CWE-287 · Improper Authentication (page 37)
Page 37 of 47 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2332 | High | 8.8 | 2017-04-24 | An insufficient authentication vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious… |
CVE-2017-2329 | Medium | 6.2 | 2017-04-24 | An insufficient authentication vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unprivileg… |
CVE-2017-2319 | High | 8.3 | 2017-04-24 | A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious attacker to compromise the sys… |
CVE-2017-8078 | Medium | 5.3 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, the upgrade process can be requested remotely without authentication (httpupg.cgi with a parameter called cmd). This affects the… |
CVE-2017-6617 | Medium | 5.4 | 2017-04-20 | A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow… |
CVE-2016-1219 | Critical | 9.8 | 2017-04-20 | Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use. |
CVE-2016-5410 | Medium | 5.5 | 2017-04-19 | firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removeP… |
CVE-2017-7284 | High | 8.8 | 2017-04-12 | An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/users.php to change the password of the… |
CVE-2017-7588 | Critical | 9.8 | 2017-04-12 | On certain Brother devices, authorization is mishandled by including a valid AuthCookie cookie in the HTTP response to a failed login attempt. Affected models… |
CVE-2016-1908 | Critical | 9.8 | 2017-04-11 | The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisio… |
CVE-2016-5068 | Critical | 9.8 | 2017-04-10 | Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests. |
CVE-2015-2880 | High | 8.8 | 2017-04-10 | TRENDnet WiFi Baby Cam TV-IP743SIC has a password of admin for the backdoor root account. |
CVE-2007-6760 | Critical | 9.8 | 2017-04-07 | Dataprobe iBootBar (with 2007-09-20 and possibly later beta firmware) allows remote attackers to bypass authentication, and conduct power-cycle attacks on conn… |
CVE-2007-6759 | Critical | 9.8 | 2017-04-07 | Dataprobe iBootBar (with 2007-09-20 and possibly later released firmware) allows remote attackers to bypass authentication, and conduct power-cycle attacks on… |
CVE-2017-7450 | Critical | 9.8 | 2017-04-05 | AIRTAME HDMI dongle with firmware before 2.2.0 allows unauthenticated access to a big part of the management interface. It is possible to extract all informati… |
CVE-2016-10309 | Critical | 9.8 | 2017-03-30 | In the GUI of Ceragon FibeAir IP-10 (before 7.2.0) devices, a remote attacker can bypass authentication by adding an ALBATROSS cookie with the value 0-4-11 to… |
CVE-2017-2689 | High | 8.8 | 2017-03-29 | Siemens RUGGEDCOM ROX I (all versions) allow an authenticated user to bypass access restrictions in the web interface at port 10000/TCP to obtain privileged fi… |
CVE-2016-9463 | High | 8.1 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud inclu… |
CVE-2016-9124 | Critical | 9.8 | 2017-03-28 | Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to passwor… |
CVE-2017-5237 | High | 7.5 | 2017-03-27 | Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a factory default confi… |
CVE-2016-4926 | Critical | 9.8 | 2017-03-20 | Insufficient authentication vulnerability in Junos Space before 15.2R2 allows remote network based users with access to Junos Space web interface to perform ce… |
CVE-2017-3880 | Medium | 6.5 | 2017-03-17 | An Authentication Bypass vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access limited meeting information on… |
CVE-2017-3867 | Medium | 5.3 | 2017-03-17 | A vulnerability in the Border Gateway Protocol (BGP) Bidirectional Forwarding Detection (BFD) implementation of Cisco Adaptive Security Appliance (ASA) Softwar… |
CVE-2017-6967 | High | 7.3 | 2017-03-17 | xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potentia… |
CVE-2017-0100 | High | 7.8 | 2017-03-17 | A DCOM object in Helppane.exe in Microsoft Windows 7 SP1; Windows Server 2008 R2; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold… |
CVE-2017-3854 | High | 8.8 | 2017-03-15 | A vulnerability in the mesh code of Cisco Wireless LAN Controller (WLC) software could allow an unauthenticated, remote attacker to impersonate a WLC in a mesh… |
CVE-2017-3831 | Critical | 9.8 | 2017-03-15 | A vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could allow an unauthenticated, remote attacker to bypass authenticati… |
CVE-2016-8023 | High | 8.1 | 2017-03-14 | Authentication bypass by assumed-immutable data vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthentic… |
CVE-2016-8022 | High | 7.5 | 2017-03-14 | Authentication bypass by spoofing vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker… |
CVE-2017-5619 | Critical | 9.8 | 2017-03-13 | An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attackers can login with the hashed password itself (e.g., from the… |
CVE-2017-6526 | Critical | 9.8 | 2017-03-09 | An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrativ… |
CVE-2017-6549 | High | 8.8 | 2017-03-09 | Session hijack vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51… |
CVE-2016-9729 | Medium | 6.5 | 2017-03-07 | IBM QRadar 7.2 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM Refere… |
CVE-2016-7145 | Critical | 9.8 | 2017-03-07 | The m_authenticate function in ircd/m_authenticate.c in nefarious2 allows remote attackers to spoof certificate fingerprints and consequently log in as another… |
CVE-2017-6104 | High | 7.5 | 2017-03-02 | Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0. |
CVE-2017-6413 | High | 8.6 | 2017-03-02 | The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM… |
CVE-2017-6062 | High | 8.6 | 2017-03-02 | The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM… |
CVE-2017-6343 | High | 8.1 | 2017-02-27 | The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Softwa… |
CVE-2016-1888 | High | 7.5 | 2017-02-15 | The telnetd service in FreeBSD 9.3, 10.1, 10.2, 10.3, and 11.0 allows remote attackers to inject arguments to login and bypass authentication via vectors invol… |
CVE-2017-5152 | Critical | 9.1 | 2017-02-13 | An issue was discovered in Advantech WebAccess Version 8.1. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able… |
CVE-2016-9369 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-9362 | Critical | 9.1 | 2017-02-13 | An issue was discovered in WAGO 750-8202/PFC200 prior to FW04 (released August 2015), WAGO 750-881 prior to FW09 (released August 2016), and WAGO 0758-0874-000… |
CVE-2016-9361 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-8362 | Medium | 6.5 | 2017-02-13 | An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2… |
CVE-2016-8347 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Kabona AB WebDatorCentral (WDC) application prior to Version 3.4.0. WDC does not limit authentication attempts that may allow a brut… |
CVE-2017-2765 | Critical | 9.8 | 2017-02-08 | EMC Isilon InsightIQ 4.1.0, 4.0.1, 4.0.0, 3.2.2, 3.2.1, 3.2.0, 3.1.1, 3.1.0, 3.0.1, 3.0.0 is affected by an authentication bypass vulnerability that could pote… |
CVE-2016-2403 | Critical | 9.8 | 2017-02-07 | Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which trigg… |
CVE-2016-1502 | High | 7.3 | 2017-02-07 | NetApp SnapCenter Server 1.0 and 1.0P1 allows remote attackers to partially bypass authentication and then list and delete backups via unspecified vectors. |
CVE-2017-2768 | Critical | 9.8 | 2017-02-03 | EMC Network Configuration Manager (NCM) 9.3.x, EMC Network Configuration Manager (NCM) 9.4.0.x, EMC Network Configuration Manager (NCM) 9.4.1.x, EMC Network Co… |
CVE-2017-2767 | Critical | 9.8 | 2017-02-03 | EMC Network Configuration Manager (NCM) 9.3.x, EMC Network Configuration Manager (NCM) 9.4.0.x, EMC Network Configuration Manager (NCM) 9.4.1.x, EMC Network Co… |
CVE-2017-3791 | Critical | 10.0 | 2017-02-01 | A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions with admi… |
CVE-2016-3176 | Medium | 5.6 | 2017-01-31 | Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication servi… |
CVE-2017-3795 | Medium | 5.4 | 2017-01-26 | A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct arbitrary password changes against any non-administrati… |
CVE-2016-4484 | Medium | 6.8 | 2017-01-23 | The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts w… |
CVE-2017-5554 | High | 8.1 | 2017-01-23 | An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done with… |
CVE-2016-7144 | High | 8.1 | 2017-01-18 | The m_authenticate function in modules/m_sasl.c in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints an… |
CVE-2016-6659 | High | 8.1 | 2016-12-23 | Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-release) before 13.9 f… |
CVE-2016-6474 | High | 7.3 | 2016-12-14 | A vulnerability in the implementation of X.509 Version 3 for SSH authentication functionality in Cisco IOS and IOS XE Software could allow an unauthenticated… |
CVE-2016-4322 | Critical | 9.8 | 2016-12-13 | BMC BladeLogic Server Automation (BSA) before 8.7 Patch 3 allows remote attackers to bypass authentication and consequently read arbitrary files or possibly ha… |
CVE-2016-9796 | Critical | 9.8 | 2016-12-03 | Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30024. An attacker ca… |
CVE-2016-2944 | Critical | 9.8 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brut… |
CVE-2016-6452 | Critical | 9.8 | 2016-11-03 | A vulnerability in the web-based graphical user interface (GUI) of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication. T… |
CVE-2016-6397 | Critical | 9.8 | 2016-10-28 | A vulnerability in the interdevice communications interface of the Cisco IP Interoperability and Collaboration System (IPICS) Universal Media Services (UMS) co… |
CVE-2016-1000214 | Medium | 5.3 | 2016-10-25 | Ruckus Wireless H500 web management interface authentication bypass |
CVE-2016-6434 | High | 7.8 | 2016-10-06 | Cisco Firepower Management Center 6.0.1 has hardcoded database credentials, which allows local users to obtain sensitive information by leveraging CLI access… |
CVE-2016-5686 | Critical | 9.8 | 2016-10-05 | Johnson & Johnson Animas OneTouch Ping devices mishandle acknowledgements, which makes it easier for remote attackers to bypass authentication via a custom com… |
CVE-2016-5086 | Critical | 9.8 | 2016-10-05 | Johnson & Johnson Animas OneTouch Ping devices allow remote attackers to bypass authentication via replay attacks. |
CVE-2016-7141 | High | 7.5 | 2016-10-03 | curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication o… |
CVE-2016-7191 | High | 8.1 | 2016-09-28 | The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validate… |
CVE-2016-6159 | High | 7.5 | 2016-09-21 | The management interface of Huawei WS331a routers with software before WS331a-10 V100R001C01B112 allows remote attackers to bypass authentication and obtain ad… |
CVE-2016-4966 | Medium | 6.5 | 2016-09-21 | The diagnosis_control.php page in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to download PCAP files via vectors rel… |
CVE-2016-4860 | High | 7.3 | 2016-09-19 | Yokogawa STARDOM FCN/FCJ controller R1.01 through R4.01 does not require authentication for Logic Designer connections, which allows remote attackers to reconf… |
CVE-2016-0883 | Critical | 9.8 | 2016-09-18 | Pivotal Cloud Foundry (PCF) Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, whi… |
CVE-2016-1279 | Critical | 9.8 | 2016-09-09 | J-Web in Juniper Junos OS before 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D25, 13.3 before 13.3R10, 13… |
CVE-2016-7114 | High | 8.8 | 2016-09-06 | A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100… |
CVE-2016-7112 | Critical | 9.8 | 2016-09-06 | A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100… |
CVE-2016-6377 | High | 8.1 | 2016-09-03 | Media Origination System Suite Software 2.6 and earlier in Cisco Virtual Media Packager (VMP) allows remote attackers to bypass authentication and make arbitra… |
CVE-2015-6397 | High | 8.8 | 2016-08-08 | Cisco RV110W, RV130W, and RV215W devices have an incorrect RBAC configuration for the default account, which allows remote authenticated users to obtain root a… |
CVE-2016-1278 | High | 7.8 | 2016-08-05 | Juniper Junos OS before 12.1X46-D50 on SRX Series devices reverts to "safe mode" authentication and allows root CLI logins without a password after a failed up… |
CVE-2016-5133 | Medium | 5.3 | 2016-07-23 | Google Chrome before 52.0.2743.82 mishandles origin information during proxy authentication, which allows man-in-the-middle attackers to spoof a proxy-authenti… |
CVE-2016-4503 | Critical | 9.8 | 2016-07-12 | Moxa Device Server Web Console 5232-N allows remote attackers to bypass authentication, and consequently modify settings and data, via vectors related to readi… |
CVE-2016-4953 | High | 7.5 | 2016-07-05 | ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK pack… |
CVE-2016-1427 | High | 7.5 | 2016-06-18 | The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attacke… |
CVE-2016-3085 | Medium | 6.5 | 2016-06-10 | Apache CloudStack 4.5.x before 4.5.2.1, 4.6.x before 4.6.2.1, 4.7.x before 4.7.1.1, and 4.8.x before 4.8.0.1, when SAML-based authentication is enabled and use… |
CVE-2016-0916 | Critical | 9.8 | 2016-06-10 | EMC NetWorker 8.2.1.x and 8.2.2.x before 8.2.2.6 and 9.x before 9.0.0.6 mishandles authentication, which allows remote attackers to execute arbitrary commands… |
CVE-2016-4510 | Critical | 9.1 | 2016-06-09 | The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and read arbitrary files… |
CVE-2016-4432 | Critical | 9.1 | 2016-06-01 | The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently p… |
CVE-2016-3094 | Medium | 5.9 | 2016-06-01 | PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of… |
CVE-2016-2286 | High | 7.5 | 2016-05-31 | Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices wi… |
CVE-2016-1402 | High | 7.5 | 2016-05-21 | The Active Directory (AD) integration component in Cisco Identity Service Engine (ISE) before 1.2.0.899 patch 7, when AD group-membership authorization is enab… |
CVE-2016-2012 | Medium | 6.5 | 2016-05-07 | HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote attackers to bypass authentication via unspecified vectors. |
CVE-2016-4422 | Critical | 9.8 | 2016-05-06 | The pam_sm_authenticate function in pam_sshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a s… |
CVE-2016-1387 | Critical | 9.8 | 2016-05-05 | The XML API in TelePresence Codec (TC) 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, and 7.3.5 and Collaboration Endpoint (CE) 8.0.0, 8.0.1, and 8.1.0 in Ci… |
CVE-2016-2300 | Medium | 6.5 | 2016-04-22 | Ecava IntegraXor before 5.0 build 4522 allows remote attackers to bypass authentication and access unspecified web pages via unknown vectors. |
CVE-2016-2076 | High | 7.6 | 2016-04-15 | Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appli… |
CVE-2016-0733 | Critical | 9.8 | 2016-04-12 | The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authe… |
CVE-2016-2245 | Critical | 9.8 | 2016-03-19 | HP Support Assistant before 8.1.52.1 allows remote attackers to bypass authentication via unspecified vectors. |
CVE-2016-1356 | Low | 3.7 | 2016-03-03 | Cisco FireSIGHT System Software 6.1.0 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to enumerate… |
CVE-2016-1329 | Critical | 9.8 | 2016-03-03 | Cisco NX-OS 6.0(2)U6(1) through 6.0(2)U6(5) on Nexus 3000 devices and 6.0(2)A6(1) through 6.0(2)A6(5) and 6.0(2)A7(1) on Nexus 3500 devices has hardcoded crede… |
CVE-2016-1307 | Medium | 5.4 | 2016-02-07 | The Openfire server in Cisco Finesse Desktop 10.5(1) and 11.0(1) and Unified Contact Center Express 10.6(1) has a hardcoded account, which makes it easier for… |