Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
91 results · Clear filters · Feed
-
Low 2.8
Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Healt…
-
Low 3.3
Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is u…
-
Low 3.3
A PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI d…
-
Low 2.0
A user without PR can reset user authentication failures information
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be …
-
Low 2.3
Improper running task check in S Secure prior to SMR MAY-2021 Release 1 allows attackers to use locked app without auth…
-
Low 3.3
Intent redirection in Samsung Experience Service versions 10.8.0.4 in Android P(9.0) below, and 12.2.0.5 in Android Q(1…
-
Low 3.3
Hijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is ex…
-
Low 3.5
Web Gateway (MWG) - Privilege Escalation vulnerability
Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected log data via improper access controls in the user interface.
-
Low 3.7
Improper Authentication in org.keycloak:keycloak-core
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit furth…
-
Low —
Improper Authentication in Apache Hadoop
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensiti…
-
Low —
Puppet supports use of IP addresses in certnames without warning of potential risks
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP a…