CWE-287 · Improper Authentication (page 33)
Page 33 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7222 | Medium | 5.3 | 2020-01-18 | An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authentica… |
CVE-2019-3997 | Medium | 4.6 | 2020-01-16 | Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.0-1.3 allows a local, unauthenticated attacker to pair a rogue keypad to… |
CVE-2019-19857 | Medium | 6.5 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. An admin can change their password without providing the current p… |
CVE-2012-3824 | High | 7.5 | 2020-01-10 | In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization. |
CVE-2014-5081 | Critical | 9.8 | 2020-01-10 | sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass |
CVE-2012-2714 | Critical | 9.8 | 2020-01-09 | The BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users via the audien… |
CVE-2012-1258 | Medium | 6.5 | 2020-01-09 | cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate user permissions, which allow remote at… |
CVE-2020-1786 | Medium | 4.6 | 2020-01-09 | HUAWEI Mate 20 Pro smartphones versions earlier than 10.0.0.175(C00E69R3P8) have an improper authentication vulnerability. The software does not sufficiently v… |
CVE-2020-1787 | Medium | 6.6 | 2020-01-09 | HUAWEI Mate 20 smartphones versions earlier than 9.1.0.139(C00E133R3P1) have an improper authentication vulnerability. The system has a logic error under certa… |
CVE-2014-2651 | Critical | 9.8 | 2020-01-09 | Unify OpenStage/OpenScape Desk Phone IP SIP before V3 R3.11.0 has an authentication bypass in the default mode of the Workpoint Interface |
CVE-2019-17023 | Medium | 6.5 | 2020-01-08 | After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Mach… |
CVE-2019-19518 | Critical | 9.8 | 2020-01-08 | CA Automic Sysload 5.6.0 through 6.1.2 contains a vulnerability, related to a lack of authentication on the File Server port, that potentially allows remote at… |
CVE-2019-20360 | High | 7.5 | 2020-01-08 | A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user inf… |
CVE-2013-5122 | Critical | 9.8 | 2020-01-07 | Cisco Linksys Routers EA2700, EA3500, E4200, EA4500: A bug can cause an unsafe TCP port to open which leads to unauthenticated access |
CVE-2019-6854 | High | 7.8 | 2020-01-06 | A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -with initial releases before 1 January 20… |
CVE-2018-19834 | High | 7.5 | 2019-12-31 | The quaker function of a smart contract implementation for BOMBBA (BOMB), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contrac… |
CVE-2018-19833 | High | 7.5 | 2019-12-31 | The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because… |
CVE-2018-19832 | High | 7.5 | 2019-12-31 | The NETM() function of a smart contract implementation for NewIntelTechMedia (NETM), an tradable Ethereum ERC20 token, allows attackers to change the owner of… |
CVE-2018-19831 | High | 7.5 | 2019-12-31 | The ToOwner() function of a smart contract implementation for Cryptbond Network (CBN), an tradable Ethereum ERC20 token, allows attackers to change the owner o… |
CVE-2018-20489 | Medium | 5.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2013-4982 | Critical | 9.8 | 2019-12-27 | AVTECH AVN801 DVR has a security bypass via the administration login captcha |
CVE-2013-4976 | Critical | 9.8 | 2019-12-27 | Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials |
CVE-2013-4621 | Critical | 9.8 | 2019-12-27 | Magnolia CMS before 4.5.9 has multiple access bypass vulnerabilities |
CVE-2013-3088 | Critical | 9.8 | 2019-12-26 | Belkin N900 router (F9K1104v1) contains an Authentication Bypass using "Javascript debugging". |
CVE-2013-3085 | Critical | 9.8 | 2019-12-26 | An authentication bypass exists in the web management interface in Belkin F5D8236-4 v2. |
CVE-2012-3462 | High | 8.8 | 2019-12-26 | A flaw was found in SSSD version 1.9.0. The SSSD's access-provider logic causes the result of the HBAC rule processing to be ignored in the event that the acce… |
CVE-2019-16327 | Critical | 9.8 | 2019-12-26 | D-Link DIR-601 B1 2.00NA devices are vulnerable to authentication bypass. They do not check for authentication at the server side and rely on client-side valid… |
CVE-2019-19982 | Medium | 5.3 | 2019-12-26 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulne… |
CVE-2019-5108 | Medium | 6.5 | 2019-12-23 | An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP… |
CVE-2019-5486 | High | 8.8 | 2019-12-18 | A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an att… |
CVE-2019-8804 | Medium | 5.7 | 2019-12-18 | An inconsistency in Wi-Fi network configuration settings was addressed. This issue is fixed in iOS 13.2 and iPadOS 13.2. An attacker in physical proximity may… |
CVE-2019-8760 | Medium | 6.8 | 2019-12-18 | This issue was addressed by improving Face ID machine learning models. This issue is fixed in iOS 13. A 3D model constructed to look like the enrolled user may… |
CVE-2019-8704 | Medium | 5.5 | 2019-12-18 | An authentication issue was addressed with improved state management. This issue is fixed in tvOS 13. A local user may be able to leak sensitive user informati… |
CVE-2019-8634 | High | 8.8 | 2019-12-18 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.5. A user may be unexpectedly logged in to anot… |
CVE-2019-8533 | High | 7.8 | 2019-12-18 | A lock handling issue was addressed with improved lock handling. This issue is fixed in macOS Mojave 10.14.4. A Mac may not lock when disconnecting from an ext… |
CVE-2014-8650 | Critical | 9.8 | 2019-12-15 | python-requests-Kerberos through 0.5 does not handle mutual authentication |
CVE-2019-5252 | Low | 3.5 | 2019-12-14 | There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficie… |
CVE-2019-5253 | Medium | 5.9 | 2019-12-13 | E5572-855 with versions earlier than 8.0.1.3(H335SP1C233) has an improper authentication vulnerability. The device does not perform a sufficient authentication… |
CVE-2014-1867 | High | 7.8 | 2019-12-13 | suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code execution |
CVE-2019-5061 | Medium | 6.5 | 2019-12-12 | An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before… |
CVE-2019-18341 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Control Center Server… |
CVE-2019-18337 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains an authentication bypass v… |
CVE-2019-18332 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18322 | Critical | 9.1 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could be able to… |
CVE-2019-18321 | Critical | 9.1 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could be able to… |
CVE-2019-18320 | High | 7.5 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18319 | High | 7.5 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18318 | High | 7.5 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18317 | High | 7.5 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18315 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18314 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18312 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could be able to… |
CVE-2019-18287 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The Application Server exposes directory listings… |
CVE-2019-18286 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The Application Server exposes directory listings… |
CVE-2019-18284 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The AdminService is available without authenticati… |
CVE-2013-4593 | High | 7.5 | 2019-12-11 | RubyGem omniauth-facebook has an access token security vulnerability |
CVE-2019-14870 | Medium | 5.4 | 2019-12-10 | All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes… |
CVE-2013-2159 | Critical | 9.8 | 2019-12-10 | Monkey HTTP Daemon: broken user name authentication |
CVE-2019-18380 | Medium | 6.5 | 2019-12-09 | Symantec Industrial Control System Protection (ICSP), versions 6.x.x, may be susceptible to an unauthorized access issue that could potentially allow a threat… |
CVE-2019-15897 | Critical | 9.6 | 2019-12-05 | beegfs-ctl in ThinkParQ BeeGFS through 7.1.3 allows Authentication Bypass via communication with a BeeGFS metadata server (which is typically not exposed to ex… |
CVE-2019-17437 | High | 7.8 | 2019-12-05 | An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges an… |
CVE-2019-14910 | Critical | 9.8 | 2019-12-05 | A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (… |
CVE-2019-19598 | High | 8.8 | 2019-12-05 | D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAP_AUTH header timestamp value. In HTTP r… |
CVE-2019-19521 | Critical | 9.8 | 2019-12-05 | libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/auth_subr.c… |
CVE-2019-19519 | High | 7.8 | 2019-12-05 | In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the main function in s… |
CVE-2019-14909 | High | 8.3 | 2019-12-04 | A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accept… |
CVE-2019-19507 | Medium | 5.3 | 2019-12-02 | In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name… |
CVE-2019-12394 | Critical | 9.8 | 2019-12-02 | Anviz access control devices allow unverified password change which allows remote attackers to change the administrator password without prior authentication. |
CVE-2019-5218 | High | 8.8 | 2019-11-29 | There is an insufficient authentication vulnerability in Huawei Band 2 and Honor Band 3. The band does not sufficiently authenticate the device try to connect… |
CVE-2019-16201 | High | 7.5 | 2019-11-26 | WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/b… |
CVE-2019-6675 | Critical | 9.8 | 2019-11-26 | BIG-IP configurations using Active Directory, LDAP, or Client Certificate LDAP for management authentication with multiple servers are exposed to a vulnerabili… |
CVE-2019-14856 | Medium | 6.5 | 2019-11-26 | ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None |
CVE-2019-15987 | Medium | 5.3 | 2019-11-26 | A vulnerability in web interface of the Cisco Webex Event Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center could… |
CVE-2019-18250 | Critical | 9.8 | 2019-11-26 | In all versions of ABB Power Generation Information Manager (PGIM) and Plant Connect, the affected product is vulnerable to authentication bypass, which may al… |
CVE-2019-18374 | Critical | 9.8 | 2019-11-25 | Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a type of is… |
CVE-2019-16286 | Medium | 6.8 | 2019-11-22 | An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by changing browser preferences to launch a sep… |
CVE-2019-3654 | Medium | 5.3 | 2019-11-22 | Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web tra… |
CVE-2014-2904 | High | 7.5 | 2019-11-21 | wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication. |
CVE-2019-19006 | Critical | 9.8 | 2019-11-21 | Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. |
CVE-2019-15803 | Critical | 9.1 | 2019-11-14 | An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Through an undocumented sequence of keypresses, undocumented functionality… |
CVE-2013-3072 | Critical | 9.8 | 2019-11-14 | An Authentication Bypass vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34 in http://<router_ip>/apply.cgi?/hdd_usr_setup.htm that when visite… |
CVE-2019-11170 | High | 7.8 | 2019-11-14 | Authentication bypass in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure, esca… |
CVE-2013-3367 | Critical | 9.8 | 2019-11-13 | Undocumented TELNET service in TRENDnet TEW-691GR and TEW-692GR when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg_… |
CVE-2019-5233 | High | 8.8 | 2019-11-13 | Huawei smartphones with versions earlier than Taurus-AL00B 10.0.0.41(SP2C00E41R3P2) have an improper authentication vulnerability. Successful exploitation may… |
CVE-2019-5213 | Low | 2.4 | 2019-11-12 | Honor play smartphones with versions earlier than Cornell-AL00A 9.1.0.321(C00E320R1P1T8) have an insufficient authentication vulnerability. The system has a lo… |
CVE-2019-18848 | High | 7.5 | 2019-11-12 | The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string. |
CVE-2019-13531 | Medium | 4.8 | 2019-11-08 | In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not… |
CVE-2011-4628 | Critical | 9.8 | 2019-11-06 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted re… |
CVE-2019-8108 | Medium | 6.5 | 2019-11-05 | Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated us… |
CVE-2013-5123 | Medium | 5.9 | 2019-11-05 | The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-… |
CVE-2019-1980 | Medium | 5.3 | 2019-11-05 | A vulnerability in the protocol detection component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower… |
CVE-2019-1877 | Medium | 6.5 | 2019-11-05 | A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sess… |
CVE-2019-18661 | High | 7.5 | 2019-11-02 | Fastweb FASTGate 1.0.1b devices allow partial authentication bypass by changing a certain check_pwd return value from 0 to 1. An attack does not achieve admini… |
CVE-2018-4064 | High | 7.1 | 2019-10-31 | An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A speciall… |
CVE-2013-1391 | High | 7.5 | 2019-10-30 | Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remot… |
CVE-2016-2359 | Critical | 9.8 | 2019-10-25 | Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultaneously making a req… |
CVE-2019-17627 | Medium | 6.5 | 2019-10-16 | The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy (BLE) traffic during one authorized u… |
CVE-2019-14510 | Medium | 6.7 | 2019-10-11 | An issue was discovered in Kaseya VSA RMM through 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local account FSAdminxxxxxxxx… |
CVE-2019-9531 | Critical | 9.8 | 2019-10-10 | The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated… |
CVE-2019-17372 | High | 8.1 | 2019-10-09 | Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for ex… |