CWE-303: Incorrect Implementation of Authentication Algorithm
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- kiteworks security-advisories, nextcloud user oidc +1 moreIssuer not verified from obtained token in user_oidc4.8 Medium
- google chromeInappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote...9.6 Critical
- freebsdNetwork authentication attack via pam_krb59.8 Critical
- microsoft sharepoint server, sharepoint server 2019 +1 moreMicrosoft SharePoint Server Elevation of Privilege Vulnerability9.8 Critical
- mendix saml, siemens mendix saml (mendix 7 compatible), mendix saml (mendix 8 compatible) +6 more +8 moreA vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3...9.1 Critical
- weston embedded uc-ftpsAn authentication bypass vulnerability exists in the Authentication functionality of Weston...8.6 High
- tp-link tl-wr940n, tl-wr940n firmware +1 moreThis vulnerability allows network-adjacent attackers to disclose sensitive information on...6.5 Medium
- mendix saml, siemens mendix saml (mendix 7 compatible), mendix saml (mendix 8 compatible) +4 more +6 moreA vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All Versions >= 1.16.4 ...9.1 Critical
- m-files clientIncorrect Implementation of Authentication Algorithm4.8 Medium
github.com/prometheus/prometheusGo,github.com/prometheus/prometheus/v2Go +1 morePrometheus vulnerable to basic authentication bypass7.2 High- prometheus exporter toolkit, exporter-toolkit +1 morePrometheus Exporter Toolkit vulnerable to basic authentication bypass6.2 Medium
- datahubDataHub missing JWT signature check9.9 Critical
- cisco small business rv series router firmware, rv110w firmware, rv130 firmware +2 more +4 moreCisco Small Business RV110W, RV130, RV130W, and RV215W Routers IPSec VPN Server Authentication Bypass Vulnerability4.0 Medium
- siemens opcenter quality v13.1, opcenter quality v13.2, opcenter quality +2 moreA vulnerability has been identified in Opcenter Quality V13.1 (All versions < V13.1.20220624),...7.5 High
- cisco wireless lan controller (wlc), wireless lan controller 8.10.151.0, wireless lan controller 8.10.162.0 +2 moreCisco Wireless LAN Controller Management Interface Authentication Bypass Vulnerability10.0 Critical
- garrett ic module cmaAn authentication bypass vulnerability exists in the CMA run_server_6877 functionality of Garrett...7.5 High
- apollosapp data-connector-rock, apollosproject apollos-apps +1 moreAuto-merging Person Records Compromised8.8 High
- envoyproxy envoyJWT authentication bypass with unknown issuer token8.2 High
- opensuse tumbleweed, saltstack salt, suse linux enterprise server 15 sp 3 +2 moresalt-api unauthenticated remote code execution9.8 Critical
- d-link dir-842, dlink dir-842 firmware +1 moreThis vulnerability allows network-adjacent attackers to bypass authentication on affected...8.8 High
- simplesamlphp saml2Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET6.5 Medium
- bec technologies multiple routers, dlink dir-867 firmware, dir-878 firmware +1 more +3 moreThis vulnerability allows network-adjacent attackers to bypass authentication on affected...8.8 High
- d-link dap-1330, dlink dap-1330 firmware +1 moreThis vulnerability allows network-adjacent attackers to bypass authentication on affected...8.8 High
- siemens tim 1531 irc, tim 1531 irc firmware +1 moreA vulnerability has been identified in TIM 1531 IRC (All versions < V1.1). A remote attacker with...9.8 Critical
- nextcloud server, owncloud +1 moreNextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer...8.1 High