CWE-287
Improper Authentication
Description
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-114 · CAPEC-115 · CAPEC-151 · CAPEC-194 · CAPEC-22 · CAPEC-57 · CAPEC-593 · CAPEC-633 · CAPEC-650 · CAPEC-94
CVEs mapped to this weakness (4,803)
page 18 of 241| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-29155 | Cri | 0.64 | 9.8 | 0.01 | Nov 20, 2023 | Versions of INEA ME RTU firmware 3.36b and prior do not require authentication to the "root" account on the host system of the device. This could allow an attacker to obtain admin-level access to the host system. | ||
| CVE-2023-44324 | Cri | 0.64 | 9.8 | 0.01 | Nov 17, 2023 | Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An unauthenticated attacker can abuse this vulnerability to access the API and leak default admin's password.… | ||
| CVE-2023-41442 | Cri | 0.64 | 9.8 | 0.01 | Nov 15, 2023 | An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via a crafted request to the MQTT component. | ||
| CVE-2023-4612 | Cri | 0.64 | 9.8 | 0.01 | Nov 9, 2023 | Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date… | ||
| CVE-2023-30967 | Cri | 0.64 | 9.8 | 0.01 | Oct 26, 2023 | Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files on the file system. | ||
| CVE-2023-24479 | Cri | 0.64 | 9.8 | 0.02 | Oct 11, 2023 | An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability. | ||
| CVE-2023-20252 | Cri | 0.64 | 9.8 | 0.01 | Sep 27, 2023 | A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vulnerability is due to improper… | ||
| CVE-2023-4669 | Cri | 0.64 | 9.8 | 0.01 | Sep 14, 2023 | Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass. This issue affects SYSGuard 3001: before 3.2.20.0. | ||
| CVE-2023-4501 | Cri | 0.64 | 9.8 | 0.01 | Sep 12, 2023 | User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0… | ||
| CVE-2023-39069 | Cri | 0.64 | 9.8 | 0.01 | Sep 11, 2023 | An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism. | ||
| CVE-2021-27715 | Cri | 0.64 | 9.8 | 0.01 | Sep 8, 2023 | An issue was discovered in MoFi Network MOFI4500-4GXeLTE-V2 3.5.6-xnet-5052 allows attackers to bypass the authentication and execute arbitrary code via crafted HTTP request. | ||
| CVE-2023-4373 | Cri | 0.64 | 9.8 | 0.01 | Aug 21, 2023 | Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature. | ||
| CVE-2023-39846 | Cri | 0.64 | 9.8 | 0.01 | Aug 16, 2023 | An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token. | ||
| CVE-2023-32090 | Cri | 0.64 | 9.8 | 0.01 | Aug 7, 2023 | Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials | ||
| CVE-2023-3638 | Cri | 0.64 | 9.8 | 0.01 | Jul 19, 2023 | In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application. | ||
| CVE-2023-34137 | Cri | 0.64 | 9.8 | 0.01 | Jul 13, 2023 | SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerability. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions. | ||
| CVE-2023-33274 | Cri | 0.64 | 9.8 | 0.01 | Jul 12, 2023 | The authentication mechanism in PowerShield SNMP Web Pro 1.1 contains a vulnerability that allows unauthenticated users to directly access Common Gateway Interface (CGI) scripts without proper identification or authorization. This vulnerability arises from a lack of proper… | ||
| CVE-2023-32222 | Cri | 0.64 | 9.8 | 0.02 | Jun 28, 2023 | D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method. | ||
| CVE-2023-30945 | Cri | 0.64 | 9.8 | 0.01 | Jun 26, 2023 | Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker could read sensitive… | ||
| CVE-2023-3326 | Cri | 0.64 | 9.8 | 0.01 | Jun 22, 2023 | pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5… |
- risk 0.64cvss 9.8epss 0.01
Versions of INEA ME RTU firmware 3.36b and prior do not require authentication to the "root" account on the host system of the device. This could allow an attacker to obtain admin-level access to the host system.
- risk 0.64cvss 9.8epss 0.01
Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An unauthenticated attacker can abuse this vulnerability to access the API and leak default admin's password.…
- risk 0.64cvss 9.8epss 0.01
An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via a crafted request to the MQTT component.
- risk 0.64cvss 9.8epss 0.01
Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date…
- risk 0.64cvss 9.8epss 0.01
Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files on the file system.
- risk 0.64cvss 9.8epss 0.02
An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability.
- risk 0.64cvss 9.8epss 0.01
A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vulnerability is due to improper…
- risk 0.64cvss 9.8epss 0.01
Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass. This issue affects SYSGuard 3001: before 3.2.20.0.
- risk 0.64cvss 9.8epss 0.01
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0…
- risk 0.64cvss 9.8epss 0.01
An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism.
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in MoFi Network MOFI4500-4GXeLTE-V2 3.5.6-xnet-5052 allows attackers to bypass the authentication and execute arbitrary code via crafted HTTP request.
- risk 0.64cvss 9.8epss 0.01
Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature.
- risk 0.64cvss 9.8epss 0.01
An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token.
- risk 0.64cvss 9.8epss 0.01
Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials
- risk 0.64cvss 9.8epss 0.01
In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.
- risk 0.64cvss 9.8epss 0.01
SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerability. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- risk 0.64cvss 9.8epss 0.01
The authentication mechanism in PowerShield SNMP Web Pro 1.1 contains a vulnerability that allows unauthenticated users to directly access Common Gateway Interface (CGI) scripts without proper identification or authorization. This vulnerability arises from a lack of proper…
- risk 0.64cvss 9.8epss 0.02
D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method.
- risk 0.64cvss 9.8epss 0.01
Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker could read sensitive…
- risk 0.64cvss 9.8epss 0.01
pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5…