CWE-305: Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- yop poll, yourownprogrammer yop poll +1 moreWordPress YOP Poll plugin <= 6.5.28 - Vote Manipulation Due to Broken Captcha Control Vulnerability5.3 Medium
- huawei hilink ai life, harmonyos ailife solution 6.0 +1 moreHuawei HiLink AI Life product has an identity authentication bypass vulnerability. Successful...4.0 Medium
- red hat service interconnect 1, service interconnect 1 for rhel 9 +1 moreSkupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service7.1 High
- fortinet fortiwanA relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all...9.8 Critical
TShockNuGetTShock Security Escalation Exploit8.9 High- cisco modeling labsCisco Modeling Labs External Authentication Bypass Vulnerability9.1 Critical
- openafsTheft of credentials in Unix client PAGs8.4 High
- ericsson codecheckercodechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service8.7 High
- swoop 1-click login: passwordless authentication, 1-click login\: passwordless authentication, swoopnow 1-click login\ +2 moreWordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerability9.8 Critical
- redhat quay, red hat quay 3 +1 moreQuay: quay allows successful authentication with trucated version of the password4.8 Medium
- cisco ata 191 firmware, ata 192 firmware, analog telephone adaptor (ata) software +2 moreCisco ATA 190 Series Analog Telephone Adapter Firmware Command Injection and Denial of Service Vulnerability5.4 Medium
- eclipse dataspace components, eclipse foundation edc, edc connector +2 moreEclipse EDC: Consumer pull transfer token validation checks not applied5.0 Medium
- trellix intrusion prevention system (ips) manager, intrusion prevention system manager +1 moreThis vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs...6.3 Medium
- trellix intrusion prevention system (ips) manager, intrusion prevention system manager +1 moreThis vulnerability allows unauthenticated remote attackers to bypass authentication and gain...6.5 Medium
- redhat openshift ai, red hat openshift data science (rhods), rhoai-2.14-rhel-8 +1 more +3 moreOdh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai8.8 High
- gitlabAuthentication Bypass by Primary Weakness in GitLab4.2 Medium
- navidromeNavidrome uses MD5 hashing algorithm9.1 Critical
- wpweb woocommerce - social login, wpwebelite woocommerce social login, yithemes yith woocommerce social login +2 moreWooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password7.3 High
- nuvoton npcm705r firmware, npcm710r firmware, npcm730r firmware +3 more +5 moreNuvoton - CWE-305: Authentication Bypass by Primary Weakness6.7 Medium
- privatebinPrivateBin allows shortening of URLs for other domains5.3 Medium
- kiloview p1/p2, p1 4g video encoder firmware, p2 4g video encoder firmware +2 moreAuthentication Bypass by Primary Weakness in Kiloview P1/P2 devices9.8 Critical
- vmware esxi, cloud foundation +1 moreVMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient...6.8 Medium
- red hat certificate system 10.4 eus for rhel-8, enterprise linux 6, enterprise linux 7 +11 more +13 moreCa: token authentication bypass vulnerability7.5 High
- milesight devicehubMileSight DeviceHub - CWE-305 Missing Authentication for Critical Function10.0 Critical
- mantisbtMantisBT user account takeover in the signup/reset password process7.3 High
- cisco ip phones with multiplatform firmware, phoneos, ip phone 6821 with multiplatform firmware +17 more +19 moreA vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an...7.5 High
- google chrome, fedoraproject fedora +1 moreInsufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote...6.1 Medium
- teosoft software teobaseAuthentication Bypass in TeoSOFT Software TeoBASE9.8 Critical
- xpodas octopod, octoped +1 moreAuthentication Bypass in XPodas' Octopod9.8 Critical
- zksoftware uface 5Authentication Bypass in ZKSoftware's UFace 59.8 Critical
- progress openedgeAuthentication Bypass in OpenEdge Authentication Gateway and AdminServer10.0 Critical
- google android, mediatek mt6739, mt6753 +38 more +40 moreIn telephony, there is a possible escalation of privilege due to a permissions bypass. This could...7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +30 more +32 moreWindows Kerberos Security Feature Bypass Vulnerability8.8 High
- coolkit ewelink, coolkit technology ewelink - smart home, ewelink-smart home +2 moreLockscreen bypass in eWeLink App7.7 High
- salesmanago, salesmanag0 salesmanago & leadoo, salesmanago & leadoo +2 moreSALESmanago <= 3.2.4 - Log Injection via Weak Authentication Token5.3 Medium
- linuxfoundation nats-serverNATS.io: Adding accounts for just the system account adds auth bypass6.5 Medium
- microfocus cobol server, enterprise developer, enterprise server +4 more +6 moreAuthentication bypass in OpenText (Micro Focus) Enterprise Server9.8 Critical
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anything-llm +1 moreAuthentication Bypass by Primary Weakness in mintplex-labs/anything-llm8.2 High
- dover fueling solutions maglink lx web console configurationDover Fueling Solutions MAGLINK LX Web Console Authentication Bypass by Primary Weakness8.8 High
- tenda n300 wireless n vdsl2 modem router, n300 firmware +1 moreAuthentication Bypass in Tenda N300 Wireless N VDSL2 Modem Router5.3 Medium
- emerson dl8000 firmware, roc809 firmware, roc809l firmware +6 more +8 moreCVE-2023-19359.4 Critical
- daprAPI token authentication bypass in HTTP endpoints in Dapr6.8 Medium
- oliva expertise eks, olivaekspertiz oliva ekspertiz +1 moreAuthentication Bypass by Primary Weakness in Oliva Expertise7.5 High
- sonicwall analytics, gms, global management system +2 moreSonicWall GMS and Analytics CAS Web Services application use static values for authentication...9.8 Critical
- sonicwall analytics, gms, global management system +2 moreThe authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks,...9.8 Critical
- ivanti avalancheAn authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could...5.9 Medium
- ping identity pingid radius pcv, pingidentity pingfederate, radius pcv +3 more +5 moreConfiguration-based MFA Bypass in PingID RADIUS PCV.6.5 Medium
- dts electronics redline router, redline router firmware +1 moreAuthentication Bypass in Redline Router9.8 Critical
- panasonic aiseg2, aiseg2 firmware +1 morePanasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass authentication due...9.6 Critical
- haxx libcurl, broadcom brocade fabric operating system firmware, debian linux +11 more +13 moreAn authentication bypass vulnerability exists in libcurl v8.0.0 where it reuses a previously...5.5 Medium
- Show moreLoading…