CWE-287 · Improper Authentication (page 35)
Page 35 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-5794 | Medium | 5.3 | 2018-02-05 | An issue was discovered in Extreme Networks ExtremeWireless WiNG 5.x before 5.8.6.9 and 5.9.x before 5.9.1.3. There is No Authentication for the AeroScout Serv… |
CVE-2017-2297 | High | 7.5 | 2018-02-01 | Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been… |
CVE-2011-4068 | Critical | 9.8 | 2018-02-01 | The check_password function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password. |
CVE-2017-16858 | Medium | 6.8 | 2018-01-31 | The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker t… |
CVE-2017-1000354 | High | 8.8 | 2018-01-29 | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkins user. The `login`… |
CVE-2017-1783 | Medium | 4.0 | 2018-01-29 | IBM Cognos Analytics 11.0 could allow a local user to change parameters set from the Cognos Analytics menus without proper authentication. IBM X-Force ID: 1368… |
CVE-2017-14698 | Critical | 9.8 | 2018-01-29 | ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N… |
CVE-2018-4836 | High | 8.8 | 2018-01-25 | A vulnerability has been identified in TeleControl Server Basic < V3.1. An authenticated attacker with a low-privileged account to the TeleControl Server Basic… |
CVE-2018-4835 | Medium | 5.3 | 2018-01-25 | A vulnerability has been identified in TeleControl Server Basic < V3.1. An attacker with network access to the TeleControl Server Basic's port 8000/tcp could b… |
CVE-2017-15135 | High | 8.1 | 2018-01-24 | It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authenti… |
CVE-2017-15531 | Critical | 9.8 | 2018-01-23 | Symantec Reporter 9.5 prior to 9.5.4.1 and 10.1 prior to 10.1.5.5 does not restrict excessive authentication attempts for management interface users. A remote… |
CVE-2017-16590 | High | 8.8 | 2018-01-23 | This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 1001. User… |
CVE-2015-6926 | High | 7.5 | 2018-01-19 | The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a craft… |
CVE-2018-5328 | Critical | 9.8 | 2018-01-15 | ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows access to various /UserManagement/ privileged modules without authenticating the user; an attacker can misuse th… |
CVE-2014-6436 | Critical | 9.8 | 2018-01-12 | Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices improperly manage sessions, which allows remote attackers to bypass authentication in opportunistic… |
CVE-2014-6435 | High | 7.5 | 2018-01-12 | cgi-bin/AZ_Retrain.cgi in Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices does not check for authentication, which allows remote attackers to cause… |
CVE-2018-0008 | Medium | 6.2 | 2018-01-10 | An unauthenticated root login may allow upon reboot when a commit script is used. A commit script allows a device administrator to execute certain instructions… |
CVE-2017-3765 | High | 7.0 | 2018-01-10 | In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HP Backdoor" was dis… |
CVE-2017-12695 | High | 8.8 | 2018-01-09 | An Improper Authentication issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerabil… |
CVE-2017-15883 | Critical | 9.8 | 2018-01-08 | Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load… |
CVE-2018-3815 | Medium | 5.7 | 2018-01-08 | The "XML Interface to Messaging, Scheduling, and Signaling" (XIMSS) protocol implementation in CommuniGate Pro (CGP) 6.2 suffers from a Missing XIMSS Protocol… |
CVE-2017-15548 | Critical | 9.8 | 2018-01-05 | An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Dat… |
CVE-2017-1000489 | High | 8.1 | 2018-01-03 | Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address |
CVE-2017-1000433 | High | 8.1 | 2018-01-02 | pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing the… |
CVE-2018-3810 | Critical | 9.8 | 2018-01-01 | Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitra… |
CVE-2014-0121 | Critical | 9.8 | 2017-12-29 | The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter. |
CVE-2015-6237 | Critical | 9.8 | 2017-12-27 | The RPC service in Tripwire (formerly nCircle) IP360 VnE Manager 7.2.2 before 7.2.6 allows remote attackers to bypass authentication and (1) enumerate users, (… |
CVE-2015-7224 | Critical | 9.8 | 2017-12-21 | puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'my… |
CVE-2017-17777 | Critical | 9.8 | 2017-12-20 | Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the admin/viewvisitcamp.php fn parameter and th… |
CVE-2017-17560 | Critical | 9.8 | 2017-12-12 | An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provide… |
CVE-2017-16689 | High | 8.8 | 2017-12-12 | A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP KERNEL from 7.21 t… |
CVE-2017-16684 | Critical | 9.8 | 2017-12-12 | SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, and 4.30, does not perform authentication checks for functionalities that re… |
CVE-2017-17430 | Critical | 9.8 | 2017-12-07 | Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote attackers to execute arbitrary commands via the web interface. |
CVE-2017-17435 | High | 8.8 | 2017-12-07 | An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line withou… |
CVE-2017-14018 | Medium | 4.8 | 2017-12-05 | An improper authentication issue was discovered in Johnson & Johnson Ethicon Endo-Surgery Generator Gen11, all versions released before November 29, 2017. The… |
CVE-2017-16953 | High | 7.5 | 2017-12-01 | connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows remote attackers to modify the PPPoE configuration or set up… |
CVE-2017-10903 | Critical | 9.8 | 2017-12-01 | Improper authentication issue in PTW-WMS1 firmware version 2.000.012 allows remote attackers to log in to the device with root privileges and conduct arbitrary… |
CVE-2017-14377 | Critical | 9.8 | 2017-11-29 | EMC RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 ha… |
CVE-2017-13872 | High | 8.1 | 2017-11-29 | An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The issue involves the "Directory Utility" co… |
CVE-2017-9316 | Medium | 6.5 | 2017-11-27 | Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerability was caused by internal Debug funct… |
CVE-2017-0910 | High | 8.8 | 2017-11-27 | In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server cre… |
CVE-2017-8028 | High | 8.1 | 2017-11-27 | In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthentica… |
CVE-2017-8214 | Medium | 6.2 | 2017-11-22 | Honor 8,Honor V8,Honor 9,Honor V9,Nova 2,Nova 2 Plus,P9,P10 Plus,Toronto Huawei smart phones with software of versions earlier than FRD-AL00C00B391, versions e… |
CVE-2017-8195 | High | 8.8 | 2017-11-22 | The FusionSphere OpenStack V100R006C00SPC102(NFV) has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, r… |
CVE-2017-8194 | High | 8.8 | 2017-11-22 | The FusionSphere OpenStack V100R006C00SPC102(NFV) has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, r… |
CVE-2017-8151 | Medium | 6.8 | 2017-11-22 | Huawei Honor 5S smart phones with software the versions before TAG-TL00C01B173 have an authentication bypass vulnerability due to the improper design of some c… |
CVE-2017-2738 | Critical | 9.8 | 2017-11-22 | VCM5010 with software versions earlier before V100R002C50SPC100 has an authentication bypass vulnerability. This is due to improper implementation of authentic… |
CVE-2017-2721 | Medium | 4.6 | 2017-11-22 | Some Huawei smart phones with software Berlin-L21C10B130,Berlin-L21C185B133,Berlin-L21HNC10B131,Berlin-L21HNC185B140,Berlin-L21HNC432B151,Berlin-L22C636B160,Be… |
CVE-2017-8861 | Critical | 9.8 | 2017-11-22 | Missing authentication for the remote configuration port 1236/tcp on the Cohu 3960HD allows an attacker to change configuration parameters such as IP address a… |
CVE-2017-16613 | Critical | 9.8 | 2017-11-21 | An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy serv… |
CVE-2017-16566 | Critical | 9.8 | 2017-11-17 | On Jooan IP Camera A5 2.3.36 devices, an insecure FTP server does not require authentication, which allows remote attackers to read or replace core system file… |
CVE-2017-12337 | Critical | 9.8 | 2017-11-16 | A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthentic… |
CVE-2017-12316 | High | 7.5 | 2017-11-16 | A vulnerability in the Guest Portal login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform multiple logi… |
CVE-2017-15272 | Medium | 5.3 | 2017-11-15 | The PSFTPd 10.0.4 Build 729 server stores its configuration inside PSFTPd.dat. This file is a Microsoft Access Database and can be extracted. The application s… |
CVE-2017-9314 | High | 8.8 | 2017-11-13 | Authentication vulnerability found in Dahua NVR models NVR50XX, NVR52XX, NVR54XX, NVR58XX with software before DH_NVR5xxx_Eng_P_V2.616.0000.0.R.20171102. Attac… |
CVE-2017-16634 | Critical | 9.8 | 2017-11-10 | In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method. |
CVE-2017-16562 | Critical | 9.8 | 2017-11-10 | The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain ad… |
CVE-2017-2914 | High | 8.1 | 2017-11-07 | An exploitable authentication bypass vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A specially crafted token can bypass… |
CVE-2017-2864 | Critical | 9.8 | 2017-11-07 | An exploitable vulnerability exists in the generation of authentication token functionality of Circle with Disney. Specially crafted network packets can cause… |
CVE-2017-1000154 | Critical | 9.8 | 2017-11-03 | Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to some authentication methods, which do not use Mahara's built-in… |
CVE-2017-12281 | High | 7.5 | 2017-11-02 | A vulnerability in the implementation of Protected Extensible Authentication Protocol (PEAP) functionality for standalone configurations of Cisco Aironet 1800… |
CVE-2017-10873 | High | 8.1 | 2017-11-02 | OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized contents via unspecified vectors. Note that this vulnerability… |
CVE-2017-1222 | Medium | 6.5 | 2017-10-26 | IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) does not perform an authentication check for a critical resource or functionality allowing anonym… |
CVE-2017-12160 | High | 7.2 | 2017-10-26 | It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indef… |
CVE-2017-9946 | High | 7.5 | 2017-10-23 | A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. An attacker with network access to… |
CVE-2017-5635 | High | 7.5 | 2017-10-19 | In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node ide… |
CVE-2017-12251 | Critical | 9.9 | 2017-10-19 | A vulnerability in the web console of the Cisco Cloud Services Platform (CSP) 2100 could allow an authenticated, remote attacker to interact maliciously with t… |
CVE-2017-14322 | Critical | 9.8 | 2017-10-18 | The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remote attackers to byp… |
CVE-2017-9625 | High | 8.2 | 2017-10-17 | An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5. The web application lacks proper authentication which… |
CVE-2017-15297 | High | 7.5 | 2017-10-16 | SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993. |
CVE-2017-15295 | Critical | 9.8 | 2017-10-16 | Xpress Server in SAP POS does not require authentication for read/write/delete file access. This is SAP Security Note 2520064. |
CVE-2017-15293 | Critical | 9.8 | 2017-10-16 | Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or certain attacks on c… |
CVE-2017-10623 | High | 7.1 | 2017-10-13 | Lack of authentication and authorization of cluster messages in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to intercept, injec… |
CVE-2017-10622 | Critical | 9.8 | 2017-10-13 | An authentication bypass vulnerability in Juniper Networks Junos Space Network Management Platform may allow a remote unauthenticated network based attacker to… |
CVE-2016-5791 | Critical | 9.8 | 2017-10-13 | An Improper Authentication issue was discovered in JanTek JTC-200, all versions. The improper authentication could provide an undocumented BusyBox Linux shell… |
CVE-2017-5791 | Critical | 9.8 | 2017-10-11 | The doFilter method in UrlAccessController in HPE Intelligent Management Center (iMC) PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified… |
CVE-2017-14003 | Critical | 9.8 | 2017-10-11 | An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01.00/29.03.2007 and prior versions. An i… |
CVE-2017-14972 | High | 7.5 | 2017-10-09 | InFocus Mondopad 2.2.08 is vulnerable to authentication bypass when accessing uploaded files by entering Control-Alt-Delete, and then using Task Manager to rea… |
CVE-2016-8937 | Critical | 9.8 | 2017-10-05 | The IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) default authentication protocol is vulnerable to a brute force attack due to disclosing too m… |
CVE-2017-14000 | Critical | 9.4 | 2017-10-05 | An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11. By accessing a specific uniform resourc… |
CVE-2017-13995 | Critical | 10.0 | 2017-10-05 | An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100. The webserver does not properly authent… |
CVE-2017-1000110 | Medium | 4.3 | 2017-10-05 | Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsf… |
CVE-2017-1000106 | High | 8.5 | 2017-10-05 | Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsf… |
CVE-2017-12819 | Critical | 9.8 | 2017-10-04 | Remote manipulations with language pack updater lead to NTLM-relay attack for system user in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior… |
CVE-2017-13984 | Medium | 6.5 | 2017-09-30 | An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users… |
CVE-2017-13983 | Critical | 9.8 | 2017-09-30 | An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users… |
CVE-2017-12236 | Critical | 9.8 | 2017-09-29 | A vulnerability in the implementation of the Locator/ID Separation Protocol (LISP) in Cisco IOS XE 3.2 through 16.5 could allow an unauthenticated, remote atta… |
CVE-2017-12229 | Critical | 9.8 | 2017-09-29 | A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 could allow an unauthenticated, remote attacker to by… |
CVE-2017-14766 | High | 7.5 | 2017-09-27 | The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() function and fn_ssr_d… |
CVE-2017-5192 | High | 8.8 | 2017-09-26 | When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authenti… |
CVE-2017-14602 | High | 7.2 | 2017-09-26 | A vulnerability has been identified in the management interface of Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before bui… |
CVE-2017-14706 | Critical | 9.8 | 2017-09-22 | DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download… |
CVE-2017-14080 | Critical | 9.8 | 2017-09-22 | Authentication bypass vulnerability in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allows attackers to access a specific part of the c… |
CVE-2015-1187 | Critical | 9.8 | 2017-09-21 | The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp. |
CVE-2017-14623 | High | 8.1 | 2017-09-20 | In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using thi… |
CVE-2017-10784 | High | 8.8 | 2017-09-19 | The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal e… |
CVE-2014-9618 | Critical | 9.8 | 2017-09-19 | The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and sub… |
CVE-2014-9611 | Critical | 9.8 | 2017-09-19 | Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php. |
CVE-2017-9803 | High | 7.5 | 2017-09-18 | Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another app… |
CVE-2017-14243 | Critical | 9.8 | 2017-09-17 | An authentication bypass vulnerability on UTStar WA3002G4 ADSL Broadband Modem WA3002G4-0021.01 devices allows attackers to directly access administrative sett… |