CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- goauthentik authentikauthentik has a forward authentication bypass with broken cookie8.6 High
- apple ipados, ios and ipados, iphone os +2 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.5 Medium
- getoutline outlineOutline has a suspended user authentication bypass via WebSocket connections6.9 Medium
- metis cyberspace technology sa dfsUnauthenticated Remote Command Execution via Web Console in METIS DFS9.8 Critical
- metis cyberspace technology sa wicUnauthenticated Remote Root Shell Access via Web Console in METIS WIC9.8 Critical
- No product listedA missing authentication mechanism in the web management API components of Shenzhen Zhibotong...8.1 High
- No product listedA lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT...6.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Storage Elevation of Privilege Vulnerability7.0 High
- capacitor-native-biometriccapacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObject in onAuthenticationSucceeded4.3 Medium
- apache druidApache Druid: Authentication Bypass via LDAP Anonymous Bind9.8 Critical
- birtech information technologies industry and trade ltd. co. sensewayImproper Authentication in Birtech Information Technologies' Sensaway7.3 High
- code-projects contact management systemcode-projects Contact Management System CRUD Endpoint improper authentication6.9 Medium
- cradle e-commercedetronetdip E-commerce Account Creation Endpoint add_seller.php missing authentication6.9 Medium
- antrea-io antreaAntrea has invalid enforcement order for network policy rules caused by integer overflow8.0 High
- flycatcher toys smart pixelator, flycatcher smart pixelator firmware +1 moreFlycatcher Toys smART Pixelator Bluetooth Low Energy missing authentication5.3 Medium
- gogsGogs Vulnerable to 2FA Bypass via Recovery Code7.7 High
- frangoteam fuxaFUXA Unauthenticated Remote Code Execution via Admin JWT Minting10.0 Critical
- rapid7 vulnerability managementRapid7 InsightVM Signature Validation Vulnerability9.6 Critical
- amcoders dokansDokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers...10.0 Critical
- dji air, mavic mini, mini se +1 more +3 moreDJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay2.3 Low
- efm iptime a8004t, iptime a8004t firmware +1 moreEFM ipTIME A8004T Hidden Hiddenloginsetup timepro.cgi httpcon_check_session_url improper authentication6.9 Medium
- progress software chef inspecUntrusted user data can lead to privilege escalation5.8 Medium
- dell openmanage network integrationDell OpenManage Network Integration, versions prior to 3.9, contains an Improper Authentication...4.3 Medium
- delinea secret server, delinea inc. secret server on-prem +1 moreFailure in Password Rotation and Check-in Mechanism in Secret Server Allows Reuse of Credentials5.3 Medium
- linuxfoundation everest, everest everest-core +1 moreEvseV2G has sequence state validation bypass4.3 Medium
- beetel 777vr1, 777vr1 firmware +1 moreBeetel 777VR1 UART missing authentication5.4 Medium
- roxnor metform – contact form, survey, quiz, & custom form builder for elementorMetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value3.7 Low
- No product listedAn issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user...9.8 Critical
- horillaHorilla HR has 2FA Bypass through its OTP Handling Logic8.1 High
- atomberg erica smart fan firmwareAn issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to...7.4 High
- crmebCRMEB JSON Token LoginServices.php remoteRegister improper authentication6.3 Medium
- crmebCRMEB LoginController.php appleLogin improper authentication6.9 Medium
- tp-link systems inc. vigi c230i mini, vigi c240 1.0, vigi c250 +31 more +33 moreAuthentication Bypass in Password Recovery Feature via Local Web App on Multiple VIGI Cameras8.7 High
- mitel mivoice mx-oneA vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50)...9.4 Critical
- arubanetworks edgeconnect sd-wan orchestratorUnauthenticated Bypass Allows Multi-Factor Authentication Circumvention9.8 Critical
- bluspark global bluvoyixImproper Authentication Vulnerability in BLUVOYIX10.0 Critical
- blurams dome flare firmwareAn insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera...6.8 Medium
- netgear ex2800, ex2800 firmware, ex3110 +5 more +7 morePath traversal vulnerability in Netgear WiFi Range Extenders6.1 Medium
- netgear ex2800, ex2800 firmware, ex3110 +5 more +7 moreAuthentication bypass in NETGEAR WiFi Range Extenders via network adjacent attacks6.1 Medium
- netgear cbr750, cbr750 firmware, nbr750 +47 more +49 moreAuthentication Bypass in NETGEAR Orbi Devices6.1 Medium
- samrocketman jervisJervis has AES CBC Mode Without Authentication8.7 High
- semantic-machines vedaAn issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a...8.6 High
- broadcom dx netops spectrumSpectrum broken authentication8.7 High
- flycatcher toys smart sketcherFlycatcher Toys smART Sketcher Bluetooth Low Energy missing authentication5.3 Medium
- ghostGhost has Staff 2FA bypass8.1 High
- icewhaletech zimaosZimaOS has Authentication Bypass via System-Level Username9.4 Critical
- kanboardKanboard is Vulnerable to Reverse Proxy Authentication Bypass9.1 Critical
- kaysus ks-wr3600 firmwareKAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session...9.4 Critical
- https://github.com/linrunner tlpPolkit Authorization Check can be Bypassed in the TLP power daemon5.1 Medium
- wolfssl wolfssl-pywolfSSL Python library `CERT_REQUIRED` mode fails to enforce client certificate requirement9.3 Critical
- Show moreLoading…