CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
A kind of CWE-306 Missing Authentication for Critical Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- matrix comsec door controller cosec vega faxq, door controller cosec vega faxq firmware, matrixcomsec cosec vega faxq firmware +2 moreAuthentication Bypass Vulnerability in Matrix Door Controller9.3 Critical
- sharp bp-30c25 firmware, bp-30c25t firmware, bp-30c25y firmware +324 more +326 moreSharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an...9.1 Critical
- advancedcoding comments – wpdiscuz, gvectors wpdiscuz +1 moreComments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider9.8 Critical
- vitalii ibryl switch user, vitaliibryl switch user +1 moreWordPress iBryl Switch User plugin <= 1.0.1 - Account Takeover vulnerability8.8 High
- roveridx rover idxRover IDX <= 3.0.0.2905 - Authenticated (Subscriber+) Authentication Bypass to Administrator8.8 High
- vivek tamrakar wp rest api fnsWordPress WP REST API FNS Plugin plugin <= 1.0.0 - Account Takeover vulnerability9.8 Critical
- n-media simple user registration, najeebmedia memberhero +1 moreWordPress Simple User Registration plugin <= 6.7 - Broken Authentication vulnerability9.8 Critical
- cyberlord92 miniorange otp verification with firebase, miniorange otp verification with firebase +1 moreMiniorange OTP Verification with Firebase <= 3.6.0 - Authentication Bypass8.1 High
- nextendweb nextend social login proNextend Social Login Pro <= 3.1.14 - Authentication Bypass via WordPress.com OAuth provider9.8 Critical
- oc2ps better-bp-registration, sk buddypress better registration +1 moreWordPress BuddyPress Better Registration plugin <= 1.6 - Broken Authentication vulnerability9.8 Critical
- tophive ultimate aiUltimateAI <= 2.8.3 - Authentication Bypass9.8 Critical
- pedalo connector, pedaloagency pedalo connector +1 morePedalo Connector <= 2.0.5 - Authentication Bypass to Administrator9.8 Critical
- lagunaisw wp users masqueradeWP Users Masquerade <= 2.0.0 - Authenticated (Subscriber+) Authentication Bypass8.8 High
- ivanti avalanchePath Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker...7.3 High
- ivanti avalanchePath Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker...7.3 High
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +84 more +86 moreThe web server of affected devices do not properly authenticate user request to the '/ClientArea...6.9 Medium
- latepoint, latepoint plugin +1 moreLatePoint <= 5.0.12 - Authentication Bypass9.8 Critical
- redefiningtheweb affiliate pro, wordpress & woocommerce affiliate program +1 moreWordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation9.8 Critical
- xunhuweb wechat social login, wechat social login 微信qq钉钉登录插件 +1 moreWechat Social login <= 1.3.0 - Authentication Bypass9.8 Critical
- artbees jupiter x coreJupiter X Core <= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover8.1 High
- dover fueling solutions (dfs) progauge maglink lx console, doverfuelingsolutions maglink lx console, dover fueling solutions (dfs) progauge maglink lx4 console +3 more +5 moreDover Fueling Solutions ProGauge MAGLINK LX CONSOLE Authentication Bypass Using an Alternate Path or Channel9.3 Critical
- villatheme woocommerce photo reviews premium, woocommerce photo reviews +1 moreWooCommerce Photo Reviews Premium <= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege Escalation9.8 Critical
- ivanti workspace controlAn authentication bypass weakness in the message broker service of Ivanti Workspace Control...7.8 High
- beckhoff twincat/bsd, ipc diagnostics package, twincat\/bsd +2 moreBeckhoff: Local authentication bypass in the IPC-Diagnostics package included in TwinCAT/BSD7.8 High
- hitachi ops center common servicesAuthentication Bypass Vulnerability in Hitachi Ops Center Common Services7.8 High
- ibm openpages with watson, openpages grc platform +1 moreIBM OpenPages information disclosure6.5 Medium
- blackberry cylanceoptics, cylanceoptics for windows +1 moreVulnerability in CylanceOPTICS Windows Installer Package Impacts CylanceOPTICS for Windows7.1 High
- inspireui mstore api – create native android & ios apps on the cloud, mstore api, mstore api create native android and ios apps on the cloud +2 moreMStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover8.1 High
- ibm openbmcIBM OpenBMC authentication bypass7.5 High
- gst electronics inohom nova panel n7Authentication Bypass in GST Electronics' inohom Nova Panel N79.9 Critical
- wpweb woocommerce - social login, woocommerce social login +1 moreWooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover9.8 Critical
- reputeinfosystems appointment booking calendar plugin and scheduling plugin – bookingpress, appointment booking calendar plugin and scheduling plugin bookingpress +1 moreAppointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress 1.1.6 - 1.1.7 - Authentication Bypass to Account Takeover9.8 Critical
- anji-plus aj-report, report +1 moreanji-plus AJ-Report Authentication Bypass9.8 Critical
- positron s.r.l broadcast signal processor tra7005, positron tra7005 firmware +1 moreAuthentication Bypass Using an Alternate Path or Channel in Positron Broadcast Signal Processor TRA70058.7 High
- wpweb woocommerce - pdf vouchers, woocommerce pdf vouchers +1 moreWooCommerce - PDF Vouchers <= 4.9.3 - Authentication Bypass to Voucher Vendor7.3 High
- d-link dsl-225, dlink dsl-225 firmware +1 moreD-Link - CWE-288: Authentication Bypass Using an Alternate Path or Channel9.8 Critical
- wpweb woocommerce - social login, woocommerce social login +1 moreWooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication Bypass7.3 High
- apinizer, pruvasoft informatics apinizer management console +1 moreAuthentication Bypass in PruvaSoft Informatics' Apinizer Management Console6.5 Medium
- fluxbuilder mstore api, inspireui mstore api – create native android & ios apps on the cloud +1 moreMStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass9.8 Critical
- instawp connect – 1-click wp staging & migration, connect +1 moreInstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin9.8 Critical
- n-able n-centralN-central Authentication Bypass9.1 Critical
- n-able n-centralN-central Authentication Bypass via Session Rebinding9.1 Critical
- parse community server, parse-community parse-server +1 moreZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability9.8 Critical
- juniper session smart conductor, session smart router, wan assurance router +2 moreSession Smart Router(SSR): On redundant router deployments API authentication can be bypassed10.0 Critical
- ibm openbmcIBM OpenBMC information disclosure7.5 High
- webinane lifeline donationLifeline Donation <= 1.2.6 - Authentication Bypass9.8 Critical
- firefly-iiiMFA bypass in oauth flow in Firefly III5.9 Medium
- jlink ax1800An issue in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to...9.8 Critical
- toshiba tec corporation tec e-studio multi-function peripheral (mfp), toshibatec e-studio-2010-ac, e-studio-2015-nc +48 more +50 moreAuthentication Bypass Vulnerability8.8 High
- motorola solutions vigilant fixed lpr coms box (bcav1f2-c600), motorola vigilant fixed lpr coms box firmware, motorolasolutions vigilant fixed lpr coms box bcav1f2 c600 +2 moreAuthentication Bypass Using an Alternate Path or Channel in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)5.1 Medium
- Show moreLoading…