CWE-1390: Weak Authentication, page 3
Filter
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
What the weakness is: CWE-1390 at MITRE. OWASP Top 10: A07:2025 Authentication Failures
Ask an AI about CWE-1390
Show the prompt
Explain CWE-1390: Weak Authentication and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1390.html and https://cve.bz/cve/cwe/1390?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.8CVE-2024-8322EPSS 1.1%
Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted functionality.
- 7.2CVE-2024-38239EPSS 1.7%
Windows Kerberos Elevation of Privilege Vulnerability
- 9.8CVE-2024-38182EPSS 0.9%
Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network.
- 2.3CVE-2024-6580EPSS 0.1%
The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or certificate. To be exploitable, an application calling the SFTPServer component…
- 9.1CVE-2024-39848EPSS 0.4%
Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways. This is related to internet2.middleware.grouper.ws.security.WsGrouperLdapAuthentication and the use of the UyY29r password for the …
- 3.3CVE-2024-29038EPSS 0.4%
tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7.
- 9.1CVE-2024-34451EPSS 0.8%
Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reve…
- 4.2CVE-2024-5891EPSS 0.2%
A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having access to the organization from which the application was created. This issue is …
- 7.3CVE-2024-35248EPSS 1.0%
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
- 8.8CVE-2024-36787EPSS 0.6%
An issue in Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 allows attackers to bypass authentication and access the administrative interface via unspecified vectors.
- 8.8CVE-2024-29837EPSS 0.5%
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in.
- 9.8CVE-2023-49340EPSS 0.9%
An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to escalate privileges and bypass authentication via incorrect access control in the web management portal.
- 7.5CVE-2024-0822EPSS 0.7%
An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command.
- 8.2CVE-2023-4094EPSS 0.5%
ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate account and cause a denial of service. In addition, a resource has been identified t…
- 4.3CVE-2023-41900EPSS 0.9%
Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginServi…
- 7.5CVE-2022-45860EPSS 0.5%
A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated a…
- 6.5CVE-2023-24890EPSS 1.2%
Microsoft OneDrive for iOS Security Feature Bypass Vulnerability
- 9.8CVE-2022-43400EPSS 1.1%
A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 (All versions < V22.2a (80)). The mobile server component of affected applications improperly handles the log in for Active Directory accounts that are part of…