cve.bz

CWE-287: Improper Authentication, page 44

Filter

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

What the weakness is: CWE-287 at MITRE

Ask an AI about CWE-287

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-287: Improper Authentication and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/287.html and https://cve.bz/cve/cwe/287?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.1CVE-2023-34998EPSS 1.2%

    An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary authentication. An attacker can sniff …

  2. 9.8CVE-2023-31242EPSS 3.5%

    An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series of network requests can lead to arbitrary authentication. An attacker can send a…

  3. 7.5CVE-2023-39981EPSS 0.8%

    A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1. This vulnerability arises from inadequate authentication measures, potentially leading to the disclosure of device information …

  4. 5.5CVE-2023-41751EPSS 0.1%

    Sensitive information disclosure due to improper token expiration validation. The following products are affected: Acronis Agent (Windows) before build 32047.

  5. 8.1CVE-2023-35785EPSS 2.4%

    Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus 4161 and below, Data Security Plus 6110 …

  6. 8.8CVE-2023-32202EPSS 0.6%

    Walchem Intuition 9 firmware versions prior to v4.21 are vulnerable to improper authentication. Login credentials are stored in a format that could allow an attacker to use them as-is to login and gain access to the device.

  7. 5.4CVE-2023-40282EPSS 0.3%

    Improper authentication vulnerability in Rakuten WiFi Pocket all versions allows a network-adjacent attacker to log in to the product's Management Screen. As a result, sensitive information may be obtained and/or the settings may be change…

  8. 8.8CVE-2023-38585EPSS 1.1%

    Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information pr…

  9. 7.5CVE-2023-25913EPSS 0.6%

    Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information.

  10. 9.8CVE-2023-4373EPSS 0.7%

    Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a user to initiate a connection without proper execution rights via the remote too…

  11. 8.8CVE-2023-4415ExploitEPSS 58%

    A vulnerability was found in Ruijie RG-EW1200G 07161417 r483. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/sys/login. The manipulation leads to improper authentication. The attack may…

  12. 7.5CVE-2023-39415EPSS 1.0%

    Improper authentication vulnerability in Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1.07 and earlier allow a remote unauthenticated attacker to…

  13. 8.8CVE-2023-33237EPSS 0.6%

    TN-5900 Series firmware version v3.3 and prior is vulnerable to improper-authentication vulnerability. This vulnerability arises from inadequate authentication measures implemented in the web API handler, allowing low-privileged APIs to ex…

  14. 9.8CVE-2023-39846EPSS 1.1%

    An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token.

  15. 3.9CVE-2023-32453EPSS 0.2%

    Dell BIOS contains an improper authentication vulnerability. A malicious user with physical access to the system may potentially exploit this vulnerability in order to modify a security-critical UEFI variable without knowledge of the BIOS …

  16. 9.8CVE-2023-35082KEVExploitEPSS >99.9%

    An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-350…

  17. 8.3CVE-2023-40020EPSS 0.5%

    PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctly verify whether the user was an administrator (High Level) or moderator (Low Le…

  18. 7.5CVE-2023-3263EPSS 0.7%

    The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of special characters when parsing credentials.Successful exploitation allows the malic…

  19. 7.5CVE-2023-39380EPSS 0.4%

    Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause audio devices to perform abnormally.

  20. 9.1CVE-2023-40260EPSS 0.6%

    EmpowerID before 7.205.0.1 allows an attacker to bypass an MFA (multi factor authentication) requirement if the first factor (username and password) is known, because the first factor is sufficient to change an account's email address, and…

  21. 9.8CVE-2023-40253EPSS 0.4%

    Improper Authentication vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Authentication Abuse.This issue affects Genian NAC V4.0: from V4.0.0 through V4.0.155; Gen…

  22. 6.8CVE-2023-39531EPSS 0.4%

    Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 23.7.2, an attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth…

  23. 4.3CVE-2023-4242EPSS 0.5%

    The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level pe…

  24. 7.1CVE-2023-21626EPSS 0.1%

    Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key.

  25. 5.3CVE-2023-36926EPSS 0.5%

    Due to missing authentication check in SAP Host Agent - version 7.22, an unauthenticated attacker can set an undocumented parameter to a particular compatibility value and in turn call read functions. This allows the attacker to gather som…

  26. 8.1CVE-2023-39349EPSS 1.1%

    Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens creat…

  27. 9.8CVE-2023-32090EPSS 0.6%

    Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials

  28. 5.0CVE-2023-0264EPSS 1.3%

    A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to imperson…

  29. 6.5CVE-2023-39112EPSS 0.7%

    ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.

  30. 6.5CVE-2023-38691EPSS 0.5%

    matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impers…

  31. 9.1CVE-2023-20214EPSS 0.9%

    A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to gain read permissions or limited write permissions to the configuration of an aff…

  32. 7.5CVE-2023-33363EPSS 0.6%

    An authentication bypass vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated users to access some functionality on BioStar 2 servers.

  33. 8.2CVE-2023-34196EPSS 0.4%

    In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates (attributes and p…

  34. 9.4CVE-2023-1935EPSS 0.7%

    ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the device and cause a denial-of-service condition.

  35. 6.1CVE-2023-3470EPSS 0.2%

    Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account.  The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or an…

  36. 8.8CVE-2023-33563EPSS 0.8%

    In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.

  37. 4.3CVE-2023-3622EPSS 0.8%

    Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to read arbitrary resource

  38. 8.8CVE-2023-38555EPSS 0.4%

    Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change, and/or reset configuration settings of the affected products. Affected product…

  39. 8.8CVE-2023-2626EPSS 0.1%

    There exists an authentication bypass vulnerability in OpenThread border router devices and implementations. This issue allows unauthenticated nodes to craft radio frames using “Key ID Mode 2”: a special mode using a static encryption key …

  40. 9.8CVE-2023-35078KEVExploitEPSS >99.9%

    An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

  41. 7.5CVE-2023-37918EPSS 1.4%

    Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate…

  42. 9.8CVE-2023-37471EPSS 1.3%

    Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of …

  43. 9.8CVE-2023-3638EPSS 0.7%

    In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.

  44. 7.5CVE-2023-27877EPSS 0.5%

    IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB server and collect sensitive information from the database. IBM X-Force ID: 2479…

  45. 8.8CVE-2022-34155EPSS 1.0%

    Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.

  46. 9.8CVE-2023-37266ExploitEPSS 6.8%

    CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addre…

  47. 8.2CVE-2023-3591EPSS 0.3%

    Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.

  48. 7.5CVE-2023-2959EPSS 0.6%

    Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users. This issue affects Oliva Expertise EKS: before 1.2.

  49. 5.3CVE-2023-35901EPSS 0.5%

    IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could allow invalid changes or values in some fields. IBM X-Force ID: 259380.

  50. 8.8CVE-2023-37268EPSS 0.5%

    Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second facto…