Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
3,176 results · Feed
-
Critical 9.8
An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The …
-
Critical 9.8
An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The …
-
Critical 9.8
Apache IoTDB grafana-connector Login Bypass Vulnerability
Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3. Attackers could login without authorization. This is fixed in 0.13.4.
-
Medium 5.3
Junos OS: Unauthenticated access vulnerability in J-Web
An Improper Authentication vulnerability in upload-file.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to upload arbitrary files to temporary folders on the device. This issue affects Juniper Ne…
-
Medium 5.3
Junos OS: User-controlled input vulnerability in J-Web
An Improper Authentication vulnerability in cert-mgmt.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to read arbitrary files from temporary folders on the device. This issue affects Juniper Netw…
-
Medium 6.5
The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploita…
-
Critical 9.8
Improper Authentication Mechanism in B&R VC4 Visualization
Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The i…
-
Medium 5.9
A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated atta…
-
Critical 9.8
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur un…
-
Critical 9.8
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication for SAML Use…
-
Unscored —
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to …
-
Medium 6.5
Two factor authentication bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to can…
-
High 7.7
Improper authentication vulnerability in GitHub Enterprise Server leading to modification of secret gists
An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users' secret gists by authenticating through an SSH certificate authority. To do so, a user had to know the secret gist's U…
-
Critical 9.8CVE-2021-28235 Public exploit
Etcd-io Improper Authentication vulnerability
Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.
-
Medium 5.3
jeecg-boot API Documentation improper authentication
A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has b…
-
Critical 9.8
An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorre…
-
Medium 4.4
App lockout in nextcloud Android app can be bypassed via thirdparty apps
Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a t…
-
Medium 4.4
App pin of the iOS app can be bypassed in Nextcloud iOS
Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextclo…
-
High 8.8
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1…
-
High 7.5
In multiple functions of PasspointXmlUtils.java, there is a possible authentication misconfiguration due to a logic err…
-
Critical 9.8
Ansible Semaphore mishandles authentication
api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication.
-
High 7.3
SourceCodester Medicine Tracker System improper authentication
A vulnerability, which was classified as critical, was found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file Users.php?f=save_user. The manipulation of the argument firstname/middlename/lastname/username/password leads …
-
Medium 6.5
SourceCodester Online Pizza Ordering System Password Change improper authentication
A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admin/ajax.php?action=save_user of the component Password Change Handler. The manipulation leads to impr…
-
Medium 4.4
Improper authentication in SecSettings prior to SMR Mar-2023 Release 1 allows attacker to reset the setting.
-
Medium 5.9
Improper authorization implementation in Exynos baseband prior to SMR Mar-2023 Release 1 allows incorrect handling of u…
-
Medium 4.3
IBM Robotic Process Automation security bypass
IBM Robotic Process Automation 21.0.0 - 21.0.7 and 23.0.0 is vulnerable to client-side validation bypass for credential pools. Invalid credential pools may be created as a result. IBM X-Force ID: 242951.
-
Medium 5.4
IBM Manage Application security bypass
IBM Manage Application 8.8.0 and 8.9.0 in the IBM Maximo Application Suite is vulnerable to incorrect default permissions which could give access to a user to actions that they should not have access to. IBM X-Force ID: 242953.
-
Critical 9.9
Improper Access Control in SAP NetWeaver AS for Java
Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized oper…
-
Critical 9.1
Full authentication bypass if SASL authorization username is specified
maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating …
-
Unscored —CVE-2022-44574 EPSS 64%
An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to…
-
Critical 10.0
homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for…
-
High 7.8
Improper authentication in Qualcomm IPC
Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD.
-
Medium 4.3
The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 doe…
-
High 8.8
Improper authentication vulnerability in S+ Operations
Improper Authentication vulnerability in ABB Symphony Plus S+ Operations.This issue affects Symphony Plus S+ Operations: from 2.X through 2.1 SP2, 2.2, from 3.X through 3.3 SP1, 3.3 SP2.
-
Medium 6.5
This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, wh…
-
High 7.5
An issue was discovered in Docmosis Tornado prior to version 2.9.5. An unauthenticated attacker can bypass the authenti…
-
Medium 4.6
There is a data processing error vulnerability in Leia-B29 2.0.0.49(M03). Successful exploitation could bypass lock scr…
-
Medium 5.5
There is an identity authentication bypass vulnerability in Huawei Children Smart Watch (Simba-AL00) 1.1.1.274. Success…
-
Medium 5.3
Cisco Nexus 9300-FX3 Series Fabric Extender for UCS Fabric Interconnects Authentication Bypass Vulnerability
A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender (FEX) when used in UCS Fabric Interconnect deployments could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerabi…
-
Critical 9.8
An access control issue in H3C A210-G A210-GV100R005 allows attackers to authenticate without a password.