cve.bz

CWE-287: Improper Authentication, page 35

Filter

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

What the weakness is: CWE-287 at MITRE

Ask an AI about CWE-287

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-287: Improper Authentication and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/287.html and https://cve.bz/cve/cwe/287?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.3CVE-2024-50339EPSS 19%

    GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a …

  2. 7.8CVE-2024-49076EPSS 1.2%

    Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

  3. 8.1CVE-2024-45404EPSS 0.6%

    OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does not exist, an attacker with valid credentials or a malicious user who commits internal fraud can bre…

  4. 7.5CVE-2024-47761EPSS 0.5%

    GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifications contents can take control of an account with higher privileges. Version …

  5. 6.3CVE-2024-10511EPSS 1.0%

    CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local network repeatedly requests the /accessdenied URL.

  6. 8.8CVE-2024-0130EPSS 0.3%

    NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of th…

  7. 5.3CVE-2024-48859EPSS 0.6%

    An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the …

  8. 8.1CVE-2024-11293EPSS 0.5%

    The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login plugin for WordPress is vulnerable to authentication bypass in all versions up t…

  9. 8.1CVE-2024-45106EPSS 0.6%

    Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: * ozone.s3g.secret.http.enab…

  10. 9.2CVE-2024-53990EPSS 0.7%

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore (aka cookie jar) wil…

  11. 7.8CVE-2018-11952EPSS 0.1%

    An image with a version lower than the fuse version may potentially be booted lead to improper authentication.

  12. 7.8CVE-2016-10394EPSS 0.10%

    Initial xbl_sec revision does not have all the debug policy features and critical checks.

  13. 5.4CVE-2024-11671EPSS 0.5%

    Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user to bypass the MFA validation via data source switching.

  14. 6.7CVE-2022-33862EPSS 0.2%

    IPP software prior to v1.71 is vulnerable to default credential vulnerability. This could lead attackers to identify and access vulnerable systems.

  15. 9.2CVE-2024-45369EPSS 0.6%

    The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource.

  16. 7.5CVE-2024-6248EPSS 1.0%

    Wyze Cam v3 Cloud Infrastructure Improper Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authenticatio…

  17. 7.5CVE-2024-11494EPSS 0.7%Unsupported when assigned

    The improper authentication vulnerability in the Zyxel P-6101C ADSL modem firmware version P-6101CSA6AP_20140331 could allow an unauthenticated attacker to read some device information via a crafted HTTP HEAD method.

  18. 9.8CVE-2024-47533ExploitEPSS 4.0%

    Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()…

  19. 5.4CVE-2024-52518EPSS 0.5%

    Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the passwor…

  20. 5.3CVE-2024-11209EPSS 0.6%

    A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA. The manipulation leads to improper authentication. It is possible to initiate th…

  21. 7.5CVE-2024-51996EPSS 0.6%

    Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username atta…

  22. 8.8CVE-2024-49039KEVEPSS 14%

    Windows Task Scheduler Elevation of Privilege Vulnerability

  23. 8.1CVE-2024-51997EPSS 0.3%

    Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART (**Attestation Results Token**) token, generated by AS, could be manipulated by MITM attacker, but the verifier (CoCo Verific…

  24. 7.4CVE-2024-10963EPSS 0.8%

    A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access.…

  25. 3.1CVE-2024-50341EPSS 0.3%

    symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login…

  26. 8.1CVE-2024-9946EPSS 0.6%

    The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.13.68. This is due to insufficient verification on the user be…

  27. 8.1CVE-2024-10020EPSS 0.5%

    The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. This is due to insufficient verification on the user being returned by the social login token. Thi…

  28. 8.8CVE-2023-29117EPSS 0.3%

    Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system.

  29. 8.1CVE-2024-10114EPSS 0.5%

    The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.7.7. This is due to insufficient verification on the user being returned by the social login token. This mak…

  30. 8.1CVE-2024-10097EPSS 0.7%

    The Loginizer Security and Loginizer plugins for WordPress are vulnerable to authentication bypass in all versions up to, and including, 1.9.2. This is due to insufficient verification on the user being returned by the social login token. …

  31. 6.9CVE-2024-10620EPSS 0.5%

    A vulnerability was found in knightliao Disconf 2.6.36. It has been classified as critical. This affects an unknown part of the file /api/config/list of the component Configuration Center. The manipulation leads to improper authentication.…

  32. 6.5CVE-2024-10474EPSS 0.3%

    Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL safety checks This vulnerability affects Focus for iOS < 132.

  33. 3.1CVE-2024-49755EPSS 0.3%

    Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use …

  34. 9.8CVE-2024-50478EPSS 1.1%

    Authentication Bypass by Primary Weakness vulnerability in Swoop 1-Click Login: Passwordless Authentication allows Authentication Bypass.This issue affects 1-Click Login: Passwordless Authentication: 1.4.5.

  35. 4.9CVE-2024-49757ExploitEPSS 2.5%

    The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disablin…

  36. 7.1CVE-2024-49376EPSS 0.5%

    Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoreticall…

  37. 7.5CVE-2024-7763EPSS 0.6%

    In WhatsUp Gold versions released before 2024.0.0,  an Authentication Bypass issue exists which allows an attacker to obtain encrypted user credentials.

  38. 8.1CVE-2024-10327EPSS 0.6%

    A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user’s selection…

  39. 9.8CVE-2024-9947EPSS 0.5%

    The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due to insufficient verification on the user being returned by the social login token. This makes it pos…

  40. 7.2CVE-2024-9927EPSS 0.5%

    The WooCommerce Order Proposal plugin for WordPress is vulnerable to privilege escalation via order proposal in all versions up to and including 2.0.5. This is due to the improper implementation of allow_payment_without_login function. Thi…

  41. 6.9CVE-2024-10173EPSS 0.7%

    A vulnerability has been found in didi DDMQ 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Console Module. The manipulation with the input /;login leads to improper authenticatio…

  42. 5.3CVE-2024-9683EPSS 0.3%

    A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided. This flaw affects the authentication mechanism, reducing the overall security of password enforcement.  While the…

  43. 8.7CVE-2023-22650EPSS 0.6%

    A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher wil…

  44. 9.8CVE-2024-45216ExploitEPSS 93%

    Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any…

  45. 9.8CVE-2020-36832EPSS 0.7%

    The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and including, 7.3 to 8.6. This makes it possible for unauthenticated attackers to login as any user, including the site administr…

  46. 8.8CVE-2024-38139EPSS 0.8%

    Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network.

  47. 8.7CVE-2024-47080EPSS 0.7%

    matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method `MatrixClient.sendSharedHistoryKeys` is vulnerable to interception by malicious homeservers. …

  48. 8.8CVE-2024-45148EPSS 0.7%

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerabilit…

  49. 9.8CVE-2024-45115EPSS 1.2%

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthoriz…

  50. 9.0CVE-2024-38124EPSS 1.2%

    Windows Netlogon Elevation of Privilege Vulnerability