CWE-287 · Improper Authentication (page 36)
Page 36 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1002024 | Medium | 4.3 | 2017-09-14 | Vulnerability in web application Kind Editor v4.1.12, kindeditor/php/upload_json.php does not check authentication before allow users to upload files. |
CVE-2017-1520 | Low | 3.7 | 2017-09-12 | IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication type is CLIENT. IBM X-F… |
CVE-2017-14337 | High | 8.1 | 2017-09-12 | When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an… |
CVE-2014-9624 | High | 7.5 | 2017-09-12 | CAPTCHA bypass vulnerability in MantisBT before 1.2.19. |
CVE-2017-7650 | Medium | 6.5 | 2017-09-11 | In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely conn… |
CVE-2017-7649 | Critical | 9.8 | 2017-09-11 | The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. S… |
CVE-2017-12225 | Medium | 6.5 | 2017-09-07 | A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's admi… |
CVE-2017-12213 | Medium | 4.3 | 2017-09-07 | A vulnerability in the dynamic access control list (ACL) feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches could allow an unauthe… |
CVE-2017-14147 | Critical | 9.8 | 2017-09-07 | An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a router to its factory se… |
CVE-2015-3442 | Critical | 9.8 | 2017-09-07 | Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call. |
CVE-2017-14117 | Medium | 5.9 | 2017-09-03 | The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service… |
CVE-2015-7746 | Critical | 9.8 | 2017-09-01 | NetApp Data ONTAP before 8.2.4, when operating in 7-Mode, allows remote attackers to bypass authentication and (1) obtain sensitive information from or (2) mod… |
CVE-2017-14032 | High | 8.1 | 2017-08-30 | ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 c… |
CVE-2017-12698 | Critical | 9.8 | 2017-08-30 | An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Specially crafted requests allow a possible authenticat… |
CVE-2015-8332 | High | 8.8 | 2017-08-28 | Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote auth… |
CVE-2015-1401 | Critical | 9.8 | 2017-08-28 | Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3. |
CVE-2017-7934 | Medium | 5.9 | 2017-08-25 | An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017. PI Network Manager using older protocol versi… |
CVE-2017-7930 | High | 7.4 | 2017-08-25 | An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017. PI Data Archive has protocol flaws with the p… |
CVE-2015-3206 | High | 8.1 | 2017-08-25 | The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of… |
CVE-2014-7860 | Medium | 5.3 | 2017-08-25 | The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows rem… |
CVE-2014-7858 | Critical | 9.8 | 2017-08-25 | The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the username cookie para… |
CVE-2014-7857 | Critical | 9.8 | 2017-08-25 | D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2… |
CVE-2015-8308 | High | 7.8 | 2017-08-24 | LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections. |
CVE-2016-4460 | Critical | 9.8 | 2017-08-22 | Apache Pony Mail 0.6c through 0.8b allows remote attackers to bypass authentication. |
CVE-2016-2102 | Medium | 5.3 | 2017-08-22 | HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network. |
CVE-2017-7557 | High | 8.8 | 2017-08-22 | dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack. |
CVE-2017-7420 | Critical | 9.8 | 2017-08-21 | An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server… |
CVE-2015-4464 | Critical | 9.8 | 2017-08-18 | Kguard Digital Video Recorder 104, 108, v2 does not have any authorization or authentication between an ActiveX client and the application server. |
CVE-2017-6781 | Medium | 5.3 | 2017-08-17 | A vulnerability in the management of shell user accounts for Cisco Policy Suite (CPS) Software for CPS appliances could allow an authenticated, local attacker… |
CVE-2017-7546 | Critical | 9.8 | 2017-08-16 | PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to… |
CVE-2015-6816 | Critical | 9.8 | 2017-08-09 | ganglia-web before 3.7.1 allows remote attackers to bypass authentication. |
CVE-2017-9370 | High | 8.8 | 2017-08-09 | An information disclosure / elevation of privilege vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker who has legitimate acc… |
CVE-2012-0803 | Critical | 9.8 | 2017-08-08 | The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SO… |
CVE-2017-11151 | Critical | 9.8 | 2017-08-08 | A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without auth… |
CVE-2017-9939 | Critical | 9.8 | 2017-08-08 | A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with network access to the SiPass integrat… |
CVE-2017-6871 | Medium | 5.4 | 2017-08-08 | A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2) and SIMATIC WinCC Sm@rtClient for Android Lite (… |
CVE-2017-6869 | Critical | 9.8 | 2017-08-08 | A vulnerability was discovered in Siemens ViewPort for Web Office Portal before revision number 1453 that could allow an unauthenticated remote user to upload… |
CVE-2015-7871 | Critical | 9.8 | 2017-08-07 | Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication. |
CVE-2017-12478 | Critical | 9.8 | 2017-08-07 | It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated… |
CVE-2017-12477 | Critical | 9.8 | 2017-08-07 | It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in which its authenti… |
CVE-2017-9630 | Critical | 9.4 | 2017-08-07 | An Improper Authentication issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 3… |
CVE-2017-7920 | High | 7.5 | 2017-08-07 | An Improper Authentication issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for React versions 2.1.3… |
CVE-2017-6747 | Critical | 9.8 | 2017-08-07 | A vulnerability in the authentication module of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass local authentica… |
CVE-2017-9860 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. An attacker can use Sunny Explorer or the SMAdata2+ network protocol to update the device firmware wi… |
CVE-2017-9857 | High | 8.1 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. The SMAdata2+ communication protocol does not properly use authentication with encryption: it is vuln… |
CVE-2017-10817 | Critical | 9.8 | 2017-08-04 | MaLion for Windows and Mac 5.0.0 to 5.2.1 allows remote attackers to bypass authentication to alter settings in Relay Service Server. |
CVE-2017-10815 | High | 8.1 | 2017-08-04 | MaLion for Windows 5.2.1 and earlier (only when "Remote Control" is installed) and MaLion for Mac 4.0.1 to 5.2.1 (only when "Remote Control" is installed) allo… |
CVE-2017-9475 | Medium | 5.9 | 2017-07-31 | Comcast XFINITY WiFi Home Hotspot devices allow remote attackers to spoof the identities of Comcast customers via a forged MAC address. |
CVE-2017-11645 | Critical | 9.8 | 2017-07-28 | NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 do not require authentication for logfile.html, status.html, or s… |
CVE-2017-2126 | Critical | 9.8 | 2017-07-22 | WAPM-1166D firmware Ver.1.2.7 and earlier, WAPM-APG600H firmware Ver.1.16.1 and earlier allows remote attackers to bypass authentication and access the configu… |
CVE-2017-6530 | Critical | 9.8 | 2017-07-20 | Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgw_v1.02.0014 4.20 do not check password.shtml authorization, leading to Arbitrary password change. |
CVE-2017-8006 | Medium | 5.9 | 2017-07-17 | In EMC RSA Authentication Manager 8.2 SP1 Patch 1 and earlier, a malicious user logged into the Self-Service Console of RSA Authentication Manager as a target… |
CVE-2017-2341 | High | 8.8 | 2017-07-17 | An insufficient authentication vulnerability on platforms where Junos OS instances are run in a virtualized environment, may allow unprivileged users on the Ju… |
CVE-2017-10601 | Critical | 9.8 | 2017-07-17 | A specific device configuration can result in a commit failure condition. When this occurs, a user is logged in without being prompted for a password while try… |
CVE-2017-1000071 | High | 8.1 | 2017-07-17 | Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server. |
CVE-2017-1000068 | High | 7.5 | 2017-07-17 | TestTrack Server versions 1.0 and earlier are vulnerable to an authentication flaw in the split disablement feature resulting in the ability to disable arbitra… |
CVE-2017-1000030 | Critical | 9.8 | 2017-07-17 | Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulnerability, that makes it possible to prov… |
CVE-2017-1000020 | Critical | 9.8 | 2017-07-17 | SYN Flood or FIN Flood attack in ECos 1 and other versions embedded devices results in web Authentication Bypass. "eCos Embedded Web Servers used by Multiple R… |
CVE-2016-8951 | High | 7.5 | 2017-07-13 | IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to a denial of service attack. An attacker can exploit a vulnerabilit… |
CVE-2017-8495 | High | 7.5 | 2017-07-11 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703… |
CVE-2017-5640 | Critical | 9.8 | 2017-07-10 | It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip authenti… |
CVE-2017-7660 | High | 7.5 | 2017-07-07 | Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that… |
CVE-2017-6868 | High | 8.1 | 2017-07-07 | An Improper Authentication issue was discovered in Siemens SIMATIC CP 44x-1 RNA, all versions prior to 1.4.1. An unauthenticated remote attacker may be able to… |
CVE-2017-2186 | High | 8.8 | 2017-07-07 | HOME SPOT CUBE2 firmware V101 and earlier allows an attacker to bypass authentication to load malicious firmware via WebUI. |
CVE-2017-7405 | Critical | 9.8 | 2017-07-07 | On the D-Link DIR-615 before v20.12PTb04, once authenticated, this device identifies the user based on the IP address of his machine. By spoofing the IP addres… |
CVE-2017-6711 | Critical | 9.1 | 2017-07-06 | A vulnerability in the Ultra Automation Service (UAS) of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to gain unauthorize… |
CVE-2017-1264 | High | 7.5 | 2017-07-05 | IBM Security Guardium 10.0 does not prove or insufficiently proves that the actors identity is correct which can lead to exposure of resources or functionality… |
CVE-2017-1258 | Medium | 6.5 | 2017-07-05 | IBM Security Guardium 10.0 and 10.1 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protec… |
CVE-2017-10807 | Critical | 9.8 | 2017-07-04 | JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled. |
CVE-2017-6722 | Medium | 6.1 | 2017-07-04 | A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of Cisco Unified Contact Center Express (UCCx) could allow an unauthenticated… |
CVE-2017-6703 | Medium | 5.9 | 2017-07-04 | A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an unauthenticated, remote attacker to hijack another use… |
CVE-2017-7919 | Critical | 9.8 | 2017-07-03 | An Improper Authentication issue was discovered in Newport XPS-Cx and XPS-Qx. An attacker may bypass authentication by accessing a specific uniform resource lo… |
CVE-2017-10796 | Medium | 6.5 | 2017-07-02 | On TP-Link NC250 devices with firmware through 1.2.1 build 170515, anyone can view video and audio without authentication via an rtsp://admin@yourip:554/h264_h… |
CVE-2017-10709 | Medium | 6.8 | 2017-06-30 | The lockscreen on Elephone P9000 devices (running Android 6.0) allows physically proximate attackers to bypass a wrong-PIN lockout feature by pressing backspac… |
CVE-2017-6034 | Critical | 9.8 | 2017-06-30 | An authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartex… |
CVE-2015-1778 | Critical | 9.8 | 2017-06-27 | The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combi… |
CVE-2017-4989 | Critical | 9.8 | 2017-06-21 | In EMC Avamar Server Software 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401, an unauthenticated remote attacker may potentially bypass the aut… |
CVE-2017-3167 | Critical | 9.8 | 2017-06-20 | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may l… |
CVE-2017-3745 | High | 7.8 | 2017-06-20 | In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password informatio… |
CVE-2017-9552 | High | 7.8 | 2017-06-13 | A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Stat… |
CVE-2017-9542 | Critical | 9.8 | 2017-06-11 | D-Link DIR-615 Wireless N 300 Router allows authentication bypass via a modified POST request to login.cgi. This issue occurs because it fails to validate the… |
CVE-2016-7836 | Critical | 9.8 | 2017-06-09 | SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the management con… |
CVE-2015-2800 | High | 7.5 | 2017-06-08 | The user authentication module in Huawei Campus switches S5700, S5300, S6300, and S6700 with software before V200R001SPH012 and S7700, S9300, and S9700 with so… |
CVE-2017-7314 | High | 7.5 | 2017-06-07 | An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables… |
CVE-2014-8180 | Medium | 5.5 | 2017-06-06 | MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial… |
CVE-2014-9952 | High | 7.8 | 2017-06-06 | In the Secure File System in all Android releases from CAF using the Linux kernel, a capture-replay vulnerability could potentially exist. |
CVE-2017-9148 | Critical | 9.8 | 2017-05-29 | The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent re… |
CVE-2014-3527 | Critical | 9.8 | 2017-05-25 | When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a… |
CVE-2014-0097 | High | 7.3 | 2017-05-25 | The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous… |
CVE-2015-6817 | High | 8.1 | 2017-05-23 | PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username. |
CVE-2016-4863 | Medium | 4.3 | 2017-05-22 | The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version… |
CVE-2017-9100 | High | 8.8 | 2017-05-21 | login.cgi on D-Link DIR-600M devices with firmware 3.04 allows remote attackers to bypass authentication by entering more than 20 blank spaces in the password… |
CVE-2017-7937 | Medium | 4.0 | 2017-05-19 | An Improper Authentication issue was discovered in Phoenix Contact GmbH mGuard firmware versions 8.3.0 to 8.4.2. An attacker may be able to gain unauthorized a… |
CVE-2017-8879 | Medium | 6.8 | 2017-05-10 | Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain acces… |
CVE-2017-8827 | Critical | 9.1 | 2017-05-08 | forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit, which might allow remote attackers to cause a denial of service (login inability) or possibly conduct… |
CVE-2017-7921 | Critical | 9.8 | 2017-05-06 | An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build… |
CVE-2017-7909 | Critical | 9.8 | 2017-05-06 | A Use of Client-Side Authentication issue was discovered in Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior. The web interface uses JavaScrip… |
CVE-2017-6624 | Medium | 5.3 | 2017-05-03 | A vulnerability in Cisco IOS 15.5(3)M Software for Cisco CallManager Express (CME) could allow an unauthenticated, remote attacker to make unauthorized phone c… |
CVE-2017-8403 | High | 8.8 | 2017-05-01 | 360fly 4K cameras allow unauthenticated Wi-Fi password changes and complete access with REST by using the Bluetooth Low Energy pairing procedure, which is avai… |
CVE-2017-2101 | High | 7.3 | 2017-04-28 | Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to perform arbitrary ope… |