Attackers can bypass the lockscreen by sending an AT command over USB. The Samsung ID… |
CVE-2020-11542 | Critical | 9.8 | 2020-04-04 | 3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpret… |
CVE-2019-14880 | Critical | 9.1 | 2020-03-31 | A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not verify users' email… |
CVE-2020-5860 | High | 8.1 | 2020-03-27 | On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, in a High Ava… |
CVE-2020-9066 | High | 7.8 | 2020-03-26 | Huawei smartphones OxfordP-AN10B with versions earlier than 10.0.1.169(C00E166R4P1) have an improper authentication vulnerability. The Application doesn't perf… |
CVE-2019-15796 | Medium | 4.7 | 2020-03-26 | Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache… |
CVE-2020-10965 | High | 8.1 | 2020-03-25 | Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the default admin accoun… |
CVE-2020-10888 | Critical | 9.8 | 2020-03-25 | This vulnerability allows remote attackers to bypass authentication on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authent… |
CVE-2019-20620 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. The Settings application allows unauthenticated changes. The Samsung IDs are SVE-2019-1… |
CVE-2019-20618 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. The Pin Window feature allows unauthenticated unpinning of an app. The Samsung ID is SV… |
CVE-2019-20565 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) software. Attackers can change the USB configuration without authentication. The Samsu… |
CVE-2020-10847 | Medium | 6.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) (Galaxy S8 and Note8) software. Facial recognition can be spoofed. The Samsung ID is SVE-2019-166… |
CVE-2020-10846 | Medium | 5.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.x) and Q(10.x) software. Attackers can enable the OEM unlock feature on a KG-enrolled devices, leadi… |
CVE-2019-20533 | Low | 3.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (released in China or India) software. The S Secure app can launch masked app… |
CVE-2020-8863 | High | 8.8 | 2020-03-23 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with fi… |
CVE-2020-1878 | Medium | 5.5 | 2020-03-20 | Huawei smartphone OxfordS-AN00A with versions earlier than 10.0.1.152D(C735E152R3P3),versions earlier than 10.0.1.160(C00E160R4P1) have an improper authenticat… |
CVE-2020-1864 | High | 8.1 | 2020-03-20 | Some Huawei products have a security vulnerability due to improper authentication. A remote attacker needs to obtain some information and forge the peer device… |
CVE-2020-1794 | Medium | 4.6 | 2020-03-20 | There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient authentication in certain scenarios, succes… |
CVE-2020-1793 | Medium | 4.6 | 2020-03-20 | There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient authentication in certain scenarios, succes… |
CVE-2020-10669 | High | 7.5 | 2020-03-19 | The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated att… |
CVE-2020-4205 | Medium | 6.3 | 2020-03-19 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass security restrictions, and continue to access the server even a… |
CVE-2020-6988 | High | 7.5 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2018-13060 | Medium | 6.5 | 2020-03-16 | Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue. |
CVE-2020-10594 | Critical | 9.1 | 2020-03-15 | An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via t… |
CVE-2020-9064 | Medium | 5.5 | 2020-03-12 | Huawei smartphone Honor V30 with versions earlier than OxfordS-AN00A 10.0.1.167(C00E166R4P1) have an improper authentication vulnerability. Authentication to t… |
CVE-2020-8994 | Medium | 6.8 | 2020-03-05 | An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. Attackers can get root shell by accessing the UART interface and then they can rea… |
CVE-2020-8664 | Medium | 5.3 | 2020-03-04 | CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many res… |
CVE-2020-5536 | High | 8.8 | 2020-03-04 | OpenBlocks IoT VX2 prior to Ver.4.0.0 (Ver.3 Series) allows an attacker on the same network segment to bypass authentication and to initialize the device via u… |
CVE-2018-15819 | High | 7.5 | 2020-03-02 | EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js. |
CVE-2019-20489 | Critical | 9.8 | 2020-03-02 | An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and other problems that ul… |
CVE-2020-3923 | High | 8.1 | 2020-02-27 | DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET, contain misconfigured authentication mechanism. Attackers can crack the default passw… |
CVE-2019-5165 | High | 7.2 | 2020-02-25 | An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware version 1.13. A specially configured device… |
CVE-2018-14705 | Critical | 9.8 | 2020-02-24 | In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device o… |
CVE-2019-20481 | Critical | 9.8 | 2020-02-24 | In MIELE XGW 3000 ZigBee Gateway before 2.4.0, the Password Change Function does not require knowledge of the old password. This can be exploited in conjunctio… |
CVE-2019-15299 | High | 8.8 | 2020-02-24 | An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the contact_autologin_key field in the database… |
CVE-2020-8862 | High | 8.8 | 2020-02-22 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authent… |
CVE-2020-8861 | High | 8.8 | 2020-02-22 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders… |
CVE-2020-3944 | High | 8.6 | 2020-02-19 | vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) has an improper trust store configuration leading to authentication byp… |
CVE-2011-2054 | Medium | 4.3 | 2020-02-19 | A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authent… |
CVE-2014-3879 | Critical | 9.8 | 2020-02-18 | OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, which causes… |
CVE-2013-4454 | Critical | 9.1 | 2020-02-18 | WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities |
CVE-2020-1842 | Medium | 6.8 | 2020-02-18 | Huawei HEGE-560 version 1.0.1.20(SP2); OSCA-550 and OSCA-550A version 1.0.0.71(SP1); and OSCA-550AX and OSCA-550X version 1.0.0.71(SP2) have an insufficient au… |
CVE-2020-1812 | High | 7.8 | 2020-02-18 | HUAWEI P30 smartphones with versions earlier than 10.0.0.173(C00E73R1P11) have an improper authentication vulnerability. Due to improperly validation of certai… |
CVE-2020-1789 | Medium | 6.8 | 2020-02-18 | Huawei OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X products with version 1.0.1.21(SP3) have an insufficient authentication vulnerability. The software does… |
CVE-2015-6922 | Critical | 9.8 | 2020-02-17 | Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authe… |
CVE-2019-20046 | Critical | 9.8 | 2020-02-14 | The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. The affected product does not requi… |
CVE-2020-5532 | Medium | 4.3 | 2020-02-14 | ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker on the same network segment to bypass au… |
CVE-2013-6360 | High | 7.5 | 2020-02-13 | TRENDnet TS-S402 has a backdoor to enable TELNET. |
CVE-2019-3998 | Medium | 5.5 | 2020-02-13 | Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to modify the Wi-Fi network th… |
CVE-2019-14598 | Medium | 6.7 | 2020-02-13 | Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 1… |
CVE-2014-4198 | Critical | 9.1 | 2020-02-13 | A Two-Factor Authentication Bypass Vulnerability exists in BS-Client Private Client 2.4 and 2.5 via an XML request that neglects the use of ADPswID and AD para… |
CVE-2020-8953 | Critical | 9.8 | 2020-02-13 | OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication). |
CVE-2011-4338 | High | 7.8 | 2020-02-12 | Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root p… |
CVE-2020-8595 | High | 7.3 | 2020-02-12 | Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matc… |
CVE-2020-0688 | High | 8.8 | 2020-02-11 | A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchan… |
CVE-2013-2120 | High | 8.4 | 2020-02-11 | The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allo… |
CVE-2013-5582 | High | 7.8 | 2020-02-11 | Ammyy Admin 3.2 and earlier stores the client ID at a fixed memory location, which might make it easier for user-assisted remote attackers to bypass authentica… |
CVE-2014-9753 | Critical | 9.8 | 2020-02-11 | confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter. |
CVE-2013-1359 | Critical | 9.8 | 2020-02-11 | An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0; Universal Management… |
CVE-2013-1360 | Critical | 9.8 | 2020-02-11 | An Authentication Bypass vulnerability exists in DELL SonicWALL Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0, Analyzer 7.0, Universal Management… |
CVE-2014-8347 | High | 7.8 | 2020-02-11 | An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 and Filemaker Pro Advanced 12.04, which… |
CVE-2019-6744 | Medium | 4.3 | 2020-02-10 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Samsung Knox 1.2.02.39 on Samsung Galaxy S9 build G960… |
CVE-2019-20062 | Critical | 9.8 | 2020-02-10 | MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (the hash never expires until used). |
CVE-2017-18641 | High | 8.1 | 2020-02-10 | In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers. |
CVE-2013-3096 | Medium | 5.9 | 2020-02-07 | D-Link DIR865L v1.03 suffers from an "Unauthenticated Hardware Linking" vulnerability. |
CVE-2013-3091 | Critical | 9.8 | 2020-02-07 | An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication using "Javascript debugging." |
CVE-2012-6340 | Medium | 4.6 | 2020-02-06 | An Authentication vulnerability exists in NETGEAR WGR614 v7 and v9 due to a hardcoded credential used for serial programming, a related issue to CVE-2006-1002. |
CVE-2020-8771 | Critical | 9.8 | 2020-02-06 | The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as… |
CVE-2013-2681 | Critical | 9.8 | 2020-02-05 | Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to gain unauthorized access. |
CVE-2015-0102 | High | 8.1 | 2020-02-05 | IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this co… |
CVE-2019-15620 | Low | 2.7 | 2020-02-04 | Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the proje… |
CVE-2019-15617 | Medium | 5.4 | 2020-02-04 | A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login. |
CVE-2019-15615 | Medium | 6.1 | 2020-02-04 | A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past. |
CVE-2013-7051 | High | 8.8 | 2020-02-04 | D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters |
CVE-2020-8591 | Critical | 9.8 | 2020-02-03 | eG Manager 7.1.2 allows authentication bypass via a com.egurkha.EgLoginServlet?uname=admin&upass=&accessKey=eGm0n1t0r request. |
CVE-2020-8510 | Critical | 9.8 | 2020-02-03 | An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en (user+perms+lang), one can… |
CVE-2016-2032 | High | 7.5 | 2020-01-31 | A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the management interface of an underlying system component called RabbitMQ… |
CVE-2013-5116 | High | 7.1 | 2020-01-31 | Evernote prior to 5.5.1 has insecure password change |
CVE-2013-5114 | Medium | 6.1 | 2020-01-31 | LastPass prior to 2.5.1 allows secure wipe bypass. |
CVE-2013-5112 | Medium | 4.6 | 2020-01-31 | Evernote before 5.5.1 has insecure PIN storage |
CVE-2020-5206 | High | 8.7 | 2020-01-30 | In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if… |
CVE-2013-3317 | Critical | 9.8 | 2020-01-29 | Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass via the NtgrBak key. |
CVE-2013-3316 | Critical | 9.8 | 2020-01-29 | Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass due to the server skipping checks for URLs containing a ".jpg". |
CVE-2013-3215 | Critical | 9.8 | 2020-01-29 | vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function. |
CVE-2013-2569 | High | 7.5 | 2020-01-29 | A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, which could let a mal… |
CVE-2013-3071 | Critical | 9.8 | 2020-01-28 | NETGEAR Centria WNDR4700 devices with firmware 1.0.0.34 allow authentication bypass. |
CVE-2013-1600 | Medium | 5.3 | 2020-01-28 | An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS… |
CVE-2013-4863 | High | 8.8 | 2020-01-28 | The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute arbitrary Lua code via a RunLua action i… |
CVE-2019-15585 | Critical | 9.8 | 2020-01-28 | Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integratio… |
CVE-2019-19825 | Critical | 9.8 | 2020-01-27 | On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, lead… |
CVE-2013-4462 | Critical | 9.1 | 2020-01-27 | WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability |
CVE-2020-5224 | Medium | 6.5 | 2020-01-24 | In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify… |
CVE-2013-1596 | Medium | 5.3 | 2020-01-24 | An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554. |
CVE-2012-6451 | Critical | 9.8 | 2020-01-24 | Lorex LNC116 and LNC104 IP Cameras have a Remote Authentication Bypass Vulnerability |
CVE-2020-1788 | Medium | 5.5 | 2020-01-21 | Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability. Certain applications do not properly va… |
CVE-2020-1840 | Medium | 6.0 | 2020-01-21 | HUAWEI Mate 20 smart phones with versions earlier than 10.0.0.175(C00E70R3P8) have an insufficient authentication vulnerability. A local attacker with high pri… |