CWE-287 · Improper Authentication (page 39)
Page 39 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-16953 | High | 7.5 | 2017-12-01 | connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows remote attackers to modify the PPPoE configuration or set up… |
CVE-2017-10903 | Critical | 9.8 | 2017-12-01 | Improper authentication issue in PTW-WMS1 firmware version 2.000.012 allows remote attackers to log in to the device with root privileges and conduct arbitrary… |
CVE-2017-14377 | Critical | 9.8 | 2017-11-29 | EMC RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 ha… |
CVE-2017-13872 | High | 8.1 | 2017-11-29 | An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The issue involves the "Directory Utility" co… |
CVE-2017-9316 | Medium | 6.5 | 2017-11-27 | Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerability was caused by internal Debug funct… |
CVE-2017-0910 | High | 8.8 | 2017-11-27 | In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server cre… |
CVE-2017-8028 | High | 8.1 | 2017-11-27 | In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthentica… |
CVE-2017-8214 | Medium | 6.2 | 2017-11-22 | Honor 8,Honor V8,Honor 9,Honor V9,Nova 2,Nova 2 Plus,P9,P10 Plus,Toronto Huawei smart phones with software of versions earlier than FRD-AL00C00B391, versions e… |
CVE-2017-8195 | High | 8.8 | 2017-11-22 | The FusionSphere OpenStack V100R006C00SPC102(NFV) has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, r… |
CVE-2017-8194 | High | 8.8 | 2017-11-22 | The FusionSphere OpenStack V100R006C00SPC102(NFV) has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, r… |
CVE-2017-8151 | Medium | 6.8 | 2017-11-22 | Huawei Honor 5S smart phones with software the versions before TAG-TL00C01B173 have an authentication bypass vulnerability due to the improper design of some c… |
CVE-2017-2738 | Critical | 9.8 | 2017-11-22 | VCM5010 with software versions earlier before V100R002C50SPC100 has an authentication bypass vulnerability. This is due to improper implementation of authentic… |
CVE-2017-2721 | Medium | 4.6 | 2017-11-22 | Some Huawei smart phones with software Berlin-L21C10B130,Berlin-L21C185B133,Berlin-L21HNC10B131,Berlin-L21HNC185B140,Berlin-L21HNC432B151,Berlin-L22C636B160,Be… |
CVE-2017-8861 | Critical | 9.8 | 2017-11-22 | Missing authentication for the remote configuration port 1236/tcp on the Cohu 3960HD allows an attacker to change configuration parameters such as IP address a… |
CVE-2017-16613 | Critical | 9.8 | 2017-11-21 | An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy serv… |
CVE-2017-16566 | Critical | 9.8 | 2017-11-17 | On Jooan IP Camera A5 2.3.36 devices, an insecure FTP server does not require authentication, which allows remote attackers to read or replace core system file… |
CVE-2017-12337 | Critical | 9.8 | 2017-11-16 | A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthentic… |
CVE-2017-12316 | High | 7.5 | 2017-11-16 | A vulnerability in the Guest Portal login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform multiple logi… |
CVE-2017-15272 | Medium | 5.3 | 2017-11-15 | The PSFTPd 10.0.4 Build 729 server stores its configuration inside PSFTPd.dat. This file is a Microsoft Access Database and can be extracted. The application s… |
CVE-2017-9314 | High | 8.8 | 2017-11-13 | Authentication vulnerability found in Dahua NVR models NVR50XX, NVR52XX, NVR54XX, NVR58XX with software before DH_NVR5xxx_Eng_P_V2.616.0000.0.R.20171102. Attac… |
CVE-2017-16634 | Critical | 9.8 | 2017-11-10 | In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method. |
CVE-2017-16562 | Critical | 9.8 | 2017-11-10 | The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain ad… |
CVE-2017-2914 | High | 8.1 | 2017-11-07 | An exploitable authentication bypass vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A specially crafted token can bypass… |
CVE-2017-2864 | Critical | 9.8 | 2017-11-07 | An exploitable vulnerability exists in the generation of authentication token functionality of Circle with Disney. Specially crafted network packets can cause… |
CVE-2017-1000154 | Critical | 9.8 | 2017-11-03 | Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to some authentication methods, which do not use Mahara's built-in… |
CVE-2017-12281 | High | 7.5 | 2017-11-02 | A vulnerability in the implementation of Protected Extensible Authentication Protocol (PEAP) functionality for standalone configurations of Cisco Aironet 1800… |
CVE-2017-10873 | High | 8.1 | 2017-11-02 | OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized contents via unspecified vectors. Note that this vulnerability… |
CVE-2017-1222 | Medium | 6.5 | 2017-10-26 | IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) does not perform an authentication check for a critical resource or functionality allowing anonym… |
CVE-2017-12160 | High | 7.2 | 2017-10-26 | It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indef… |
CVE-2017-9946 | High | 7.5 | 2017-10-23 | A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. An attacker with network access to… |
CVE-2017-5635 | High | 7.5 | 2017-10-19 | In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node ide… |
CVE-2017-12251 | Critical | 9.9 | 2017-10-19 | A vulnerability in the web console of the Cisco Cloud Services Platform (CSP) 2100 could allow an authenticated, remote attacker to interact maliciously with t… |
CVE-2017-14322 | Critical | 9.8 | 2017-10-18 | The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remote attackers to byp… |
CVE-2017-9625 | High | 8.2 | 2017-10-17 | An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5. The web application lacks proper authentication which… |
CVE-2017-15297 | High | 7.5 | 2017-10-16 | SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993. |
CVE-2017-15295 | Critical | 9.8 | 2017-10-16 | Xpress Server in SAP POS does not require authentication for read/write/delete file access. This is SAP Security Note 2520064. |
CVE-2017-15293 | Critical | 9.8 | 2017-10-16 | Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or certain attacks on c… |
CVE-2017-10623 | High | 7.1 | 2017-10-13 | Lack of authentication and authorization of cluster messages in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to intercept, injec… |
CVE-2017-10622 | Critical | 9.8 | 2017-10-13 | An authentication bypass vulnerability in Juniper Networks Junos Space Network Management Platform may allow a remote unauthenticated network based attacker to… |
CVE-2016-5791 | Critical | 9.8 | 2017-10-13 | An Improper Authentication issue was discovered in JanTek JTC-200, all versions. The improper authentication could provide an undocumented BusyBox Linux shell… |
CVE-2017-5791 | Critical | 9.8 | 2017-10-11 | The doFilter method in UrlAccessController in HPE Intelligent Management Center (iMC) PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified… |
CVE-2017-14003 | Critical | 9.8 | 2017-10-11 | An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01.00/29.03.2007 and prior versions. An i… |
CVE-2017-14972 | High | 7.5 | 2017-10-09 | InFocus Mondopad 2.2.08 is vulnerable to authentication bypass when accessing uploaded files by entering Control-Alt-Delete, and then using Task Manager to rea… |
CVE-2016-8937 | Critical | 9.8 | 2017-10-05 | The IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) default authentication protocol is vulnerable to a brute force attack due to disclosing too m… |
CVE-2017-14000 | Critical | 9.4 | 2017-10-05 | An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11. By accessing a specific uniform resourc… |
CVE-2017-13995 | Critical | 10.0 | 2017-10-05 | An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100. The webserver does not properly authent… |
CVE-2017-1000110 | Medium | 4.3 | 2017-10-05 | Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsf… |
CVE-2017-1000106 | High | 8.5 | 2017-10-05 | Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsf… |
CVE-2017-12819 | Critical | 9.8 | 2017-10-04 | Remote manipulations with language pack updater lead to NTLM-relay attack for system user in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior… |
CVE-2017-13984 | Medium | 6.5 | 2017-09-30 | An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users… |
CVE-2017-13983 | Critical | 9.8 | 2017-09-30 | An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users… |
CVE-2017-12236 | Critical | 9.8 | 2017-09-29 | A vulnerability in the implementation of the Locator/ID Separation Protocol (LISP) in Cisco IOS XE 3.2 through 16.5 could allow an unauthenticated, remote atta… |
CVE-2017-12229 | Critical | 9.8 | 2017-09-29 | A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 could allow an unauthenticated, remote attacker to by… |
CVE-2017-14766 | High | 7.5 | 2017-09-27 | The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() function and fn_ssr_d… |
CVE-2017-5192 | High | 8.8 | 2017-09-26 | When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authenti… |
CVE-2017-14602 | High | 7.2 | 2017-09-26 | A vulnerability has been identified in the management interface of Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before bui… |
CVE-2017-14706 | Critical | 9.8 | 2017-09-22 | DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download… |
CVE-2017-14080 | Critical | 9.8 | 2017-09-22 | Authentication bypass vulnerability in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allows attackers to access a specific part of the c… |
CVE-2015-1187 | Critical | 9.8 | 2017-09-21 | The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp. |
CVE-2017-14623 | High | 8.1 | 2017-09-20 | In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using thi… |
CVE-2017-10784 | High | 8.8 | 2017-09-19 | The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal e… |
CVE-2014-9618 | Critical | 9.8 | 2017-09-19 | The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and sub… |
CVE-2014-9611 | Critical | 9.8 | 2017-09-19 | Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php. |
CVE-2017-9803 | High | 7.5 | 2017-09-18 | Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another app… |
CVE-2017-14243 | Critical | 9.8 | 2017-09-17 | An authentication bypass vulnerability on UTStar WA3002G4 ADSL Broadband Modem WA3002G4-0021.01 devices allows attackers to directly access administrative sett… |
CVE-2017-1002024 | Medium | 4.3 | 2017-09-14 | Vulnerability in web application Kind Editor v4.1.12, kindeditor/php/upload_json.php does not check authentication before allow users to upload files. |
CVE-2017-1520 | Low | 3.7 | 2017-09-12 | IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication type is CLIENT. IBM X-F… |
CVE-2017-14337 | High | 8.1 | 2017-09-12 | When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an… |
CVE-2014-9624 | High | 7.5 | 2017-09-12 | CAPTCHA bypass vulnerability in MantisBT before 1.2.19. |
CVE-2017-7650 | Medium | 6.5 | 2017-09-11 | In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely conn… |
CVE-2017-7649 | Critical | 9.8 | 2017-09-11 | The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. S… |
CVE-2017-12225 | Medium | 6.5 | 2017-09-07 | A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's admi… |
CVE-2017-12213 | Medium | 4.3 | 2017-09-07 | A vulnerability in the dynamic access control list (ACL) feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches could allow an unauthe… |
CVE-2017-14147 | Critical | 9.8 | 2017-09-07 | An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a router to its factory se… |
CVE-2015-3442 | Critical | 9.8 | 2017-09-07 | Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call. |
CVE-2017-14117 | Medium | 5.9 | 2017-09-03 | The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service… |
CVE-2015-7746 | Critical | 9.8 | 2017-09-01 | NetApp Data ONTAP before 8.2.4, when operating in 7-Mode, allows remote attackers to bypass authentication and (1) obtain sensitive information from or (2) mod… |
CVE-2017-14032 | High | 8.1 | 2017-08-30 | ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 c… |
CVE-2017-12698 | Critical | 9.8 | 2017-08-30 | An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Specially crafted requests allow a possible authenticat… |
CVE-2015-8332 | High | 8.8 | 2017-08-28 | Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote auth… |
CVE-2015-1401 | Critical | 9.8 | 2017-08-28 | Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3. |
CVE-2017-7934 | Medium | 5.9 | 2017-08-25 | An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017. PI Network Manager using older protocol versi… |
CVE-2017-7930 | High | 7.4 | 2017-08-25 | An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017. PI Data Archive has protocol flaws with the p… |
CVE-2015-3206 | High | 8.1 | 2017-08-25 | The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of… |
CVE-2014-7860 | Medium | 5.3 | 2017-08-25 | The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows rem… |
CVE-2014-7858 | Critical | 9.8 | 2017-08-25 | The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the username cookie para… |
CVE-2014-7857 | Critical | 9.8 | 2017-08-25 | D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2… |
CVE-2015-8308 | High | 7.8 | 2017-08-24 | LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections. |
CVE-2016-4460 | Critical | 9.8 | 2017-08-22 | Apache Pony Mail 0.6c through 0.8b allows remote attackers to bypass authentication. |
CVE-2016-2102 | Medium | 5.3 | 2017-08-22 | HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network. |
CVE-2017-7557 | High | 8.8 | 2017-08-22 | dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack. |
CVE-2017-7420 | Critical | 9.8 | 2017-08-21 | An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server… |
CVE-2015-4464 | Critical | 9.8 | 2017-08-18 | Kguard Digital Video Recorder 104, 108, v2 does not have any authorization or authentication between an ActiveX client and the application server. |
CVE-2017-6781 | Medium | 5.3 | 2017-08-17 | A vulnerability in the management of shell user accounts for Cisco Policy Suite (CPS) Software for CPS appliances could allow an authenticated, local attacker… |
CVE-2017-7546 | Critical | 9.8 | 2017-08-16 | PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to… |
CVE-2015-6816 | Critical | 9.8 | 2017-08-09 | ganglia-web before 3.7.1 allows remote attackers to bypass authentication. |
CVE-2017-9370 | High | 8.8 | 2017-08-09 | An information disclosure / elevation of privilege vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker who has legitimate acc… |
CVE-2012-0803 | Critical | 9.8 | 2017-08-08 | The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SO… |
CVE-2017-11151 | Critical | 9.8 | 2017-08-08 | A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without auth… |
CVE-2017-9939 | Critical | 9.8 | 2017-08-08 | A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with network access to the SiPass integrat… |