CWE-287 · Improper Authentication (page 36)
Page 36 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-14709 | Critical | 9.8 | 2018-12-03 | Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token genera… |
CVE-2018-14708 | Critical | 9.8 | 2018-12-03 | An insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept network traffic. |
CVE-2018-14637 | Medium | 6.1 | 2018-11-30 | The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnera… |
CVE-2018-7958 | High | 7.4 | 2018-11-27 | There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack… |
CVE-2018-19458 | High | 7.5 | 2018-11-22 | In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2… |
CVE-2018-16160 | High | 7.8 | 2018-11-15 | SecureCore Standard Edition Version 2.x allows an attacker to bypass the product 's authentication to log in to a Windows PC. |
CVE-2018-7358 | Medium | 6.5 | 2018-11-14 | ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may al… |
CVE-2018-3696 | Medium | 5.5 | 2018-11-14 | Authentication bypass in the Intel RAID Web Console 3 for Windows before 4.186 may allow an unprivileged user to potentially gain administrative privileges via… |
CVE-2018-2483 | Medium | 4.3 | 2018-11-13 | HTTP Verb Tampering is possible in SAP BusinessObjects Business Intelligence Platform, versions 4.1 and 4.2, Central Management Console (CMC) by changing reque… |
CVE-2018-7910 | Medium | 6.8 | 2018-11-13 | Some Huawei smartphones ALP-AL00B 8.0.0.118D(C00), ALP-TL00B 8.0.0.118D(C01), BLA-AL00B 8.0.0.118D(C00), BLA-L09C 8.0.0.127(C432), 8.0.0.128(C432), 8.0.0.137(C… |
CVE-2018-19076 | Critical | 9.8 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-17918 | Critical | 9.8 | 2018-11-02 | Circontrol CirCarLife all versions prior to 4.3.1, authentication to the device can be bypassed by entering the URL of a specific page. |
CVE-2018-6908 | Critical | 9.8 | 2018-11-01 | An authentication bypass vulnerability exists in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application allowing an unauthen… |
CVE-2018-6011 | High | 8.1 | 2018-11-01 | The time-based one-time-password (TOTP) function in the application logic of the Green Electronics RainMachine Mini-8 (2nd generation) uses the administrator's… |
CVE-2018-18891 | High | 7.5 | 2018-11-01 | MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late. |
CVE-2016-2125 | Medium | 6.5 | 2018-10-31 | It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba… |
CVE-2018-16467 | Medium | 5.3 | 2018-10-30 | A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares. |
CVE-2018-16465 | Medium | 5.3 | 2018-10-30 | Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second factor failed to load. |
CVE-2018-16464 | Medium | 5.7 | 2018-10-30 | A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the pass… |
CVE-2016-10732 | Critical | 9.8 | 2018-10-29 | ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.ph… |
CVE-2018-17923 | Medium | 6.9 | 2018-10-24 | SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that an attacker with physical access to the product may able to reprogram it. |
CVE-2018-15751 | Critical | 9.8 | 2018-10-24 | SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi). |
CVE-2018-18014 | Medium | 4.8 | 2018-10-24 | * Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to private s… |
CVE-2018-12667 | Critical | 9.8 | 2018-10-19 | The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) is affected by an improper authentication vulnerability that al… |
CVE-2018-12666 | Critical | 9.8 | 2018-10-19 | SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B devices improperly identifies users only by the authentication level sent in the cookies, which allow re… |
CVE-2018-1822 | Critical | 9.8 | 2018-10-18 | IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely… |
CVE-2018-7989 | Medium | 4.6 | 2018-10-17 | Huawei Mate 10 pro smartphones with the versions before BLA-AL00B 8.1.0.326(C00) have an improper authentication vulnerability. App Lock is a function to preve… |
CVE-2018-7076 | Critical | 9.8 | 2018-10-17 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) prior to iMC PLAT 7.3 E0605P04. |
CVE-2018-10933 | Critical | 9.1 | 2018-10-17 | A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first perform… |
CVE-2018-18389 | Critical | 9.8 | 2018-10-16 | Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Accoun… |
CVE-2018-17534 | Medium | 6.8 | 2018-10-15 | Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper access control. This allows attackers with… |
CVE-2018-1738 | High | 7.1 | 2018-10-11 | IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0 could allow an authenticated user to obtain highly sensitive information or jeopardize system integrity due to… |
CVE-2018-18061 | High | 7.5 | 2018-10-10 | An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. Attackers can access the file manager interface that provides them with the abil… |
CVE-2018-16738 | Low | 3.7 | 2018-10-10 | tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1. |
CVE-2018-16737 | Medium | 5.3 | 2018-10-10 | tinc before 1.0.30 has a broken authentication protocol, without even a partial mitigation. |
CVE-2018-13789 | High | 7.5 | 2018-10-10 | An issue was discovered in Descor Infocad FM before 3.1.0.0. An unauthenticated web service allows the retrieval of files on the web server and on reachable SM… |
CVE-2018-12455 | High | 8.1 | 2018-10-10 | Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using "ad… |
CVE-2018-0053 | Medium | 6.8 | 2018-10-10 | An authentication bypass vulnerability in the initial boot sequence of Juniper Networks Junos OS on vSRX Series may allow an attacker to gain full control of t… |
CVE-2018-0052 | High | 7.2 | 2018-10-10 | If RSH service is enabled on Junos OS and if the PAM authentication is disabled, a remote unauthenticated attacker can obtain root access to the device. RSH se… |
CVE-2018-0044 | Critical | 9.8 | 2018-10-10 | An insecure SSHD configuration in Juniper Device Manager (JDM) and host OS on Juniper NFX Series devices may allow remote unauthenticated access if any of the… |
CVE-2018-15543 | Medium | 6.8 | 2018-10-09 | An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The FingerprintManager class for Biometric validation allows authenticati… |
CVE-2018-15542 | Medium | 6.4 | 2018-10-09 | An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The Passcode feature allows authentication bypass via runtime manipulatio… |
CVE-2018-14080 | High | 7.5 | 2018-10-09 | An issue was discovered on D-Link DIR-809 A1 through 1.09, A2 through 1.11, and Guest Zone through 1.09 devices. One can bypass authentication mechanisms to do… |
CVE-2012-6710 | Critical | 9.8 | 2018-10-07 | ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to… |
CVE-2018-15371 | Medium | 6.7 | 2018-10-05 | A vulnerability in the shell access request mechanism of Cisco IOS XE Software could allow an authenticated, local attacker to bypass authentication and gain u… |
CVE-2018-0435 | Critical | 9.1 | 2018-10-05 | A vulnerability in the Cisco Umbrella API could allow an authenticated, remote attacker to view and modify data across their organization and other organizatio… |
CVE-2013-7465 | Critical | 9.8 | 2018-10-05 | Ice Cold Apps Servers Ultimate 6.0.2(12) does not require authentication for TELNET, SSH, or FTP, which allows remote attackers to execute arbitrary code by up… |
CVE-2018-0505 | Medium | 6.5 | 2018-10-04 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock |
CVE-2018-12472 | High | 7.3 | 2018-10-04 | A improper authentication using the HOST header in SUSE Linux SMT allows remote attackers to spoof a sibling server. Affected releases are SUSE Linux SMT: vers… |
CVE-2018-6689 | High | 7.8 | 2018-10-03 | Authentication Bypass vulnerability in McAfee Data Loss Prevention Endpoint (DLPe) 10.0.x earlier than 10.0.510, and 11.0.x earlier than 11.0.600 allows attack… |
CVE-2018-14826 | Critical | 9.8 | 2018-10-02 | Entes EMG12 versions 2.57 and prior The application uses a web interface where it is possible for an attacker to bypass authentication with a specially crafted… |
CVE-2018-17786 | Critical | 9.8 | 2018-10-02 | On D-Link DIR-823G devices, ExportSettings.sh, upload_settings.cgi, GetDownLoadSyslog.sh, and upload_firmware.cgi do not require authentication, which allows r… |
CVE-2018-1672 | Medium | 5.0 | 2018-10-01 | IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the… |
CVE-2018-9080 | Medium | 5.9 | 2018-09-28 | For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's… |
CVE-2018-7108 | Medium | 5.9 | 2018-09-27 | HPE StorageWorks XP7 Automation Director (AutoDir) version 8.5.2-02 to earlier than 8.6.1-00 has a local and remote authentication bypass vulnerability that ex… |
CVE-2018-1539 | Medium | 5.4 | 2018-09-25 | IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication via a direct request or… |
CVE-2018-17341 | High | 8.1 | 2018-09-23 | BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonst… |
CVE-2018-12169 | High | 7.6 | 2018-09-21 | Platform sample code firmware in 4th Generation Intel Core Processor, 5th Generation Intel Core Processor, 6th Generation Intel Core Processor, 7th Generation… |
CVE-2018-14643 | Critical | 9.8 | 2018-09-21 | An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitr… |
CVE-2018-12242 | Critical | 9.8 | 2018-09-19 | The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to an authentication bypass exploit, which is a type of issue that can allow attacker… |
CVE-2017-3912 | Medium | 4.4 | 2018-09-18 | Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary comma… |
CVE-2018-16670 | Medium | 5.3 | 2018-09-18 | An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html. |
CVE-2018-16668 | Medium | 5.3 | 2018-09-18 | An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/reposit… |
CVE-2018-17153 | Critical | 9.8 | 2018-09-18 | It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker c… |
CVE-2018-11787 | High | 8.1 | 2018-09-18 | In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires aut… |
CVE-2017-2872 | High | 7.2 | 2018-09-17 | Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A HTTP request can… |
CVE-2018-16286 | Critical | 9.8 | 2018-09-14 | LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to fo… |
CVE-2018-7572 | Medium | 6.8 | 2018-09-12 | Pulse Secure Client 9.0R1 and 5.3RX before 5.3R5, when configured to authenticate VPN users during Windows Logon, can allow attackers to bypass Windows authent… |
CVE-2018-1773 | Medium | 4.3 | 2018-09-12 | IBM Datacap Fastdoc Capture 9.1.1, 9.1.3, and 9.1.4 could allow an authenticated user to bypass future authentication mechanisms once the initial login is comp… |
CVE-2018-16947 | Critical | 9.8 | 2018-09-12 | An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (… |
CVE-2018-15485 | Critical | 9.1 | 2018-09-07 | An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. FTP does not require authentication or authorization, aka KONE-03. |
CVE-2018-16590 | Critical | 9.8 | 2018-09-06 | FURUNO FELCOM 250 and 500 devices use only client-side JavaScript in login.js for authentication. |
CVE-2017-14026 | High | 7.5 | 2018-09-06 | In Ice Qube Thermal Management Center versions prior to version 4.13, the web application does not properly authenticate users which may allow an attacker to g… |
CVE-2018-15479 | Medium | 6.5 | 2018-08-30 | An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip be… |
CVE-2018-15478 | High | 8.1 | 2018-08-30 | An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, WiFi Bulb before 2.58, WiFi LED Strip be… |
CVE-2018-13821 | Critical | 9.8 | 2018-08-30 | A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to conduct a variety of attacks, including fil… |
CVE-2018-7791 | Critical | 9.8 | 2018-08-29 | A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware… |
CVE-2018-14805 | Critical | 9.8 | 2018-08-29 | ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP is set to allow anonymous authentication, and specific key values within the eSOM… |
CVE-2018-15727 | Critical | 9.8 | 2018-08-29 | Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing… |
CVE-2017-9820 | Critical | 9.8 | 2018-08-24 | The National Payments Corporation of India BHIM application 1.3 for Android uses a custom keypad for which the input element is available to the Accessibility… |
CVE-2017-9819 | Critical | 9.8 | 2018-08-24 | The National Payments Corporation of India BHIM application 1.3 for Android does not properly restrict use of the OTP feature, which makes it easier for attack… |
CVE-2018-14786 | Critical | 9.4 | 2018-08-23 | Becton, Dickinson and Company (BD) Alaris Plus medical syringe pumps (models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA) versions 2.3.6 and prior are aff… |
CVE-2018-1999045 | Medium | 5.4 | 2018-08-23 | A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that… |
CVE-2017-16348 | High | 7.5 | 2018-08-23 | An exploitable denial of service vulnerability exists in Insteon Hub running firmware version 1012. Leftover demo functionality allows for arbitrarily rebootin… |
CVE-2018-15667 | High | 7.5 | 2018-08-21 | An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. It registers and uses the airmail:// URL scheme. The "send" command in the URL scheme allows an ext… |
CVE-2018-15598 | High | 7.5 | 2018-08-21 | Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly rea… |
CVE-2017-16748 | Critical | 9.8 | 2018-08-20 | An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior) using a disable… |
CVE-2018-14078 | Critical | 9.8 | 2018-08-20 | Wi2be SMART HP WMT R1.2.20_201400922 allows unauthorized remote attackers to reset the admin password via the /ConfigWizard/ChangePwd.esp?2admin URL (Attackers… |
CVE-2018-13446 | High | 7.0 | 2018-08-16 | An issue was discovered in the LINE jp.naver.line application 8.8.1 for Android. The Passcode feature allows authentication bypass via runtime manipulation tha… |
CVE-2018-13435 | High | 7.0 | 2018-08-16 | An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The Passcode feature allows authentication bypass via runtime manipulation that fo… |
CVE-2018-13434 | Medium | 6.3 | 2018-08-16 | An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The LAContext class for Biometric (TouchID) validation allows authentication bypas… |
CVE-2018-15152 | Critical | 9.1 | 2018-08-15 | Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access (1) portal/add_edit… |
CVE-2018-2449 | High | 8.6 | 2018-08-14 | SAP SRM MDM Catalog versions 3.73, 7.31, 7.32 in (SAP NetWeaver 7.3) - import functionality does not perform authentication checks for valid repository user. T… |
CVE-2018-14781 | Medium | 5.3 | 2018-08-13 | Medtronic MiniMed MMT devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerab… |
CVE-2018-11770 | Medium | 4.2 | 2018-08-13 | From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit… |
CVE-2018-3775 | High | 8.8 | 2018-08-12 | Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authenticatio… |
CVE-2018-14782 | High | 7.5 | 2018-08-10 | NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The device allows access to configuration files and profiles wit… |
CVE-2018-10630 | Critical | 9.8 | 2018-08-10 | For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there i… |
CVE-2018-7069 | High | 7.5 | 2018-08-06 | HPE has identified a remote unauthenticated access to files vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is r… |
CVE-2018-7058 | Critical | 9.8 | 2018-08-06 | Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an attacker can leverage this vulnerability to ga… |