CWE-305 · Authentication Bypass by Primary Weakness (page 2)
Page 2 of 2 — CVEs classified under CWE-305, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-20378 | High | 7.5 | 2024-05-01 | A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieve sensitive informat… |
CVE-2024-3847 | Medium | 6.1 | 2024-04-17 | Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2023-6153 | Critical | 9.8 | 2024-03-27 | Authentication Bypass by Primary Weakness vulnerability in TeoSOFT Software TeoBASE allows Authentication Bypass. This issue affects TeoBASE: through 20240327… |
CVE-2024-1202 | Critical | 9.8 | 2024-03-21 | Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass. This issue affects Octopod: before v1. NOTE: The ven… |
CVE-2023-7103 | Critical | 9.8 | 2024-03-05 | Authentication Bypass by Primary Weakness vulnerability in ZKSoftware Biometric Security Solutions UFace 5 allows Authentication Bypass. This issue affects UF… |
CVE-2024-1403 | Critical | 10.0 | 2024-02-27 | In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypa… |
CVE-2024-20015 | High | 7.8 | 2024-02-05 | In telephony, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege with no additional exec… |
CVE-2024-20674 | High | 8.8 | 2024-01-09 | Windows Kerberos Security Feature Bypass Vulnerability |
CVE-2023-6998 | High | 7.7 | 2023-12-30 | Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue affects eWeLink be… |
CVE-2023-4939 | Medium | 5.3 | 2023-10-21 | The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication to… |
CVE-2023-4501 | Critical | 9.8 | 2023-09-12 | User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enter… |
CVE-2023-4898 | High | 7.5 | 2023-09-12 | Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. |
CVE-2023-36497 | High | 8.8 | 2023-09-11 | Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 could allow a guest user to elevate… |
CVE-2023-2959 | High | 7.5 | 2023-07-17 | Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users. This issue affects Ol… |
CVE-2023-34137 | Critical | 9.8 | 2023-07-13 | SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerabil… |
CVE-2023-34124 | Critical | 9.8 | 2023-07-13 | The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2… |
CVE-2023-28126 | Medium | 5.9 | 2023-05-09 | An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser metho… |
CVE-2022-40723 | Medium | 6.5 | 2023-04-25 | The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations. |
CVE-2023-1833 | Critical | 9.8 | 2023-04-14 | Authentication Bypass by Primary Weakness vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass. This issue affects Redline Ro… |
CVE-2023-28727 | Critical | 9.6 | 2023-03-31 | Panasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass authentication due to mishandling of X-Forwarded-For headers. |
CVE-2023-27538 | Medium | 5.5 | 2023-03-30 | An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH o… |
CVE-2023-27536 | Medium | 5.9 | 2023-03-30 | An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect… |
CVE-2023-27535 | Medium | 5.9 | 2023-03-30 | An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subs… |
CVE-2023-27582 | Critical | 9.1 | 2023-03-13 | maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL author… |
CVE-2023-1307 | Critical | 9.8 | 2023-03-10 | Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13. |
CVE-2023-0777 | Critical | 9.8 | 2023-02-10 | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. |
CVE-2022-3100 | Medium | 5.9 | 2023-01-18 | A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API. |
CVE-2022-4722 | High | 7.2 | 2022-12-27 | Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-39245 | High | 8.4 | 2022-09-26 | Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` variable can allow… |
CVE-2022-38700 | High | 8.8 | 2022-09-09 | OpenHarmony-v3.1.1 and prior versions have a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service. |
CVE-2022-38081 | Medium | 6.2 | 2022-09-09 | OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of… |
CVE-2022-38064 | Medium | 6.2 | 2022-09-09 | OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information. |
CVE-2022-2651 | Critical | 9.8 | 2022-08-04 | Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5. |
CVE-2021-45031 | High | 7.7 | 2022-03-30 | A vulnerability in MEPSAN's USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords. |
CVE-2022-0547 | Critical | 9.8 | 2022-03-18 | OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred auth… |
CVE-2022-23729 | High | 7.8 | 2022-03-04 | When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010. |
CVE-2022-0451 | Medium | 6.5 | 2022-02-18 | Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly… |
CVE-2021-26726 | High | 8.8 | 2022-02-16 | A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges… |
CVE-2021-28503 | High | 7.4 | 2022-02-04 | The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows… |
CVE-2021-3850 | Critical | 9.1 | 2022-01-25 | Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21. |
CVE-2021-43175 | High | 7.5 | 2021-12-07 | The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other… |
CVE-2021-3547 | High | 7.4 | 2021-07-12 | OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certif… |
CVE-2020-15077 | Medium | 5.3 | 2021-06-04 | OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with… |
CVE-2020-15078 | High | 7.5 | 2021-04-26 | OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authe… |
CVE-2021-21403 | High | 7.5 | 2021-03-26 | In github.com/kongchuanhujiao/server before version 1.3.21 there is an authentication Bypass by Primary Weakness vulnerability. All users are impacted. This is… |
CVE-2020-14359 | High | 7.3 | 2021-02-23 | A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass our Gatekeeper. Lowe… |
CVE-2020-24683 | Critical | 9.8 | 2020-12-22 | The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (cl… |
CVE-2020-15787 | Critical | 9.8 | 2020-09-09 | A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attemp… |
CVE-2020-10126 | High | 7.6 | 2020-08-21 | NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor (BNA), enabling an attacker with physical acc… |
CVE-2020-10123 | Medium | 5.3 | 2020-08-21 | The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host… |
CVE-2020-10923 | High | 8.8 | 2020-07-28 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authenticat… |
CVE-2020-11012 | Critical | 9.3 | 2020-04-23 | MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to per… |
CVE-2019-14910 | Critical | 9.8 | 2019-12-05 | A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (… |
CVE-2019-14909 | High | 8.3 | 2019-12-04 | A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accept… |
CVE-2019-14833 | Medium | 5.4 | 2019-11-06 | A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or… |
CVE-2019-0042 | Medium | 4.2 | 2019-04-10 | Juniper Identity Management Service (JIMS) for Windows versions prior to 1.1.4 may send an incorrect message to associated SRX services gateways. This may allo… |
CVE-2019-3878 | High | 8.1 | 2019-03-26 | A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through a… |