Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
3,173 results · Feed
-
Medium 6.3
Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specifi…
-
High 7.3
Demososo DM Enterprise Website Building System Cookie indexDM_load.php dmlogin improper authentication
A vulnerability has been found in Demososo DM Enterprise Website Building System up to 2022.8 and classified as critical. Affected by this vulnerability is the function dmlogin of the file indexDM_load.php of the component Cookie Handler. The manipulation of …
-
High 7.5
The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows att…
-
Medium 6.5CVE-2023-52160 Public exploit
The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_su…
-
Critical 9.6
Arbitrary Authentication Relay Vulnerability in Deprecated EAP Browser Plugin
Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor that could trick a target domain user with EAP installed in their web browser into requesting and re…
-
High 7.1
IBM Spectrum Scale security bypass
IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.7.0 could allow a local attacker to initiate connections from a container outside the current namespace. IBM X-Force ID: 237811.
-
High 7.5
IBM Spectrum Scale security bypass
IBM Storage Scale Container Native Storage Access 5.1.2.1 -through 5.1.7.0 could allow an attacker to initiate connections to containers from external networks. IBM X-Force ID: 237812.
-
Critical 9.8
Adobe FrameMaker Publishing Server Authentication Bypass Vulnerability | CVE-2023-44324 bypass
Adobe FrameMaker Publishing Server versions 2022.1 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass authentication mechanisms and gain …
-
Medium 4.2
External OpenID Connect Account Takeover by E-Mail Change in mastodon
Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML, OIDC) to attach to existing local users with the same e-mail address. This results in a possible ac…
-
High 8.8
CWE-287: Improper Authentication vulnerability exists that could cause unauthorized tampering of device configuration o…
-
Medium 5.2
Improper authentication in some Intel(R) Server Product OpenBMC firmware before version egs-1.09 may allow an authentic…
-
Critical 9.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
KEV Feb 15, 2024 -
High 7.3
A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector …
-
High 8.8
Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters …
-
Critical 10.0
OpenObserve Privilege Escalation Vulnerability in Users API
OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/{org_id}/users" endpoint. This vulnerability allows any authenticated regular…
-
Critical 9.1
OpenObserve Unauthorized Access Vulnerability in Users API
OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/{org_id}/users/{email_id}" endpoint. This vulnerability allows any a…
-
Critical 9.8
An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific co…
-
Critical 9.8
An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php…
-
High 7.7
Open Forms potential multi-factor authentication bypass
Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials (username + password) compromised could potentially …
-
Medium 5.3
Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints
Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without proper authentication. The attacker is not allowed to do any modification within the Ozo…
-
Medium 5.3
QTS, QuTS hero, QuTScloud
An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in t…
-
Medium 5.5
ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of…
-
Medium 4.2
OctoPrint Unverified Password Change via Access Control Settings
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An…
-
Medium 6.5
PKCE downgrade attack in Authentik
Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the code_challenge parameter to the authorization request and adds the code_verifier p…
-
Critical 9.8
CrateDB authentication bypass vulnerability
CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a s…
-
High 7.3
Shanxi Diankeyun Technology NODERP Cookie common.php improper authentication
A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file application/index/common.php of the component Cookie Handler. The manipulation of the argument Nod_U…
-
Medium 5.3
Insufficient access control
When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user. The attack requires a logged-in other user to know the UUID. While the legitimate user completes the comment, the malicious user can add more …
-
Medium 6.3
Sichuan Yougou Technology KuERP common.php checklogin improper authentication
A vulnerability classified as critical was found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this vulnerability is the function checklogin of the file /application/index/common.php. The manipulation of the argument App_User_id/App_user_Token l…
-
Critical 9.6
Motorola MR2600 Authentication Bypass Vulnerability
An authentication bypass vulnerability exists in the web component of the Motorola MR2600. An attacker can exploit this vulnerability to access protected URLs and retrieve sensitive information.
-
Medium 6.5
Authentication bypass in vector-admin domain restriction
Authentication bypass in vector-admin allows a user to register to a vector-admin server while “domain restriction” is active, even when not owning an authorized email address.
-
High 7.5
HPE OneView may allow clusterService Authentication Bypass resulting in denial of service.
-
Medium 6.2
The issue was addressed with improved authentication. This issue is fixed in iOS 17.3 and iPadOS 17.3. Stolen Device Pr…
-
Medium 5.5
An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.6.4. A lo…
-
High 7.5
Authorization vulnerability in the BootLoader module. Successful exploitation of this vulnerability may affect service …
-
High 7.5
EverShop vulnerable to improper authorization in GraphQL endpoints
Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.
-
Medium 4.8
rubygems.org MFA Bypass through password reset function could allow account takeover
Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to b…
-
Critical 9.1
@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)
Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.
-
Critical 9.8
An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string…
-
Medium 5.9
Hozard alarm system (Alarmsysteem) v1.0 is vulnerable to Improper Authentication. Commands sent via the SMS functionali…
-
Critical 9.8
Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.