Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
1,204 results · Clear filters · Feed
-
High 8.8
An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The request handler for ll.KeepAliveSes…
-
High 7.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
High 7.5
The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authenticati…
-
High 7.3
SourceCodester Royale Event Management System userregister.php improper authentication
A vulnerability was found in SourceCodester Royale Event Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /royal_event/userregister.php. The manipulation leads to improper authentication. The attack …
-
High 7.3
holdennb CollabCal calenderServer.cpp handleGet improper authentication
A vulnerability, which was classified as critical, was found in holdennb CollabCal. Affected is the function handleGet of the file calenderServer.cpp. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The patch i…
-
High 7.5
The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful…
-
High 8.6
Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
-
High 7.8
Rockwell Automation Studio 5000 Logix Emulate Vulnerable to a Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software. Users are granted elevated permissions on certain product services when the software is installed. Due to this misconfiguration, a malicious user could po…
-
High 7.2
Authentication Bypass by Primary Weakness in ikus060/rdiffweb
Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.
-
High 8.1
kyverno verifyImages rule bypass possible with malicious proxy/registry
An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject unsigned arbitrary container images into a protected Kubernetes cluster. This is fixed in 1.8.5. This h…
-
High 8.6
CodeIgniter is vulnerable to improper authentication via Session Handlers
CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an at…
-
High 8.8
A support user exists on the device and appears to be a backdoor for Technical Support staff. The default password for …
-
High 7.5
Denial of service in Modem module due to improper authorization while error handling in Snapdragon Auto, Snapdragon Com…
-
High 7.1
In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented.
-
High 8.3
PIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks.
OpenHarmony-v3.1.4 and prior versions had an vulnerability. PIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks.
-
High 8.8
Authentication bypass vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to bypass au…
-
High 8.8
Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earl…
-
High 8.1
An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFT…
-
High 8.8
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. A default pas…
-
High 8.1
authentik vulnerable to unauthorized user creation and potential account takeover
authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow…
-
High 8.8
SolarWinds Platform Improper Input Validation
SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges.
-
High 7.3
A vulnerability in NetBatch-Plus software allows unauthorized access to the application
A vulnerability in NetBatch-Plus software allows unauthorized access to the application. HPE has provided a workaround and fix. Please refer to HPE Security Bulletin HPESBNS04388 for details.
-
High 8.8
CKAN contains Improper Authentication leading to account takeover
CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.
-
High 7.5
Information disclosure in kernel due to improper handling of ICMP requests in Snapdragon Wired Infrastructure and Netwo…
-
High 7.5
Improper authentication in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may…
-
High 7.7
Improper authentication in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, …
-
High 7.8
Improper authentication in BIOS firmware[A1] for some Intel(R) NUC Kits before version RY0386 may allow an authenticate…
-
High 8.1
Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.…
-
High 7.4
Improper authentication in subsystem for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15…
-
High 8.7
Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.…
-
High 8.8
FLOWRING Agentflow BPM - Broken Access Control
Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account to acquire arbitrary account privilege, and access, manipulate system or disrupt service.
-
High 8.4
Multiple path traversal in appspawn and nwebspawn services.
OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary directories or escape application sandbox.If chained with other vulnerabilities it would allow an unpri…
-
High 8.2
Broken access controls on PDFtron data in M-Files Hubshare
Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL.
-
High 7.5
FactoryTalk Alarm and Events Server Vulnerable to Denial-Of-Service Attack
An unauthenticated attacker with network access to a victim's Rockwell Automation FactoryTalk Alarm and Events service could open a connection, causing the service to fault and become unavailable. The affected port could be used as a server ping port and uses…
-
High 7.3
SourceCodester Sanitization Management System missing authentication
A vulnerability has been found in SourceCodester Sanitization Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to missing authentication. The attack can be launched remotely. …
-
High 8.8
Brokercap Bifrost vulnerable to authentication bypass for admin and monitor user groups
Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user grou…
-
High 7.5
Secuever reverseWall-MDS Remote Code Execution Vulnerability
Remote code execution vulnerability due to insufficient user privilege verification in reverseWall-MDS. Remote attackers can exploit the vulnerability such as stealing account, through remote code execution.
-
High 8.3
Softbus_server in communication subsystem has a authenication bypass vulnerability in a callback handler function. Attackers can launch attacks on distributed networks by sending Bluetooth rfcomm packets to any remote device and executing arbitrary co ...
OpenHarmony-v3.1.2 and prior versions have an authenication bypass vulnerability in a callback handler function of Softbus_server in communication subsystem. Attackers can launch attacks on distributed networks by sending Bluetooth rfcomm packets to any remot…
-
High 8.4
Startup subsystem missed permission validation in param service. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause DoS by disabling particular services.
OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause…
-
High 8.8
Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/…