CWE-288 · Authentication Bypass Using an Alternate Path or Channel (page 6)
Page 6 of 7 — CVEs classified under CWE-288, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-35124 | High | 7.5 | 2024-08-13 | A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password… |
CVE-2024-7503 | Critical | 9.8 | 2024-08-12 | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of l… |
CVE-2024-6684 | | 2024-08-12 | Authentication Bypass Using an Alternate Path or Channel vulnerability in GST Electronics inohom Nova Panel N7 allows Authentication Bypass. This issue affect… | |
CVE-2024-7350 | Critical | 9.8 | 2024-08-08 | The Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to authentication bypass in versions 1.1… |
CVE-2024-7314 | Critical | 9.8 | 2024-08-02 | anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to b… |
CVE-2024-7007 | Critical | 9.8 | 2024-07-25 | Positron Broadcast Signal Processor TRA7005 v1.20 is vulnerable to an authentication bypass exploit that could allow an attacker to have unauthorized access to… |
CVE-2024-7027 | High | 7.3 | 2024-07-24 | The WooCommerce - PDF Vouchers plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.9.3. This is due to insufficient… |
CVE-2024-38437 | Critical | 9.8 | 2024-07-21 | D-Link - CWE-288:Authentication Bypass Using an Alternate Path or Channel |
CVE-2024-6635 | High | 7.3 | 2024-07-20 | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient… |
CVE-2024-5620 | Medium | 6.5 | 2024-07-18 | Authentication Bypass Using an Alternate Path or Channel vulnerability in PruvaSoft Informatics Apinizer Management Console allows Authentication Bypass. This… |
CVE-2024-6328 | Critical | 9.8 | 2024-07-12 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including… |
CVE-2024-6397 | Critical | 9.8 | 2024-07-11 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44… |
CVE-2024-39309 | Critical | 9.8 | 2024-07-01 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 al… |
CVE-2024-5322 | Critical | 9.1 | 2024-07-01 | The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass. This vu… |
CVE-2024-28200 | Critical | 9.1 | 2024-07-01 | The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 20… |
CVE-2024-2973 | Critical | 10.0 | 2024-06-27 | An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or conductor running with a redundant peer a… |
CVE-2024-31916 | High | 7.5 | 2024-06-27 | IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authenticatio… |
CVE-2024-5432 | Critical | 9.8 | 2024-06-20 | The Lifeline Donation plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.6. This is due to insufficient verifica… |
CVE-2023-37057 | Critical | 9.8 | 2024-06-17 | An issue in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to execute arbitrary code via the router's authentication mechanism. |
CVE-2024-37893 | Medium | 5.9 | 2024-06-17 | Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to b… |
CVE-2024-3496 | High | 8.8 | 2024-06-14 | Attackers can bypass the web login authentication process to gain access to the printer's system information and upload malicious drivers to the printer. As fo… |
CVE-2024-38279 | Medium | 4.6 | 2024-06-13 | The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file syste… |
CVE-2024-2013 | Critical | 10.0 | 2024-06-11 | An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to in… |
CVE-2024-2012 | Critical | 9.1 | 2024-06-11 | vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or code to be executed on… |
CVE-2024-4552 | Critical | 9.8 | 2024-06-04 | The Social Login Lite For WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.6.0. This is due to insuf… |
CVE-2024-36042 | Critical | 9.8 | 2024-06-03 | Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with supe… |
CVE-2024-36470 | High | 8.1 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases |
CVE-2024-5204 | High | 8.8 | 2024-05-29 | The Swiss Toolkit For WP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.7. This is due to the plugin storing… |
CVE-2024-5150 | Critical | 9.8 | 2024-05-29 | The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.26. This is due to the 'activatio… |
CVE-2024-4544 | Critical | 9.8 | 2024-05-24 | The Pie Register - Social Sites Login (Add on) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.7. This is due… |
CVE-2024-29853 | High | 7.8 | 2024-05-22 | An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation. |
CVE-2024-4393 | Critical | 9.8 | 2024-05-08 | The Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2. This is due to insufficient verification… |
CVE-2024-4186 | Critical | 9.8 | 2024-05-07 | The Edwiser Bridge plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.5. This is due to the 'eb_user_email_verif… |
CVE-2024-34524 | Critical | 9.1 | 2024-05-06 | In XLANG OpenAgents through fe73ac4, the allowed_file protection mechanism can be bypassed by using an incorrect file extension for the nature of the file cont… |
CVE-2023-50915 | Medium | 6.5 | 2024-04-30 | An issue exists in GalaxyClientService.exe in GOG Galaxy (Beta) 2.0.67.2 through 2.0.71.2 that could allow authenticated users to overwrite and corrupt critica… |
CVE-2024-31463 | Medium | 4.7 | 2024-04-17 | Ironic-image is an OpenStack Ironic deployment packaged and configured by Metal3. When the reverse proxy mode is enabled by the `IRONIC_REVERSE_PROXY_SETUP` va… |
CVE-2024-1646 | High | 8.2 | 2024-04-16 | parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parame… |
CVE-2024-31814 | High | 8.8 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to bypass login through the Form_Login function. |
CVE-2024-26566 | High | 8.2 | 2024-03-07 | An issue in Cute Http File Server v.3.1 allows a remote attacker to escalate privileges via the password verification component. |
CVE-2024-2056 | Critical | 9.8 | 2024-03-05 | Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy service. In particular, the "tailon" service… |
CVE-2024-2055 | Critical | 9.8 | 2024-03-05 | The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not requir… |
CVE-2024-27198 | Critical | 9.8 | 2024-03-04 | In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible |
CVE-2024-1525 | Medium | 5.3 | 2024-02-22 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versio… |
CVE-2024-1709 | Critical | 10.0 | 2024-02-21 | ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an atta… |
CVE-2024-21491 | Medium | 5.9 | 2024-02-13 | Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths… |
CVE-2024-23917 | Critical | 9.8 | 2024-02-06 | In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible |
CVE-2023-50272 | High | 7.5 | 2023-12-19 | A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). The vulnerability could be r… |
CVE-2023-6718 | Critical | 9.4 | 2023-12-13 | An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to the lack of any aut… |
CVE-2023-2437 | Critical | 9.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on th… |
CVE-2023-42770 | Critical | 10.0 | 2023-11-21 | Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP… |
CVE-2023-3277 | Critical | 9.8 | 2023-11-03 | The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to impro… |
CVE-2023-41351 | Critical | 9.8 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mech… |
CVE-2023-20247 | Medium | 5.0 | 2023-11-01 | A vulnerability in the remote access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software coul… |
CVE-2023-46747 | Critical | 9.8 | 2023-10-26 | Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port… |
CVE-2023-39930 | High | 7.5 | 2023-10-25 | A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a malicio… |
CVE-2023-39231 | High | 7.3 | 2023-10-25 | PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered devi… |
CVE-2023-43045 | Medium | 5.9 | 2023-10-23 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM… |
CVE-2023-46319 | High | 7.5 | 2023-10-23 | WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on a network access a… |
CVE-2021-4353 | Medium | 5.3 | 2023-10-20 | The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. Th… |
CVE-2023-4957 | Medium | 5.4 | 2023-10-11 | A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in… |
CVE-2023-42771 | High | 8.8 | 2023-10-03 | Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unaut… |
CVE-2023-1260 | High | 8.0 | 2023-09-24 | An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions… |
CVE-2023-42793 | Critical | 9.8 | 2023-09-19 | In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible |
CVE-2023-4702 | Critical | 9.8 | 2023-09-14 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Yepas Digital Yepas allows Authentication Bypass. This issue affects Digital Yepas… |
CVE-2023-41256 | Critical | 9.1 | 2023-09-11 | Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 are vulnerable to authentication byp… |
CVE-2023-20269 | Medium | 5.0 | 2023-09-06 | A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could al… |
CVE-2023-3162 | Critical | 9.8 | 2023-08-31 | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to i… |
CVE-2023-32002 | Critical | 9.8 | 2023-08-21 | The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability a… |
CVE-2023-3249 | Critical | 9.8 | 2023-06-30 | The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is… |
CVE-2023-2834 | Critical | 9.8 | 2023-06-30 | The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the… |
CVE-2023-30946 | Low | 3.5 | 2023-06-29 | A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not s… |
CVE-2023-2982 | Critical | 9.8 | 2023-06-29 | The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and… |
CVE-2023-34335 | High | 7.7 | 2023-06-12 | AMI BMC contains a vulnerability in the IPMI handler, where an unauthenticated host is allowed to write to a host SPI flash, bypassing secure boot protections… |
CVE-2023-2986 | Critical | 9.8 | 2023-06-08 | The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to in… |
CVE-2021-4373 | High | 8.8 | 2023-06-07 | The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it possible for unauthen… |
CVE-2020-36724 | Critical | 9.8 | 2023-06-07 | The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied has… |
CVE-2020-36713 | Critical | 9.8 | 2023-06-07 | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestricted access to the '… |
CVE-2023-2546 | High | 8.8 | 2023-06-06 | The WP User Switch plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.2. This is due to incorrect authentication… |
CVE-2023-2781 | High | 8.1 | 2023-06-03 | The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up to, and i… |
CVE-2022-36249 | Medium | 5.4 | 2023-05-30 | Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are direc… |
CVE-2023-2734 | Critical | 9.8 | 2023-05-25 | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on… |
CVE-2023-2733 | Critical | 9.8 | 2023-05-25 | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on… |
CVE-2023-2732 | Critical | 9.8 | 2023-05-25 | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on… |
CVE-2023-2704 | Critical | 9.8 | 2023-05-19 | The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insufficient verificati… |
CVE-2023-20003 | Medium | 4.7 | 2023-05-18 | A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adj… |
CVE-2023-2499 | Critical | 9.8 | 2023-05-16 | The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verifi… |
CVE-2023-31152 | Medium | 4.0 | 2023-05-10 | An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC)… |
CVE-2022-40725 | High | 7.3 | 2023-04-25 | PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before th… |
CVE-2023-21098 | High | 7.8 | 2023-04-19 | In multiple functions of AccountManagerService.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy. This… |
CVE-2023-2027 | Critical | 9.8 | 2023-04-15 | The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is due to insufficient v… |
CVE-2023-23503 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, iOS 15.7.3 and iPadOS 15.7.3… |
CVE-2023-20018 | High | 8.6 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass a… |
CVE-2023-22495 | Critical | 9.8 | 2023-01-14 | Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this applicatio… |
CVE-2022-42277 | High | 7.5 | 2023-01-13 | NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may le… |
CVE-2022-42276 | High | 7.5 | 2023-01-13 | NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead… |
CVE-2022-42275 | High | 7.7 | 2023-01-13 | NVIDIA BMC IPMI handler allows an unauthenticated host to write to a host SPI flash bypassing secureboot protections. This may lead to a loss of integrity and… |
CVE-2022-3614 | Medium | 6.1 | 2023-01-03 | In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirec… |
CVE-2022-47578 | High | 7.1 | 2022-12-20 | An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on US… |
CVE-2022-27510 | Critical | 9.8 | 2022-11-08 | Unauthorized access to Gateway user capabilities |
CVE-2022-26870 | High | 7.0 | 2022-10-21 | Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability… |