CWE-287
Improper Authentication
Description
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-114 · CAPEC-115 · CAPEC-151 · CAPEC-194 · CAPEC-22 · CAPEC-57 · CAPEC-593 · CAPEC-633 · CAPEC-650 · CAPEC-94
CVEs mapped to this weakness (5,083)
page 166 of 255| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2015-5298 | Med | 0.35 | 6.5 | 0.01 | Jul 7, 2022 | The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification. | ||
| CVE-2022-28713 | Med | 0.35 | 5.3 | 0.01 | Jul 4, 2022 | Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information without logging in to the product. | ||
| CVE-2022-29578 | Med | 0.35 | 5.3 | 0.01 | Jun 24, 2022 | Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address, and daily energy usage. | ||
| CVE-2022-20733 | Med | 0.35 | 5.3 | 0.01 | Jun 15, 2022 | A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions. This vulnerability is due to exposed sensitive Security Assertion Markup… | ||
| CVE-2022-29883 | Med | 0.35 | 5.3 | 0.01 | May 20, 2022 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not restrict unauthenticated access to certain pages of the web interface. This could allow an attacker to delete log files without authentication. | ||
| CVE-2021-26598 | Med | 0.35 | 5.3 | 0.11 | Mar 28, 2022 | ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token). | ||
| CVE-2020-14504 | Med | 0.35 | 5.3 | 0.01 | Feb 24, 2022 | The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacker can send a crafted request that may allow for modification of the configuration settings. | ||
| CVE-2021-36346 | Med | 0.35 | 5.3 | 0.04 | Jan 25, 2022 | Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to deny access to the iDRAC webserver. | ||
| CVE-2022-22289 | Med | 0.35 | 5.3 | 0.01 | Jan 10, 2022 | Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information. | ||
| CVE-2021-44937 | Med | 0.35 | 5.3 | 0.01 | Dec 14, 2021 | glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /public_html/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied. | ||
| CVE-2021-43068 | Med | 0.35 | 5.4 | 0.01 | Dec 9, 2021 | A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authentication via a RADIUS login portal. | ||
| CVE-2021-41309 | Med | 0.35 | 5.3 | 0.01 | Dec 8, 2021 | Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken Authentication vulnerability in the… | ||
| CVE-2021-38376 | Med | 0.35 | 5.3 | 0.01 | Nov 22, 2021 | OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call. | ||
| CVE-2021-22490 | Med | 0.35 | 5.3 | 0.01 | Oct 28, 2021 | There is a Permission verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect the device performance. | ||
| CVE-2021-32951 | Med | 0.35 | 5.3 | 0.01 | Oct 27, 2021 | WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored and controlled by the WebAccess/NMS, as well as IP addresses and names of all the devices managed via WebAccess/NMS. | ||
| CVE-2021-41157 | Med | 0.35 | 5.3 | 0.02 | Oct 26, 2021 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. By default, SIP requests of the type SUBSCRIBE are not authenticated in the affected versions of… | ||
| CVE-2021-24017 | Med | 0.35 | 5.4 | 0.01 | Sep 30, 2021 | An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler. | ||
| CVE-2021-30667 | Med | 0.35 | 5.4 | 0.00 | Sep 8, 2021 | A logic issue was addressed with improved validation. This issue is fixed in iOS 14.6 and iPadOS 14.6. An attacker in WiFi range may be able to force a client to use a less secure authentication mechanism. | ||
| CVE-2021-30720 | Med | 0.35 | 5.4 | 0.01 | Sep 8, 2021 | A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious website may be able to access restricted ports on arbitrary servers. | ||
| CVE-2021-1561 | Med | 0.35 | 5.4 | 0.01 | Aug 18, 2021 | A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authenticated, remote attacker to gain unauthorized access and modify the spam quarantine settings of another user. This… |
- risk 0.35cvss 6.5epss 0.01
The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification.
- risk 0.35cvss 5.3epss 0.01
Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information without logging in to the product.
- risk 0.35cvss 5.3epss 0.01
Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address, and daily energy usage.
- risk 0.35cvss 5.3epss 0.01
A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions. This vulnerability is due to exposed sensitive Security Assertion Markup…
- risk 0.35cvss 5.3epss 0.01
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not restrict unauthenticated access to certain pages of the web interface. This could allow an attacker to delete log files without authentication.
- risk 0.35cvss 5.3epss 0.11
ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).
- risk 0.35cvss 5.3epss 0.01
The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacker can send a crafted request that may allow for modification of the configuration settings.
- risk 0.35cvss 5.3epss 0.04
Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to deny access to the iDRAC webserver.
- risk 0.35cvss 5.3epss 0.01
Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information.
- risk 0.35cvss 5.3epss 0.01
glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /public_html/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied.
- risk 0.35cvss 5.4epss 0.01
A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authentication via a RADIUS login portal.
- risk 0.35cvss 5.3epss 0.01
Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken Authentication vulnerability in the…
- risk 0.35cvss 5.3epss 0.01
OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call.
- risk 0.35cvss 5.3epss 0.01
There is a Permission verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect the device performance.
- risk 0.35cvss 5.3epss 0.01
WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored and controlled by the WebAccess/NMS, as well as IP addresses and names of all the devices managed via WebAccess/NMS.
- risk 0.35cvss 5.3epss 0.02
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. By default, SIP requests of the type SUBSCRIBE are not authenticated in the affected versions of…
- risk 0.35cvss 5.4epss 0.01
An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler.
- risk 0.35cvss 5.4epss 0.00
A logic issue was addressed with improved validation. This issue is fixed in iOS 14.6 and iPadOS 14.6. An attacker in WiFi range may be able to force a client to use a less secure authentication mechanism.
- risk 0.35cvss 5.4epss 0.01
A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious website may be able to access restricted ports on arbitrary servers.
- risk 0.35cvss 5.4epss 0.01
A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authenticated, remote attacker to gain unauthorized access and modify the spam quarantine settings of another user. This…