CWE-287 · Improper Authentication (page 37)
Page 37 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-8609 | Low | 3.7 | 2018-08-01 | It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from… |
CVE-2018-10603 | Critical | 9.8 | 2018-07-31 | Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior do not perform authentication of IEC-104 control commands, which may all… |
CVE-2018-7947 | Low | 3.9 | 2018-07-31 | Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability. An attacker could trick the user to c… |
CVE-2018-1638 | Medium | 5.9 | 2018-07-31 | IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication (TFA) while resetting a user password but enforces it for all other… |
CVE-2018-10847 | Medium | 4.2 | 2018-07-30 | prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session r… |
CVE-2017-2652 | High | 8.8 | 2018-07-27 | It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork C… |
CVE-2017-12195 | Medium | 6.5 | 2018-07-27 | A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authentica… |
CVE-2018-6686 | Medium | 6.6 | 2018-07-27 | Authentication Bypass vulnerability in TPM autoboot in McAfee Drive Encryption (MDE) 7.1.0 and above allows physically proximate attackers to bypass local secu… |
CVE-2017-7562 | Medium | 6.5 | 2018-07-26 | An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker abl… |
CVE-2017-12610 | Medium | 6.8 | 2018-07-26 | In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with S… |
CVE-2018-11491 | Critical | 9.8 | 2018-07-25 | ASUS HG100 devices with firmware before 1.05.12 allow unauthenticated access, leading to remote command execution. |
CVE-2018-8859 | Critical | 9.8 | 2018-07-24 | Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can b… |
CVE-2018-5387 | High | 7.5 | 2018-07-24 | Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate t… |
CVE-2018-12804 | Critical | 9.8 | 2018-07-20 | Adobe Connect versions 9.7.5 and earlier have an Authentication Bypass vulnerability. Successful exploitation could lead to session hijacking. |
CVE-2018-14345 | High | 7.5 | 2018-07-17 | An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. A… |
CVE-2017-2638 | Medium | 6.5 | 2018-07-16 | It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read o… |
CVE-2016-9497 | High | 8.8 | 2018-07-13 | Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, is vulnerable to an authentication bypass using an alternate path or chan… |
CVE-2016-9482 | Critical | 9.8 | 2018-07-13 | Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigatin… |
CVE-2016-6549 | Medium | 4.3 | 2018-07-13 | The Zizai Tech Nut device allows unauthenticated Bluetooth pairing, which enables unauthenticated connected applications to write data to the device name attri… |
CVE-2016-6544 | High | 7.5 | 2018-07-13 | getgps data in iTrack Easy can be modified without authentication by setting the data using the parametercmd:setothergps. This vulnerability can be exploited t… |
CVE-2018-8171 | High | 7.5 | 2018-07-11 | A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vu… |
CVE-2018-1129 | Medium | 6.5 | 2018-07-10 | A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able t… |
CVE-2018-1128 | High | 7.5 | 2018-07-10 | It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph c… |
CVE-2018-10861 | High | 8.1 | 2018-07-10 | A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and co… |
CVE-2016-6541 | High | 8.8 | 2018-07-06 | TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, v… |
CVE-2018-3761 | High | 8.1 | 2018-07-05 | Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new… |
CVE-2018-11052 | Critical | 9.8 | 2018-07-03 | Dell EMC ECS versions 3.2.0.0 and 3.2.0.1 contain an authentication bypass vulnerability. A remote unauthenticated attacker could exploit this vulnerability to… |
CVE-2018-4856 | Medium | 4.9 | 2018-07-03 | A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with administrative access to the device's ma… |
CVE-2018-4852 | Critical | 9.8 | 2018-07-03 | A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the device could poten… |
CVE-2018-12575 | Critical | 9.8 | 2018-07-02 | On TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 171019 Rel.55346n devices, all actions in the web interface are affected by bypass of authentication… |
CVE-2018-8902 | Medium | 6.5 | 2018-06-29 | An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. The impacted products used a single shared key encryption model to encrypt da… |
CVE-2018-12984 | Critical | 9.8 | 2018-06-29 | Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" credentials. |
CVE-2018-6667 | Critical | 10.0 | 2018-06-26 | Authentication Bypass vulnerability in the administrative user interface in McAfee Web Gateway 7.8.1.0 through 7.8.1.5 allows remote attackers to execute arbit… |
CVE-2018-0528 | Medium | 4.3 | 2018-06-26 | Cybozu Office 10.0.0 to 10.7.0 allows authenticated attackers to bypass authentication to view the schedules that are not permitted to access via unspecified v… |
CVE-2018-12613 | High | 8.8 | 2018-06-21 | An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerabilit… |
CVE-2018-0362 | Medium | 4.3 | 2018-06-21 | A vulnerability in BIOS authentication management of Cisco 5000 Series Enterprise Network Compute System and Cisco Unified Computing (UCS) E-Series Servers cou… |
CVE-2018-12446 | Low | 3.6 | 2018-06-20 | An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The Passcode feature allows authentication bypass via runtime manipulation t… |
CVE-2018-12445 | Low | 3.1 | 2018-06-20 | An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The FingerprintManager class for Biometric validation allows authentication… |
CVE-2018-9024 | Medium | 5.3 | 2018-06-18 | An improper authentication vulnerability in CA Privileged Access Manager 2.x allows attackers to spoof IP addresses in a log file. |
CVE-2018-1085 | Critical | 9.0 | 2018-06-15 | openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotat… |
CVE-2018-12271 | Medium | 6.4 | 2018-06-13 | An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS. The LAContext class for Biometric (TouchID) validation allows authentication bypass by… |
CVE-2018-11407 | Critical | 9.8 | 2018-06-13 | An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote… |
CVE-2018-12049 | Critical | 9.8 | 2018-06-08 | A remote attacker can bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.ht… |
CVE-2018-12048 | Critical | 9.8 | 2018-06-08 | A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.html… |
CVE-2018-0321 | Critical | 9.8 | 2018-06-07 | A vulnerability in Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the Java Remote Method Invocation (RM… |
CVE-2018-0319 | Critical | 9.8 | 2018-06-07 | A vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unaut… |
CVE-2018-0318 | Critical | 9.8 | 2018-06-07 | A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthor… |
CVE-2017-7931 | Critical | 9.8 | 2018-06-06 | In ABB IP GATEWAY 3.39 and prior, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access the configuratio… |
CVE-2017-7639 | Medium | 5.3 | 2018-06-05 | QNAP NAS application Proxy Server through version 1.2.0 does not authenticate requests properly. Successful exploitation can lead to change of the settings of… |
CVE-2018-10597 | High | 8.3 | 2018-06-05 | IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX10… |
CVE-2018-7943 | High | 8.8 | 2018-06-05 | There is an authentication bypass vulnerability in some Huawei servers. A remote attacker with low privilege may bypass the authentication by some special oper… |
CVE-2017-16025 | Medium | 5.9 | 2018-06-04 | Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an… |
CVE-2018-10611 | Critical | 9.8 | 2018-06-04 | Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated… |
CVE-2018-11711 | Critical | 9.8 | 2018-06-04 | A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN for /login.html via vectors involving /… |
CVE-2018-11692 | Critical | 9.8 | 2018-06-04 | An issue was discovered on Canon LBP6650, LBP3370, LBP3460, and LBP7750C devices. It is possible to bypass the Administrator Mode authentication for /tlogin.cg… |
CVE-2018-7949 | High | 8.8 | 2018-06-01 | The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specia… |
CVE-2016-10532 | Critical | 9.8 | 2018-05-31 | console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any comm… |
CVE-2018-11579 | Medium | 5.3 | 2018-05-31 | class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulne… |
CVE-2018-11478 | High | 8.8 | 2018-05-30 | An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The OBD port is used to receive measurement data and debug information from the car. This on… |
CVE-2016-10525 | Critical | 9.8 | 2018-05-29 | When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication. |
CVE-2014-10067 | Medium | 5.9 | 2018-05-29 | paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or th… |
CVE-2018-8862 | Low | 3.1 | 2018-05-25 | In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, an improper authentication vulnerability caused by specially… |
CVE-2017-9421 | Medium | 6.5 | 2018-05-24 | Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain API calls on behalf of a web user using… |
CVE-2018-8898 | Critical | 9.8 | 2018-05-23 | A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT_77616… |
CVE-2018-0271 | Critical | 9.8 | 2018-05-17 | A vulnerability in the API gateway of the Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authenticat… |
CVE-2017-2604 | Medium | 4.3 | 2018-05-15 | In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permiss… |
CVE-2018-10825 | Medium | 5.3 | 2018-05-15 | Mimo Baby 2 devices do not use authentication or encryption for the Bluetooth Low Energy (BLE) communication from a Turtle to a Lilypad, which allows attackers… |
CVE-2018-6617 | High | 7.8 | 2018-05-11 | Easy Hosting Control Panel (EHCP) v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database users by leveraging f… |
CVE-2018-7941 | High | 8.8 | 2018-05-10 | Huawei iBMC V200R002C60 have an authentication bypass vulnerability. A remote attacker with low privilege may craft specific messages to upload authentication… |
CVE-2018-7940 | Medium | 6.2 | 2018-05-10 | Huawei smart phones Mate 10 and Mate 10 Pro with earlier versions than 8.0.0.129(SP2C00) and earlier versions than 8.0.0.129(SP2C01) have an authentication byp… |
CVE-2018-6020 | Medium | 6.5 | 2018-05-09 | In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when making certain POST requests, which may all… |
CVE-2018-10683 | Critical | 9.8 | 2018-05-09 | An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access… |
CVE-2018-10682 | Critical | 9.8 | 2018-05-09 | An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication… |
CVE-2017-3775 | Medium | 6.4 | 2018-05-04 | Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before boo… |
CVE-2018-10641 | High | 8.1 | 2018-05-04 | D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext. |
CVE-2018-10561 | Critical | 9.8 | 2018-05-04 | An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that require… |
CVE-2018-0247 | Medium | 4.7 | 2018-05-02 | A vulnerability in Web Authentication (WebAuth) clients for the Cisco Wireless LAN Controller (WLC) and Aironet Access Points running Cisco IOS Software could… |
CVE-2018-10544 | Critical | 9.8 | 2018-05-02 | Meross MSS110 devices through 1.1.24 contain an unauthenticated admin.htm administrative interface. |
CVE-2018-9232 | High | 7.8 | 2018-05-01 | Due to the lack of firmware authentication in the upgrade process of T&W WIFI Repeater BE126 devices, an attacker can craft a malicious firmware and use it as… |
CVE-2018-10576 | High | 7.8 | 2018-04-30 | An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentication handling by the native Access Poin… |
CVE-2018-1418 | High | 8.8 | 2018-04-26 | IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IBM X-Force ID: 138824. |
CVE-2017-12712 | High | 8.8 | 2018-04-25 | The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be… |
CVE-2018-1112 | High | 8.0 | 2018-04-25 | glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from an… |
CVE-2018-10362 | Critical | 9.8 | 2018-04-25 | An issue was discovered in phpLiteAdmin 1.9.5 through 1.9.7.1. Due to loose comparison with '==' instead of '===' in classes/Authorization.php for the user-pro… |
CVE-2018-1106 | Medium | 5.5 | 2018-04-23 | An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local… |
CVE-2014-0927 | High | 8.1 | 2018-04-20 | The ActiveMQ admin user interface in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote attackers to bypass authentica… |
CVE-2018-6960 | High | 8.8 | 2018-04-20 | VMware Horizon DaaS (7.x before 8.0.0) contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authentication. Note: In… |
CVE-2018-0238 | Critical | 9.9 | 2018-04-19 | A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System (UCS) Director could allow an authenticated, remote att… |
CVE-2018-7760 | Critical | 9.8 | 2018-04-18 | An authorization bypass vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. Requests to CGI functions… |
CVE-2016-10434 | High | 7.5 | 2018-04-18 | In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 820 and SD 820A, the input to RPMB writ… |
CVE-2017-12196 | Medium | 4.8 | 2018-04-18 | undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value… |
CVE-2017-2871 | High | 8.8 | 2018-04-17 | Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is… |
CVE-2018-6547 | Critical | 9.1 | 2018-04-13 | plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, contains an HTTP mes… |
CVE-2018-6546 | Critical | 9.8 | 2018-04-13 | plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, executes code at a u… |
CVE-2017-0356 | Critical | 9.8 | 2018-04-13 | A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass… |
CVE-2016-9646 | Medium | 5.3 | 2018-04-13 | ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can… |
CVE-2014-3999 | High | 8.1 | 2018-04-10 | The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user DN. |
CVE-2016-8380 | High | 7.3 | 2018-04-05 | The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication. |
CVE-2016-8371 | High | 7.3 | 2018-04-05 | The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled. |
CVE-2018-1082 | High | 8.1 | 2018-04-04 | A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the use… |