CWE-287 · Improper Authentication (page 34)
Page 34 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-17134 | Critical | 9.1 | 2019-10-08 | Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certif… |
CVE-2019-16929 | High | 7.5 | 2019-10-08 | Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens. |
CVE-2019-13336 | Critical | 9.8 | 2019-10-08 | The dbell Wi-Fi Smart Video Doorbell DB01-S Gen 1 allows remote attackers to launch commands with no authentication verification via TCP port 81, because the l… |
CVE-2019-11733 | Critical | 9.8 | 2019-09-27 | When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that local… |
CVE-2019-12664 | High | 7.5 | 2019-09-25 | A vulnerability in the Dialer interface feature for ISDN connections in Cisco IOS XE Software for Cisco 4000 Series Integrated Services Routers (ISRs) could al… |
CVE-2019-14239 | Medium | 6.6 | 2019-09-24 | On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeat… |
CVE-2019-14238 | Medium | 6.6 | 2019-09-24 | On STMicroelectronics STM32F7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated with a debug probe via th… |
CVE-2019-16649 | Critical | 10.0 | 2019-09-21 | On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of… |
CVE-2019-6832 | High | 8.3 | 2019-09-17 | A CWE-287: Authentication vulnerability exists in spaceLYnk (all versions before 2.4.0) and Wiser for KNX (all versions before 2.4.0 - formerly known as homeLY… |
CVE-2016-10983 | Medium | 6.5 | 2019-09-17 | The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data. |
CVE-2019-16261 | Critical | 9.1 | 2019-09-12 | Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the ma… |
CVE-2019-16250 | High | 7.5 | 2019-09-11 | includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Shee… |
CVE-2019-16190 | Critical | 9.8 | 2019-09-09 | SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 devices allows Authentication Bypass, as… |
CVE-2019-5473 | High | 7.2 | 2019-09-09 | An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4. |
CVE-2019-12405 | Critical | 9.8 | 2019-09-09 | Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Given a u… |
CVE-2019-13188 | Critical | 9.8 | 2019-09-05 | In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application. |
CVE-2019-13361 | Medium | 6.5 | 2019-09-05 | Smanos W100 1.0.0 devices have Insecure Permissions, exploitable by an attacker on the same Wi-Fi network. |
CVE-2019-13190 | Medium | 5.3 | 2019-09-05 | In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. This allows for CAPTCHA bypass in the signup page. |
CVE-2019-13526 | High | 8.8 | 2019-08-30 | Datalogic AV7000 Linear barcode scanner all versions prior to 4.6.0.0 is vulnerable to authentication bypass, which may allow an attacker to remotely execute a… |
CVE-2019-11064 | Critical | 9.8 | 2019-08-29 | A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is… |
CVE-2019-12643 | Critical | 10.0 | 2019-08-28 | A vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass authenticat… |
CVE-2019-15648 | Medium | 6.5 | 2019-08-27 | The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber. |
CVE-2019-13423 | High | 8.8 | 2019-08-23 | Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user wh… |
CVE-2014-10389 | Critical | 9.8 | 2019-08-22 | The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication. |
CVE-2019-1974 | Critical | 9.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Ex… |
CVE-2019-1938 | Critical | 9.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote… |
CVE-2019-1937 | Critical | 9.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Ex… |
CVE-2019-6143 | Critical | 9.1 | 2019-08-20 | Forcepoint Next Generation Firewall (Forcepoint NGFW) 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has a serious authentication vulnerability… |
CVE-2019-11187 | Critical | 9.8 | 2019-08-15 | Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-in… |
CVE-2018-14008 | Medium | 6.5 | 2019-08-15 | Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled. |
CVE-2019-15046 | High | 7.5 | 2019-08-14 | Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-7998… |
CVE-2019-5223 | High | 7.8 | 2019-08-13 | PCManager 9.1.3.1 has an improper authentication vulnerability. The certain driver interface of the software does not perform a validation of user-mode data pr… |
CVE-2019-14985 | Critical | 9.8 | 2019-08-13 | eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because t… |
CVE-2018-20954 | High | 7.5 | 2019-08-08 | The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys. |
CVE-2019-1946 | Medium | 6.5 | 2019-08-08 | A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker t… |
CVE-2019-14432 | High | 8.8 | 2019-08-07 | Incorrect authentication of application WebSocket connections in Loom Desktop for Mac up to 0.16.0 allows remote code execution from either malicious JavaScrip… |
CVE-2019-14705 | High | 7.2 | 2019-08-06 | An Incorrect Access Control issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5 because any valid cookie can be used to make… |
CVE-2019-5679 | High | 7.8 | 2019-08-06 | NVIDIA Shield TV Experience prior to v8.0, NVIDIA Tegra bootloader contains a vulnerability in nvtboot where the Trusted OS image is improperly authenticated… |
CVE-2019-7163 | Critical | 9.8 | 2019-08-02 | The web interface of Alcatel LINKZONE MW40-V-V1.0 MW40_LU_02.00_02 devices is vulnerable to an authentication bypass that allows an unauthenticated user to hav… |
CVE-2018-1987 | High | 7.8 | 2019-08-02 | IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect node password may be displayed in plain te… |
CVE-2016-10826 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93). |
CVE-2018-20937 | Medium | 4.3 | 2019-08-01 | cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321). |
CVE-2016-10835 | Medium | 4.3 | 2019-08-01 | cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107). |
CVE-2016-10833 | High | 7.5 | 2019-08-01 | cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104). |
CVE-2016-10832 | Medium | 6.5 | 2019-08-01 | cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102). |
CVE-2016-10831 | High | 7.2 | 2019-08-01 | cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101). |
CVE-2018-20924 | Medium | 5.5 | 2019-08-01 | cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads (SEC-378). |
CVE-2016-10836 | Medium | 6.5 | 2019-08-01 | cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108). |
CVE-2019-3884 | Medium | 5.4 | 2019-08-01 | A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from another namespace is abl… |
CVE-2018-20888 | Medium | 5.5 | 2019-08-01 | cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authentication (SEC-424). |
CVE-2019-5455 | Medium | 6.8 | 2019-07-30 | Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process. |
CVE-2019-5453 | Medium | 6.1 | 2019-07-30 | Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to… |
CVE-2019-5449 | Medium | 4.3 | 2019-07-30 | A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events. |
CVE-2019-11202 | Critical | 9.8 | 2019-07-30 | An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher s… |
CVE-2018-17213 | High | 8.8 | 2019-07-29 | An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. A user without valid credentials can bypass the authentication process, obtain… |
CVE-2019-1020018 | High | 7.3 | 2019-07-29 | Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link. |
CVE-2018-13927 | High | 7.8 | 2019-07-22 | Debug policy with invalid signature can be loaded when the debug policy functionality is disabled by using the parallel image loading in Snapdragon Auto, Snapd… |
CVE-2015-7882 | High | 8.1 | 2019-07-19 | Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access. |
CVE-2019-1917 | Critical | 9.1 | 2019-07-17 | A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on… |
CVE-2018-18095 | Medium | 6.8 | 2019-07-11 | Improper authentication in firmware for Intel(R) SSD DC S4500 Series and Intel(R) SSD DC S4600 Series before SCV10150 may allow an unprivileged user to potenti… |
CVE-2019-10966 | Medium | 5.3 | 2019-07-10 | In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected via an added unsecured terminal server to a TCP/IP… |
CVE-2019-9629 | Critical | 9.8 | 2019-07-08 | Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials). |
CVE-2019-13372 | Critical | 9.8 | 2019-07-06 | /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via… |
CVE-2019-5964 | High | 8.8 | 2019-07-05 | iDoors Reader 2.10.17 and earlier allows an attacker on the same network segment to bypass authentication to access the management console and operate the prod… |
CVE-2019-13294 | Critical | 9.8 | 2019-07-04 | AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session control. Therefore an unauthenticated user… |
CVE-2019-12845 | Medium | 5.3 | 2019-07-03 | The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3. |
CVE-2018-11426 | Critical | 9.8 | 2019-07-03 | A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker can brute force param… |
CVE-2017-8405 | High | 7.5 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by th… |
CVE-2019-7666 | High | 8.8 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash value of the password, which may allow an a… |
CVE-2019-10964 | High | 7.1 | 2019-06-28 | Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters… |
CVE-2018-14868 | Medium | 6.5 | 2019-06-28 | Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of o… |
CVE-2018-15556 | Critical | 9.8 | 2019-06-27 | The Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 allows login with root level access with the user "root" and an empty password by using th… |
CVE-2019-7226 | High | 8.8 | 2019-06-27 | The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to privileged functions… |
CVE-2019-11272 | High | 7.3 | 2019-06-26 | Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application usi… |
CVE-2019-10689 | Medium | 6.5 | 2019-06-24 | VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides in… |
CVE-2019-2018 | High | 8.8 | 2019-06-19 | In resetPasswordInternal of DevicePolicyManagerService.java, there is a possible bypass of password reset protection due to an unusual root cause. Remote user… |
CVE-2019-11232 | Critical | 9.8 | 2019-06-19 | EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information (Password) without being authenticated, by sending an EMP_NO element to the kw… |
CVE-2018-18877 | High | 8.8 | 2019-06-18 | In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alternative configuration page config_main.php that al… |
CVE-2019-10998 | Medium | 6.8 | 2019-06-18 | An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LTS devices. Unlimite… |
CVE-2017-9389 | High | 8.8 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device… |
CVE-2017-9383 | Critical | 9.9 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be… |
CVE-2019-7579 | High | 7.5 | 2019-06-17 | An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. An ability exists for an unauthenticated user to browse a confidential ui/1.0.99.187766/dyn… |
CVE-2019-10157 | Medium | 4.7 | 2019-06-12 | It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An… |
CVE-2019-10150 | Medium | 5.9 | 2019-06-12 | It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. A… |
CVE-2018-19999 | High | 7.8 | 2019-06-07 | The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the… |
CVE-2019-1842 | Medium | 5.4 | 2019-06-05 | A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated, remote attacker to successfully log in… |
CVE-2018-7123 | High | 7.5 | 2019-06-05 | A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2018-7121 | Critical | 9.8 | 2019-06-05 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2018-18571 | Critical | 9.1 | 2019-06-05 | An Incorrect Access Control vulnerability has been identified in Citrix XenMobile Server 10.8.0 before Rolling Patch 6 and 10.9.0 before Rolling Patch 3. An at… |
CVE-2019-5298 | Medium | 6.8 | 2019-06-04 | There is an improper authentication vulnerability in some Huawei AP products before version V200R009C00SPC800. Due to the improper implementation of authentica… |
CVE-2019-12564 | Critical | 9.8 | 2019-06-03 | In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backup/DyyyymmddThhmmss… |
CVE-2019-12530 | Critical | 9.8 | 2019-06-02 | Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and… |
CVE-2019-12440 | Critical | 9.8 | 2019-05-29 | The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard… |
CVE-2019-12395 | Medium | 5.3 | 2019-05-28 | In Webbukkit Dynmap 3.0-beta-3 or below, due to a missing login check in servlet/MapStorageHandler.java, an attacker can see a map image without login even if… |
CVE-2018-12013 | High | 7.8 | 2019-05-24 | Improper authentication in locked memory region can lead to unprivilged access to the memory in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electr… |
CVE-2018-11271 | Critical | 9.8 | 2019-05-24 | Improper authentication can happen on Remote command handling due to inappropriate handling of events in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec… |
CVE-2019-12300 | Critical | 9.8 | 2019-05-23 | Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a tok… |
CVE-2019-6814 | Critical | 9.8 | 2019-05-22 | A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impact to confidentiali… |
CVE-2018-7847 | Critical | 9.8 | 2019-05-22 | A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cau… |
CVE-2019-8443 | High | 8.1 | 2019-05-22 | The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote att… |