cve.bz

CWE-287: Improper Authentication, page 40

Filter

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

What the weakness is: CWE-287 at MITRE

Ask an AI about CWE-287

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-287: Improper Authentication and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/287.html and https://cve.bz/cve/cwe/287?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2023-42662EPSS 0.5%

    JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of…

  2. 7.5CVE-2023-48703EPSS 0.6%

    RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the `xmlsec1` command line tool is called internally to verify the signature of SAML a…

  3. 6.2CVE-2024-20301EPSS 0.3%

    A vulnerability in Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, physical attacker to bypass secondary authentication and access an affected Windows device. This vulnerability is due to a failure to i…

  4. 6.5CVE-2023-38367EPSS 0.4%

    IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2) allows CRUD Operations with a…

  5. 9.1CVE-2024-25128EPSS 0.9%

    Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, that could deceive the backend into using any requested Op…

  6. 7.5CVE-2023-38372EPSS 0.8%

    An unauthorized attacker who has obtained an IBM Watson IoT Platform 1.0 security authentication token can use it to impersonate an authorized platform user. IBM X-Force ID: 261201.

  7. 9.1CVE-2024-1735EPSS 0.8%

    A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentication. All users who rely on armeria-saml older than version 1.27.2 must upgrade to 1.27.2 or lat…

  8. 6.3CVE-2024-22395EPSS 0.4%

    Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a remote authenticated attacker to associate another user's MFA mobile application.

  9. 9.8CVE-2024-1817EPSS 0.8%

    A vulnerability has been found in Demososo DM Enterprise Website Building System up to 2022.8 and classified as critical. Affected by this vulnerability is the function dmlogin of the file indexDM_load.php of the component Cookie Handler. …

  10. 7.5CVE-2023-52161EPSS 1.1%

    The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete the EAPOL handshake by skippin…

  11. 6.5CVE-2023-52160EPSS 1.2%

    The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_d…

  12. 9.6CVE-2024-22245EPSS 1.3%

    Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor that could trick a target domain user with EAP installed in their web browser in…

  13. 7.5CVE-2022-41738EPSS 0.4%

    IBM Storage Scale Container Native Storage Access 5.1.2.1 -through 5.1.7.0 could allow an attacker to initiate connections to containers from external networks. IBM X-Force ID: 237812.

  14. 6.5CVE-2022-41737EPSS 0.1%

    IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.7.0 could allow a local attacker to initiate connections from a container outside the current namespace. IBM X-Force ID: 237811.

  15. 7.5CVE-2023-6451EPSS 0.5%

    Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication cookies and bypass the application's authentication mechanisms.

  16. 9.8CVE-2024-20738EPSS 1.1%

    Adobe FrameMaker Publishing Server versions 2022.1 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass authentication …

  17. 7.4CVE-2024-25618EPSS 0.5%

    Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML, OIDC) to attach to existing local users with the same e-mail address. This resu…

  18. 8.8CVE-2024-0568EPSS 0.3%

    CWE-287: Improper Authentication vulnerability exists that could cause unauthorized tampering of device configuration over NFC communication.

  19. 8.8CVE-2023-31189EPSS 0.2%

    Improper authentication in some Intel(R) Server Product OpenBMC firmware before version egs-1.09 may allow an authenticated user to enable escalation of privilege via local access.

  20. 9.8CVE-2024-21410KEVEPSS 13%

    Microsoft Exchange Server Elevation of Privilege Vulnerability

  21. 9.8CVE-2024-23813EPSS 0.6%

    A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potenti…

  22. 8.8CVE-2024-25313EPSS 0.8%

    Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/teacher_login.php.

  23. 8.1CVE-2023-51761EPSS 0.7%

    In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could bypass authentication and acquire admin capabilities.

  24. 6.5CVE-2024-25106EPSS 0.5%

    OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/{org_id}/users/{email_id}" endpoint. This vulner…

  25. 8.8CVE-2024-24830EPSS 0.7%

    OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/{org_id}/users" endpoint. This vulnerability allows any a…

  26. 9.8CVE-2024-24496ExploitEPSS 20%

    An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php components.

  27. 9.8CVE-2024-22394EPSS 0.7%

    An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow a remote attacker to bypass authentication.  This issue affects only firmware version SonicOS 7.1.…

  28. 5.3CVE-2024-23806EPSS 0.3%

    Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.

  29. 5.9CVE-2024-24771EPSS 0.6%

    Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials (username + password) compromise…

  30. 5.3CVE-2023-39196EPSS 0.8%

    Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without proper authentication. The attacker is not allowed to do any modifi…

  31. 9.8CVE-2024-24592EPSS 1.0%

    Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files.

  32. 6.5CVE-2024-20816EPSS 0.4%

    Improper authentication vulnerability in onCharacteristicWriteRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackers connect to victim&#39;s mobile hotspot without user awareness.

  33. 6.5CVE-2024-20815EPSS 0.4%

    Improper authentication vulnerability in onCharacteristicReadRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackers connect to victim&#39;s mobile hotspot without user awareness.

  34. 9.8CVE-2023-39303EPSS 0.5%

    An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed t…

  35. 5.3CVE-2023-50934EPSS 0.4%

    IBM PowerSC 1.3, 2.0, and 2.1 uses single-factor authentication which can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme. IBM X-Force ID: 275114.

  36. 9.8CVE-2024-1039EPSS 0.7%

    Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web management of the device.

  37. 5.5CVE-2023-47256EPSS 0.4%

    ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings

  38. 4.9CVE-2024-23637EPSS 0.5%

    OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repea…

  39. 8.8CVE-2024-23647EPSS 0.5%

    Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the code_challenge parameter to the authorization request and adds…

  40. 9.8CVE-2023-51982EPSS 0.7%

    CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP r…

  41. 5.3CVE-2024-1006EPSS 0.7%

    A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file application/index/common.php of the component Cookie Handler. The manipulation o…

  42. 6.5CVE-2024-23792EPSS 0.3%

    When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user. The attack requires a logged-in other user to know the UUID. While the legitimate user completes the comment, the malic…

  43. 9.8CVE-2024-0988EPSS 1.0%

    A vulnerability classified as critical was found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this vulnerability is the function checklogin of the file /application/index/common.php. The manipulation of the argument App_User…

  44. 7.5CVE-2024-23629EPSS 1.1%

    An authentication bypass vulnerability exists in the web component of the Motorola MR2600. An attacker can exploit this vulnerability to access protected URLs and retrieve sensitive information.

  45. 7.5CVE-2024-0822EPSS 0.7%

    An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command.

  46. 4.3CVE-2024-0879EPSS 0.4%

    Authentication bypass in vector-admin allows a user to register to a vector-admin server while “domain restriction” is active, even when not owning an authorized email address.

  47. 7.5CVE-2023-50275EPSS 1.0%

    HPE OneView may allow clusterService Authentication Bypass resulting in denial of service.

  48. 6.2CVE-2024-23219EPSS 0.3%

    The issue was addressed with improved authentication. This issue is fixed in iOS 17.3 and iPadOS 17.3. Stolen Device Protection may be unexpectedly disabled.

  49. 5.5CVE-2023-42935EPSS 0.2%

    An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.6.4. A local attacker may be able to view the previous logged in user’s desktop from the fast user switching screen.

  50. 7.5CVE-2023-52111EPSS 0.3%

    Authorization vulnerability in the BootLoader module. Successful exploitation of this vulnerability may affect service integrity.