Weakness (CWE)
CWE-1390: Weak Authentication
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
Source: MITRE CWE-1390
136 results · Feed
-
Critical 9.0
Microsoft Dynamics 365 Elevation of Privilege Vulnerability
Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network.
-
Low 2.3
/n software IPWorks SSH insufficient file access verification
The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or certificate. To be exploitable, an application calling the SFTPServer component must grant user acc…
-
Critical 9.1
Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways. This is rel…
-
Medium 4.3
tpm2 does not detect if quote was not generated by TPM
tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7.
-
Critical 9.1
Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many …
-
Medium 4.2
Quay: unauthorized user may authenticate via oauth application token
A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having access to the organization from which the application was created. This issue is limited to authentic…
-
High 7.3
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
-
High 8.8
An issue in Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 allows attackers to bypass authentication and access the admi…
-
High 8.8
Poor session management in Evolution Controller allows administrator functionality for unauthenticated connections
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in.
-
Critical 9.8
An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers…
-
High 7.5
Ovirt: authentication bypass
An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command.
-
Medium 6.5
Weak authentication vulnerability in Fujitsu Arconte Áurea
ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate account and cause a denial of service. In addition, a resource has been identified that could allow circ…
-
Low 3.5
Jetty's OpenId Revoked authentication allows one request
Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revok…
-
Medium 5.0
A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all v…
-
Medium 6.5
Microsoft OneDrive for iOS Security Feature Bypass Vulnerability
Microsoft OneDrive for iOS Security Feature Bypass Vulnerability
-
Critical 9.8
A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 (All versions < V22.2a (80)). The mobil…