CWE-288 · Authentication Bypass Using an Alternate Path or Channel (page 6)
Page 6 of 7 — CVEs classified under CWE-288, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-20247 | Medium | 5.0 | 2023-11-01 | A vulnerability in the remote access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software coul… |
CVE-2023-46747 | Critical | 9.8 | 2023-10-26 | Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port… |
CVE-2023-39930 | High | 7.5 | 2023-10-25 | A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a malicio… |
CVE-2023-39231 | High | 7.3 | 2023-10-25 | PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered devi… |
CVE-2023-43045 | Medium | 5.9 | 2023-10-23 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM… |
CVE-2023-46319 | High | 7.5 | 2023-10-23 | WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on a network access a… |
CVE-2021-4353 | Medium | 5.3 | 2023-10-20 | The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. Th… |
CVE-2023-4957 | Medium | 5.4 | 2023-10-11 | A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in… |
CVE-2023-42771 | High | 8.8 | 2023-10-03 | Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unaut… |
CVE-2023-1260 | High | 8.0 | 2023-09-24 | An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions… |
CVE-2023-42793 | Critical | 9.8 | 2023-09-19 | In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible |
CVE-2023-4702 | Critical | 9.8 | 2023-09-14 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Yepas Digital Yepas allows Authentication Bypass. This issue affects Digital Yepas… |
CVE-2023-41256 | Critical | 9.1 | 2023-09-11 | Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 are vulnerable to authentication byp… |
CVE-2023-20269 | Medium | 5.0 | 2023-09-06 | A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could al… |
CVE-2023-3162 | Critical | 9.8 | 2023-08-31 | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to i… |
CVE-2023-32002 | Critical | 9.8 | 2023-08-21 | The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability a… |
CVE-2023-3249 | Critical | 9.8 | 2023-06-30 | The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is… |
CVE-2023-2834 | Critical | 9.8 | 2023-06-30 | The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the… |
CVE-2023-30946 | Low | 3.5 | 2023-06-29 | A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not s… |
CVE-2023-2982 | Critical | 9.8 | 2023-06-29 | The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and… |
CVE-2023-34335 | High | 7.7 | 2023-06-12 | AMI BMC contains a vulnerability in the IPMI handler, where an unauthenticated host is allowed to write to a host SPI flash, bypassing secure boot protections… |
CVE-2023-2986 | Critical | 9.8 | 2023-06-08 | The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to in… |
CVE-2021-4373 | High | 8.8 | 2023-06-07 | The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it possible for unauthen… |
CVE-2020-36724 | Critical | 9.8 | 2023-06-07 | The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied has… |
CVE-2020-36713 | Critical | 9.8 | 2023-06-07 | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestricted access to the '… |
CVE-2023-2546 | High | 8.8 | 2023-06-06 | The WP User Switch plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.2. This is due to incorrect authentication… |
CVE-2023-2781 | High | 8.1 | 2023-06-03 | The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up to, and i… |
CVE-2022-36249 | Medium | 5.4 | 2023-05-30 | Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are direc… |
CVE-2023-2734 | Critical | 9.8 | 2023-05-25 | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on… |
CVE-2023-2733 | Critical | 9.8 | 2023-05-25 | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on… |
CVE-2023-2732 | Critical | 9.8 | 2023-05-25 | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on… |
CVE-2023-2704 | Critical | 9.8 | 2023-05-19 | The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insufficient verificati… |
CVE-2023-20003 | Medium | 4.7 | 2023-05-18 | A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adj… |
CVE-2023-2499 | Critical | 9.8 | 2023-05-16 | The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verifi… |
CVE-2023-31152 | Medium | 4.0 | 2023-05-10 | An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC)… |
CVE-2022-40725 | High | 7.3 | 2023-04-25 | PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before th… |
CVE-2023-21098 | High | 7.8 | 2023-04-19 | In multiple functions of AccountManagerService.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy. This… |
CVE-2023-2027 | Critical | 9.8 | 2023-04-15 | The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is due to insufficient v… |
CVE-2023-23503 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, iOS 15.7.3 and iPadOS 15.7.3… |
CVE-2023-20018 | High | 8.6 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass a… |
CVE-2023-22495 | Critical | 9.8 | 2023-01-14 | Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this applicatio… |
CVE-2022-42277 | High | 7.5 | 2023-01-13 | NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may le… |
CVE-2022-42276 | High | 7.5 | 2023-01-13 | NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead… |
CVE-2022-42275 | High | 7.7 | 2023-01-13 | NVIDIA BMC IPMI handler allows an unauthenticated host to write to a host SPI flash bypassing secureboot protections. This may lead to a loss of integrity and… |
CVE-2022-3614 | Medium | 6.1 | 2023-01-03 | In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirec… |
CVE-2022-47578 | High | 7.1 | 2022-12-20 | An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on US… |
CVE-2022-27510 | Critical | 9.8 | 2022-11-08 | Unauthorized access to Gateway user capabilities |
CVE-2022-26870 | High | 7.0 | 2022-10-21 | Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability… |
CVE-2022-23767 | High | 8.8 | 2022-09-19 | This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during file transfer. An atta… |
CVE-2022-36093 | High | 8.5 | 2022-09-08 | XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template… |
CVE-2022-34372 | Critical | 9.8 | 2022-09-01 | Dell PowerProtect Cyber Recovery versions before 19.11.0.2 contain an authentication bypass vulnerability. A remote unauthenticated attacker may potentially ac… |
CVE-2022-2031 | High | 8.8 | 2022-08-25 | A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt… |
CVE-2022-35869 | Critical | 9.8 | 2022-07-25 | This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentica… |
CVE-2022-30623 | Medium | 5.9 | 2022-07-18 | The server checks the user's cookie in a non-standard way, and a value is entered in the cookie value name of the status and its value is set to true to bypass… |
CVE-2022-23725 | High | 7.7 | 2022-06-30 | PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances. |
CVE-2022-23720 | High | 7.5 | 2022-06-30 | PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administr… |
CVE-2022-23719 | High | 7.2 | 2022-06-30 | PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the abi… |
CVE-2021-41995 | High | 7.7 | 2022-06-30 | A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass. |
CVE-2021-35530 | Medium | 6.0 | 2022-06-07 | A vulnerability in the application authentication and authorization mechanism in Hitachi Energy's TXpert Hub CoreTec 4, that depends on a token validation of t… |
CVE-2021-26634 | Critical | 9.8 | 2022-06-02 | SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboa… |
CVE-2022-31022 | Medium | 6.2 | 2022-06-01 | Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pa… |
CVE-2022-26865 | Medium | 6.8 | 2022-05-26 | Dell Support Assist OS Recovery versions before 5.5.2 contain an Authentication Bypass vulnerability. An unauthenticated attacker with physical access to the s… |
CVE-2021-32958 | Medium | 5.5 | 2022-05-23 | Successful exploitation of this vulnerability on Claroty Secure Remote Access (SRA) Site versions 3.0 through 3.2 allows an attacker with local command line in… |
CVE-2022-1681 | High | 7.2 | 2022-05-12 | Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions |
CVE-2021-31559 | High | 7.5 | 2022-05-06 | A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 ver… |
CVE-2022-23724 | Medium | 6.4 | 2022-05-04 | Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an… |
CVE-2022-23723 | High | 7.7 | 2022-05-02 | An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow. |
CVE-2022-23722 | Medium | 6.5 | 2022-05-02 | When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authenticatio… |
CVE-2021-41992 | High | 7.7 | 2022-04-30 | A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass. |
CVE-2021-3897 | Critical | 9.8 | 2022-04-22 | An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SM… |
CVE-2021-3849 | Critical | 9.8 | 2022-04-22 | An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM)… |
CVE-2022-0992 | Critical | 9.8 | 2022-04-19 | The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to… |
CVE-2022-22189 | High | 7.3 | 2022-04-14 | An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their perm… |
CVE-2022-1067 | Medium | 6.5 | 2022-04-11 | Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting. |
CVE-2021-32986 | Critical | 9.8 | 2022-04-04 | After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout… |
CVE-2021-32984 | Critical | 9.8 | 2022-04-04 | All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU M… |
CVE-2021-32980 | Critical | 9.8 | 2022-04-04 | Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attac… |
CVE-2022-24813 | Medium | 5.3 | 2022-04-04 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:Re… |
CVE-2022-24047 | Critical | 9.8 | 2022-02-18 | This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to… |
CVE-2021-34977 | High | 8.8 | 2022-01-13 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7000 1.0.11.116_10.2.100 routers. Authentic… |
CVE-2021-33017 | High | 8.1 | 2021-12-27 | The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the product has an alternate path or channel th… |
CVE-2021-43985 | Critical | 9.1 | 2021-12-23 | An unauthenticated remote attacker can access mySCADA myPRO Versions 8.20.0 and prior without any form of authentication or authorization. |
CVE-2021-21952 | Critical | 9.8 | 2021-12-22 | An authentication bypass vulnerability exists in the CMD_DEVICE_GET_RSA_KEY_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h… |
CVE-2021-27453 | High | 7.3 | 2021-12-21 | Mesa Labs AmegaView Versions 3.0 uses default cookies that could be set to bypass authentication to the web application, which may allow an attacker to gain ac… |
CVE-2021-43935 | High | 8.1 | 2021-12-15 | The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accep… |
CVE-2021-36308 | Medium | 5.9 | 2021-11-20 | Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an authentication bypass vulnerability. A remote unauthenticated a… |
CVE-2021-41292 | Critical | 9.8 | 2021-09-30 | ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authenticatio… |
CVE-2021-33700 | High | 7.8 | 2021-09-15 | SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowi… |
CVE-2021-32967 | Critical | 9.8 | 2021-08-30 | Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without being authenticated or authorized, which ma… |
CVE-2021-28131 | High | 7.5 | 2021-07-22 | Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, theref… |
CVE-2020-27866 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2… |
CVE-2020-27865 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version 1.04B03 WiFi exten… |
CVE-2020-27863 | Medium | 6.5 | 2021-02-12 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A routers. Auth… |
CVE-2020-13185 | Medium | 6.5 | 2021-02-11 | Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the need to specify auth… |
CVE-2020-10048 | Medium | 5.5 | 2021-02-09 | A vulnerability has been identified in SIMATIC PCS 7 (All versions), SIMATIC WinCC (All versions < V7.5 SP2). Due to an insecure password verification process… |
CVE-2020-10148 | Critical | 9.8 | 2020-12-29 | The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a… |
CVE-2020-17409 | Medium | 6.5 | 2020-10-13 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6120, R6080, R6260, R6220, R6020… |
CVE-2020-10283 | Critical | 9.8 | 2020-08-20 | The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation, in order to maintai… |
CVE-2020-5384 | High | 8.4 | 2020-07-31 | Authentication Bypass Vulnerability RSA MFA Agent 2.0 for Microsoft Windows contains an Authentication Bypass vulnerability. A local unauthenticated attacker c… |
CVE-2020-15633 | High | 8.8 | 2020-07-23 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with fi… |