cve.bz

CWE-287: Improper Authentication, page 33

Filter

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

What the weakness is: CWE-287 at MITRE

Ask an AI about CWE-287

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-287: Improper Authentication and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/287.html and https://cve.bz/cve/cwe/287?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2025-24949EPSS 0.4%

    In JotUrl 2.0, is possible to bypass security requirements during the password change process.

  2. 5.3CVE-2025-2572EPSS 0.3%

    In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of WhatsUp.dbo.WrlsMacAddressGroup.

  3. 5.3CVE-2025-22232EPSS 0.3%

    Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: * You have Spring Vault on the classpath…

  4. 9.3CVE-2025-22375EPSS 0.5%

    An authentication bypass vulnerability was found in Videx's CyberAudit-Web. Through the exploitation of a logic flaw, an attacker could create a valid session without any credentials. This vulnerability has been patched in versions later t…

  5. 8.2CVE-2025-30287EPSS 2.9%

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. A low privileged attacker with local access…

  6. 9.1CVE-2025-30282EPSS 1.8%

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage t…

  7. 7.5CVE-2025-25227EPSS 0.4%

    Insufficient state checks lead to a vector that allows to bypass 2FA checks.

  8. 6.9CVE-2025-3268EPSS 0.8%

    A vulnerability has been found in qinguoyi TinyWebServer up to 1.0 and classified as critical. This vulnerability affects unknown code of the file http/http_conn.cpp. The manipulation of the argument m_url_real leads to improper authentica…

  9. 6.6CVE-2025-3062EPSS 0.5%

    Vulnerability in Drupal Drupal Admin LTE theme.This issue affects Drupal Admin LTE theme: *.*.

  10. 6.6CVE-2025-3061EPSS 0.5%

    Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*.

  11. 6.4CVE-2025-30432EPSS 0.8%

    A logic issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. A malicious app may be able to at…

  12. 9.8CVE-2025-30430EPSS 1.2%

    This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. Password autofill may fill in passwords after failing authentication.

  13. 9.0CVE-2025-31122EPSS 0.4%

    scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by changing the username in the username field.

  14. 9.8CVE-2024-13804EPSS 0.5%

    Unauthenticated RCE in HPE Insight Cluster Management Utility

  15. 6.9CVE-2025-2859EPSS 0.4%

    An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user.

  16. 9.3CVE-2025-30361EPSS 0.6%

    WeGIA is a Web manager for charitable institutions. A security vulnerability was identified in versions prior to 3.2.6, where it is possible to change a user's password without verifying the old password. This issue exists in the control.p…

  17. 8.0CVE-2025-30214EPSS 0.4%

    Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. …

  18. 6.9CVE-2025-30168EPSS 0.4%

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication handling of Parse Server allows the authentication credentials of some specific …

  19. 7.7CVE-2024-57490EPSS 0.4%

    Guangzhou Hongfan Technology Co., LTD. iOffice20 has any user login vulnerability. An attacker can log in to any system account including the system administrator through a logical flaw.

  20. 7.4CVE-2025-22228EPSS 0.6%

    BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

  21. 5.5CVE-2025-26475EPSS 0.2%

    Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, Enables Live-Restore setting which enhances security by keeping containers running during daemon restarts, reducing attack exposure, preventing accidental misconfigura…

  22. 7.5CVE-2025-30116EPSS 0.5%

    An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Remotely Dumping of Video Footage and the Live Video Stream can occur. It allows remote attackers to access and download recorded video footage from the SD card via…

  23. 9.1CVE-2025-30114EPSS 0.5%

    An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Bypassing of Device Pairing can occur. The pairing mechanism relies solely on the connecting device's MAC address. By obtaining the MAC address through network scan…

  24. 6.9CVE-2025-2388EPSS 0.5%

    A vulnerability was found in Keytop 路内停车收费系统 2.7.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /saas/commonApi/park/getParks of the component API. The manipulation leads to impr…

  25. 6.9CVE-2025-2344EPSS 0.5%

    A vulnerability, which was classified as critical, has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this issue is some unknown functionality of the component API Endpoint. The manipulation leads to missing au…

  26. 6.9CVE-2025-2339EPSS 0.9%

    A vulnerability was found in otale Tale Blog 2.0.5. It has been classified as problematic. This affects an unknown part of the file /%61dmin/api/logs. The manipulation leads to improper authentication. It is possible to initiate the attack…

  27. 8.5CVE-2025-2230EPSS 0.2%

    A flaw exists in the Windows login flow where an AuthContext token can be exploited for replay attacks and authentication bypass.

  28. 7.8CVE-2025-29773EPSS 0.3%

    Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accounts with the same email address as an existing account. This creates potential i…

  29. 7.7CVE-2025-27138EPSS 0.6%

    DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which may cause the risk of unauthorized access.…

  30. 7.0CVE-2025-0813EPSS 0.3%

    CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permission rights has physical access to the EPAS-UI computer and is able to reboot the workstation and inter…

  31. 7.2CVE-2025-27403EPSS 0.5%

    Ratify is a verification engine as a binary executable and on Kubernetes which enables verification of artifact security metadata and admits for deployment only those that comply with policies the user creates. In a Kubernetes environment,…

  32. 9.5CVE-2024-56336EPSS 0.6%

    A vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FS number is 02). The affected device contains an unlocked bootloader. This security oversight enable…

  33. 9.8CVE-2024-11087EPSS 0.5%

    The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on …

  34. 9.8CVE-2025-1475EPSS 0.6%

    The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verification on the 'user_phone' parameter when logging in. This makes it possible for un…

  35. 5.1CVE-2025-25452EPSS 0.3%

    An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the "/user" endpoint

  36. 5.1CVE-2025-25451EPSS 0.2%

    An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a physically proximate attacker to escalate privileges via the "2fa_authorized" Local Storage key

  37. 5.1CVE-2025-25450EPSS 0.3%

    An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the deactivation of the activated second factor to the /session endpoint

  38. 9.8CVE-2025-27672EPSS 0.6%

    Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows OAUTH Security Bypass OVE-20230524-0016.

  39. 9.8CVE-2025-27641EPSS 0.9%

    Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.951 Application 20.0.2368 allows Unauthenticated APIs for Single-Sign On V-2024-009.

  40. 4.3CVE-2025-27425EPSS 0.2%

    Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first. This vulnerability was fixed in Firefox for iOS 136.

  41. 1.0CVE-2025-1880EPSS 0.3%

    A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been classified as problematic. Affected is an unknown function of the component Device Pairing. The manipulation leads to authentication bypass by primary weakness. I…

  42. 7.5CVE-2025-27422EPSS 0.4%

    FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges. This is possible at any time without any authorization. The request must follow …

  43. 5.3CVE-2024-38426EPSS 0.3%

    While processing the authentication message in UE, improper authentication may lead to information disclosure.

  44. 8.1CVE-2025-1723EPSS 1.5%

    Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug.

  45. 9.6CVE-2025-23116EPSS 0.5%

    An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor with access to UniFi Protect Cameras adjacent network to take control of UniFi Protect Cameras.

  46. 5.9CVE-2025-27416EPSS 0.5%

    Scratch-Coding-Hut.github.io is the website for Coding Hut. The website as of 28 February 2025 contained a sign in with scratch username and password form. Any user who used the sign in page would be susceptible to any other user signing i…

  47. 4.6CVE-2025-27414EPSS 0.6%

    MinIO is a high performance object storage. Starting in RELEASE.2024-06-06T09-36-42Z and prior to RELEASE.2025-02-28T09-55-16Z, a bug in evaluating the trust of the SSH key used in an SFTP connection to MinIO allows authentication bypass …

  48. 8.8CVE-2025-26326EPSS 1.7%

    A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The pro…

  49. 6.9CVE-2025-27112ExploitEPSS 1.0%

    Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify…

  50. 5.3CVE-2024-5174EPSS 0.4%

    A flaw in Gliffy results in broken authentication through the reset functionality of the application.