Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
3,176 results · Feed
-
Medium 6.3
harrystech Dynosaur-Rails application_controller.rb basic_auth improper authentication
A vulnerability has been found in harrystech Dynosaur-Rails and classified as critical. Affected by this vulnerability is the function basic_auth of the file app/controllers/application_controller.rb. The manipulation leads to improper authentication. This pr…
-
High 7.3CVE-2023-0905 Public exploit
SourceCodester Employee Task Management System changePasswordForEmployee.php improper authentication
A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file changePasswordForEmployee.php. The manipulation leads to improper authentication. It is possible to launch…
-
Critical 9.1
Priority Web – Authentication bypass
Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass.
-
High 7.5
Disable NTLM: SAM 2022.4
Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were querying for data via IP address this prevented us from utilizing Kerberos.
-
High 7.8CVE-2023-21817 Public exploit
Windows Kerberos Elevation of Privilege Vulnerability
Windows Kerberos Elevation of Privilege Vulnerability
-
Medium 6.5
Microsoft OneNote Elevation of Privilege Vulnerability
Microsoft OneNote Elevation of Privilege Vulnerability
-
Medium 5.4
Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform an…
-
High 8.2
System account impersonation in DataHub
DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service (GMS) will use the X-DataHub-Actor HTTP header to infer the user the frontend is sending the request …
-
Medium 4.3
Improper access control vulnerability in telecom application prior to SMR JAN-2023 Release 1 allows local attackers to …
-
Medium 4.0
Improper access control vulnerability in Phone application prior to SMR Feb-2023 Release 1 allows local attackers to ac…
-
Medium 4.3
An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container re…
-
High 7.5
The IHwAttestationService interface has a defect in authentication. Successful exploitation of this vulnerability may a…
-
High 8.1
An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. Dur…
-
Critical 9.4CVE-2023-22501 EPSS 16%
An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attack…
-
Critical 9.8CVE-2022-47003 Scanner template
A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via …
-
High 7.6
Privilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenter
Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.9.0 before 04.9.1.
-
Medium 5.9
Privilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenter
Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.8.0 before 04.9.1.
-
High 7.5
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via s…
-
High 7.8
Improper Authentication vulnerability in Toshiba Storage Security Software V1.2.0.7413 is that allows for sensitive inf…
-
High 7.5
Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization
Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3.
-
Critical 9.8
A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when…
-
Critical 9.8
An issue in the component global.so of Totolink A830R V4.1.2cu.5182 allows attackers to bypass authentication via a cra…
-
Medium 5.6
Limited Authentication bypass due to hardcoded secret
There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a v…
-
High 8.8
Rancher generated tokens not revoked after modifications made to authentication provider
### Impact This issue affects Rancher versions from 2.5.0 up to and including 2.5.16, from 2.6.0 up to and including 2.6.9 and 2.7.0. It only affects Rancher setups that have an external [authentication provider](https://ranchermanager.docs.rancher.com/pages-…
-
Medium 4.7
Issue with whitespace in JWT roles in OpenSearch
OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are proces…
-
Medium 6.8
In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure. This could lead to l…
-
High 7.5
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be …
-
Critical 9.8
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the…
-
Critical 9.1
In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n…
-
Critical 9.1
Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when …
-
Medium 5.3
Use of password hash instead of password for authentication vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and e…
-
Medium 5.3
It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT t…
-
High 8.8
An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The request handler for ll.KeepAliveSes…
-
High 7.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Critical 9.8
TP-Link SG105PE firmware prior to 'TL-SG105PE(UN) 1.0_1.0.0 Build 20221208' contains an authentication bypass vulnerabi…
-
Medium 5.3
m-FILTER prior to Ver.5.70R01 (Ver.5 Series) and m-FILTER prior to Ver.4.87R04 (Ver.4 Series) allows a remote unauthent…
-
Medium 5.3
Improper Authentication in thorsten/phpmyfaq
Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
-
Medium 6.5
Netdata is vulnerable to improper authentication
Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. Each Netdata Agent has an automatically generated MACHINE GUID. It is generated when the agent first starts and it is saved to disk, so that it will persist across r…
-
Critical 9.8
EXFO - BV-10 Performance Endpoint Unit Authentication bypass
EXFO - BV-10 Performance Endpoint Unit authentication bypass User can manually manipulate access enabling authentication bypass.
-
High 7.5
The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authenticati…