CWE-287 · Improper Authentication (page 34)
Page 34 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2604 | Medium | 4.3 | 2018-05-15 | In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permiss… |
CVE-2018-10825 | Medium | 5.3 | 2018-05-15 | Mimo Baby 2 devices do not use authentication or encryption for the Bluetooth Low Energy (BLE) communication from a Turtle to a Lilypad, which allows attackers… |
CVE-2018-6617 | High | 7.8 | 2018-05-11 | Easy Hosting Control Panel (EHCP) v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database users by leveraging f… |
CVE-2018-7941 | High | 8.8 | 2018-05-10 | Huawei iBMC V200R002C60 have an authentication bypass vulnerability. A remote attacker with low privilege may craft specific messages to upload authentication… |
CVE-2018-7940 | Medium | 6.2 | 2018-05-10 | Huawei smart phones Mate 10 and Mate 10 Pro with earlier versions than 8.0.0.129(SP2C00) and earlier versions than 8.0.0.129(SP2C01) have an authentication byp… |
CVE-2018-6020 | Medium | 6.5 | 2018-05-09 | In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when making certain POST requests, which may all… |
CVE-2018-10683 | Critical | 9.8 | 2018-05-09 | An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access… |
CVE-2018-10682 | Critical | 9.8 | 2018-05-09 | An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication… |
CVE-2017-3775 | Medium | 6.4 | 2018-05-04 | Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before boo… |
CVE-2018-10641 | High | 8.1 | 2018-05-04 | D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext. |
CVE-2018-10561 | Critical | 9.8 | 2018-05-04 | An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that require… |
CVE-2018-0247 | Medium | 4.7 | 2018-05-02 | A vulnerability in Web Authentication (WebAuth) clients for the Cisco Wireless LAN Controller (WLC) and Aironet Access Points running Cisco IOS Software could… |
CVE-2018-10544 | Critical | 9.8 | 2018-05-02 | Meross MSS110 devices through 1.1.24 contain an unauthenticated admin.htm administrative interface. |
CVE-2018-9232 | High | 7.8 | 2018-05-01 | Due to the lack of firmware authentication in the upgrade process of T&W WIFI Repeater BE126 devices, an attacker can craft a malicious firmware and use it as… |
CVE-2018-10576 | High | 7.8 | 2018-04-30 | An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentication handling by the native Access Poin… |
CVE-2018-1418 | High | 8.8 | 2018-04-26 | IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IBM X-Force ID: 138824. |
CVE-2017-12712 | High | 8.8 | 2018-04-25 | The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be… |
CVE-2018-1112 | High | 8.0 | 2018-04-25 | glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from an… |
CVE-2018-10362 | Critical | 9.8 | 2018-04-25 | An issue was discovered in phpLiteAdmin 1.9.5 through 1.9.7.1. Due to loose comparison with '==' instead of '===' in classes/Authorization.php for the user-pro… |
CVE-2018-1106 | Medium | 5.5 | 2018-04-23 | An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local… |
CVE-2014-0927 | High | 8.1 | 2018-04-20 | The ActiveMQ admin user interface in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote attackers to bypass authentica… |
CVE-2018-6960 | High | 8.8 | 2018-04-20 | VMware Horizon DaaS (7.x before 8.0.0) contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authentication. Note: In… |
CVE-2018-0238 | Critical | 9.9 | 2018-04-19 | A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System (UCS) Director could allow an authenticated, remote att… |
CVE-2018-7760 | Critical | 9.8 | 2018-04-18 | An authorization bypass vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. Requests to CGI functions… |
CVE-2016-10434 | High | 7.5 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 820 and SD 820A, the input to RPMB writ… |
CVE-2017-12196 | Medium | 4.8 | 2018-04-18 | undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value… |
CVE-2017-2871 | High | 8.8 | 2018-04-17 | Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is… |
CVE-2018-6547 | Critical | 9.1 | 2018-04-13 | plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, contains an HTTP mes… |
CVE-2018-6546 | Critical | 9.8 | 2018-04-13 | plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, executes code at a u… |
CVE-2017-0356 | Critical | 9.8 | 2018-04-13 | A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass… |
CVE-2016-9646 | Medium | 5.3 | 2018-04-13 | ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can… |
CVE-2014-3999 | High | 8.1 | 2018-04-10 | The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user DN. |
CVE-2016-8380 | High | 7.3 | 2018-04-05 | The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication. |
CVE-2016-8371 | High | 7.3 | 2018-04-05 | The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled. |
CVE-2018-1082 | High | 8.1 | 2018-04-04 | A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the use… |
CVE-2018-6873 | Critical | 9.8 | 2018-04-04 | The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated. |
CVE-2018-9249 | Critical | 9.8 | 2018-04-04 | FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass by ignoring the parent.location='login.html' JavaScript code in the response to an unauthen… |
CVE-2018-9248 | Critical | 9.8 | 2018-04-04 | FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header. |
CVE-2018-3822 | Critical | 9.8 | 2018-03-30 | X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canonicalization and DOM traversal. An attacke… |
CVE-2018-9148 | Critical | 9.8 | 2018-03-30 | Western Digital WD My Cloud v04.05.00-320 devices embed the session token (aka PHPSESSID) in filenames, which makes it easier for attackers to bypass authentic… |
CVE-2017-14911 | Critical | 9.8 | 2018-03-30 | In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile, Snapdragon Automobile APQ8096AU, MDM9206, MDM9650, MSM8996AU, SD 210/SD 212/SD 205… |
CVE-2018-4841 | Critical | 9.8 | 2018-03-29 | A vulnerability has been identified in TIM 1531 IRC (All versions < V1.1). A remote attacker with network access to port 80/tcp or port 443/tcp could perform a… |
CVE-2018-0195 | High | 8.8 | 2018-03-28 | A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perfo… |
CVE-2018-0163 | Medium | 6.5 | 2018-03-28 | A vulnerability in the 802.1x multiple-authentication (multi-auth) feature of Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass th… |
CVE-2018-5451 | Critical | 9.8 | 2018-03-28 | In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does not prove or insufficiently proves that the… |
CVE-2018-9105 | High | 8.8 | 2018-03-27 | NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privileged helper tool's implemented XPC serv… |
CVE-2018-1237 | Critical | 9.8 | 2018-03-27 | Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent (LIA). This component… |
CVE-2015-4987 | Medium | 6.5 | 2018-03-27 | The search and replay servers in IBM Tealeaf Customer Experience 8.0 through 9.0.2 allow remote attackers to bypass authentication via unspecified vectors. IBM… |
CVE-2018-9032 | Critical | 9.8 | 2018-03-27 | An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; Firmware Version : 1.02-2… |
CVE-2017-15534 | Medium | 6.7 | 2018-03-26 | The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of circumstance, the exploit can allow the u… |
CVE-2018-1312 | Critical | 9.8 | 2018-03-26 | In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated u… |
CVE-2018-7532 | Critical | 9.8 | 2018-03-22 | Unauthentication vulnerabilities have been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may… |
CVE-2017-16242 | Medium | 6.8 | 2018-03-22 | An issue was discovered on MECO USB Memory Stick with Fingerprint MECOZiolsamDE601 devices. The fingerprint authentication requirement for data access can be b… |
CVE-2017-17743 | Medium | 6.7 | 2018-03-22 | Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices before 4.4.20, 5.0.x before 5.0.19, and 5.1.x befor… |
CVE-2017-14008 | Critical | 9.8 | 2018-03-20 | GE Centricity PACS RA1000, diagnostic image analysis, all current versions are affected these devices use default or hard-coded credentials. Successful exploit… |
CVE-2017-14006 | Critical | 9.8 | 2018-03-20 | GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use default or hard-coded credentials. Succe… |
CVE-2017-14004 | Critical | 9.8 | 2018-03-20 | GE GEMNet License server (EchoServer) all current versions are affected these devices use default or hard-coded credentials. Successful exploitation of this vu… |
CVE-2017-14002 | Critical | 9.8 | 2018-03-20 | GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions are affected these devices use default or hard-coded credentials. Successful exp… |
CVE-2016-9880 | Critical | 9.8 | 2018-03-16 | The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used… |
CVE-2018-8715 | High | 8.1 | 2018-03-15 | The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP req… |
CVE-2018-8710 | Critical | 9.8 | 2018-03-14 | A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode… |
CVE-2018-6328 | Critical | 9.8 | 2018-03-14 | It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticate… |
CVE-2018-0886 | High | 7.0 | 2018-03-14 | The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Ser… |
CVE-2018-8096 | Critical | 9.8 | 2018-03-14 | Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name":"isauthenticationenabled","Value":fal… |
CVE-2018-7750 | Critical | 9.8 | 2018-03-13 | transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3… |
CVE-2018-6299 | Critical | 9.8 | 2018-03-13 | Authentication bypass in Hanwha Techwin Smartcams |
CVE-2018-6294 | Critical | 9.8 | 2018-03-13 | Unsecured way of firmware update in Hanwha Techwin Smartcams |
CVE-2018-7749 | Critical | 9.8 | 2018-03-12 | The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customi… |
CVE-2017-2628 | Critical | 9.8 | 2018-03-12 | curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fa… |
CVE-2018-7213 | Critical | 9.8 | 2018-03-11 | The Password Manager Extension in Abine Blur 7.8.242* before 7.8.2428 allows attackers to bypass the Multi-Factor Authentication and macOS disk-encryption prot… |
CVE-2017-18223 | High | 8.1 | 2018-03-10 | BMC Remedy AR System before 9.1 SP3, when Remedy AR Authentication is enabled, allows attackers to obtain administrative access. |
CVE-2018-7236 | High | 8.1 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of… |
CVE-2018-7228 | Critical | 9.8 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote… |
CVE-2018-7227 | Medium | 5.3 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow retrieving of specially cra… |
CVE-2018-1443 | Medium | 5.9 | 2018-03-08 | An XML parsing vulnerability affects IBM SAML-based single sign-on (SSO) systems (IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity M… |
CVE-2017-7638 | Medium | 6.5 | 2018-03-08 | QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could le… |
CVE-2018-0087 | Medium | 5.6 | 2018-03-08 | A vulnerability in the FTP server of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to log in to the FTP server of the… |
CVE-2018-7745 | High | 7.5 | 2018-03-07 | An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/install/installation/createuserinfo requests, resul… |
CVE-2018-1343 | Critical | 9.8 | 2018-03-06 | PAM exposure enabling unauthenticated access to remote host |
CVE-2017-15519 | High | 7.2 | 2018-03-06 | Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for NAS File Services. A… |
CVE-2018-5455 | Critical | 9.8 | 2018-03-05 | A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The… |
CVE-2017-9285 | Medium | 5.4 | 2018-03-02 | NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory services. |
CVE-2017-5189 | Medium | 4.3 | 2018-03-02 | NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application (JAR file) for authentication to Sentinel, allowing attackers to extract and esta… |
CVE-2018-5314 | High | 7.5 | 2018-03-01 | Command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway 11.0 before build 70.16, 11.1 before build 55.13, and 12.0 before build 53.13; an… |
CVE-2018-1286 | Medium | 6.5 | 2018-02-28 | In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for pri… |
CVE-2018-0121 | Critical | 9.8 | 2018-02-22 | A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticate… |
CVE-2017-12549 | Medium | 5.6 | 2018-02-15 | A local authentication bypass vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found. |
CVE-2011-4973 | Critical | 9.8 | 2018-02-15 | Authentication bypass vulnerability in mod_nss 1.0.8 allows remote attackers to assume the identity of a valid user by using their certificate and entering 'pa… |
CVE-2017-17161 | Medium | 6.8 | 2018-02-15 | The 'Find Phone' function in some Huawei smart phones with software earlier than Duke-L09C10B186 versions, earlier than Duke-L09C432B187 versions, earlier than… |
CVE-2017-15351 | Medium | 6.8 | 2018-02-15 | The 'Find Phone' function in Huawei Honor V9 play smart phones with versions earlier than Jimmy-AL00AC00B135 has an authentication bypass vulnerability. Due to… |
CVE-2018-7034 | High | 7.5 | 2018-02-14 | TRENDnet TEW-751DR v1.03B03, TEW-752DRU v1.03B01, and TEW733GR v1.03B01 devices allow authentication bypass via an AUTHORIZED_GROUP=1 value, as demonstrated by… |
CVE-2018-5459 | Critical | 9.8 | 2018-02-13 | An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An attacker can execute different unauthenti… |
CVE-2017-18179 | High | 8.8 | 2018-02-12 | Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a password change or a session termination. Also… |
CVE-2018-3601 | Critical | 9.8 | 2018-02-09 | A password hash usage authentication bypass vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to bypass authentication on vulnerab… |
CVE-2017-0911 | Medium | 5.4 | 2018-02-09 | Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide a… |
CVE-2018-6180 | Critical | 9.8 | 2018-02-08 | A flaw in the profile section of Online Voting System 1.0 allows an unauthenticated user to set an arbitrary password for other accounts. |
CVE-2018-1163 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13. The specific flaw exists wi… |
CVE-2018-0116 | High | 7.2 | 2018-02-08 | A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to be authorized as a subscriber with… |
CVE-2017-6199 | Critical | 9.8 | 2018-02-06 | A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field. |
CVE-2018-6569 | High | 8.8 | 2018-02-06 | West Wind Web Server 6.x does not require authentication for /ADMIN.ASP. |