Weakness (CWE)
CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
How to prevent it (1 mitigation)
-
Architecture and Design
Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
Source: MITRE CWE-288
276 results · Clear filters · Feed
-
High 8.1
User Email Verification for WooCommerce <= 3.5.0 - Authentication Bypass
The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up to, and including, 3.5.0. This is due to a random token generation weakness in the resend_verification_email …
-
High 7.3
PingID Desktop PIN attempt lockout bypass.
PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before the time-based lockout is activated.
-
High 7.8
In multiple functions of AccountManagerService.java, there is a possible loading of arbitrary code into the System Sett…
-
High 8.6
A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unau…
-
High 7.5
NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can r…
-
High 7.5
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read…
-
High 7.7
NVIDIA BMC IPMI handler allows an unauthenticated host to write to a host SPI flash bypassing secureboot protections. T…
-
High 7.1
An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite…
-
High 7.0
Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker coul…
-
High 8.8
SecureGate authentication bypass vulnerability
This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during file transfer. An attacker can take advantage of these vulnerabilities to perform various attacks such as obtaining privil…
-
High 8.5
XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any ema…
-
High 7.5CVE-2022-35869 EPSS 60%
This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation I…
-
High 7.7
PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances
PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.
-
High 7.5
PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file
PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typicall…
-
High 7.2
PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests
PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service us…
-
High 7.7
PingID Mac Login prior to 1.1 vulnerable to pre-computed dictionary attacks
A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.
-
High 7.2
Authentication Bypass Using an Alternate Path or Channel in requarks/wiki
Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions
-
High 7.5
S2S TcpToken authentication bypass
A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impa…
-
High 7.7
PingFederate PingOneMFA Integration Kit MFA Bypass
An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow.
-
High 7.7
PingID Windows Login RSA cryptographic weakness with possible offline MFA bypass
A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.
-
High 7.3
Contrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authentication
An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currentl…
-
High 8.8
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R700…
-
High 8.1
Philips IntelliBridge EC 40 and EC 80 Hub Authentication Bypass Using an Alternate Path or Channel
The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the product has an alternate path or channel that does not require authentication.
-
High 7.3
Mesa Labs AmegaView authentication bypass
Mesa Labs AmegaView Versions 3.0 uses default cookies that could be set to bypass authentication to the web application, which may allow an attacker to gain access.
-
High 8.1
ICSMA-21-343-01 Hillrom Welch Allyn Cardio Products
The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accept manual entry of any active directory (AD) account provisioned in the application without supplying…
-
High —
Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui
### Impact `rucio-webui` installations of the `1.26` release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the `webui` within a close tim…
-
High 7.0
SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstanc…
-
High 8.8CVE-2020-27866 Scanner template
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R602…
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-…
-
High 8.1
RVD#3317: MAVLink version handshaking allows for an attacker to bypass authentication
The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation, in order to maintain backwards compatibility, GCS and autopilot negotiate the version via the AUTOPILOT_VERSION message…
-
High 8.4
Authentication Bypass Vulnerability RSA MFA Agent 2.0 for Microsoft Windows contains an Authentication Bypass vulnerabi…
-
High 8.8
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-8…
-
High 7.2
Junos OS: SRX Series: Unified Access Control (UAC) bypass vulnerability
A vulnerability in Juniper Networks SRX Series device configured as a Junos OS Enforcer device may allow a user to access network resources that are not permitted by a UAC policy. This issue might occur when the IP address range configured in the Infranet Con…
-
High 8.0
An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware ver…
-
High 8.1
RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. The vulnerability all…
-
High 7.5
Docker Authentication Bypass
An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certi…