cve.bz

CWE-287: Improper Authentication, page 45

Filter

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

What the weakness is: CWE-287 at MITRE

Ask an AI about CWE-287

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-287: Improper Authentication and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/287.html and https://cve.bz/cve/cwe/287?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2023-36466EPSS 0.4%

    Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The i…

  2. 5.3CVE-2023-2975EPSS 0.6%

    Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to aut…

  3. 6.8CVE-2023-30560EPSS 0.3%

    The configuration from the PCU can be modified without authentication using physical connection to the PCU.

  4. 5.7CVE-2023-30559EPSS 0.2%

    The firmware update package for the wireless card is not properly signed and can be modified.

  5. 9.8CVE-2023-34137EPSS 1.0%

    SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerability. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-…

  6. 9.8CVE-2023-34124ExploitEPSS 50%

    The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

  7. 9.8CVE-2023-33274EPSS 1.1%

    The authentication mechanism in PowerShield SNMP Web Pro 1.1 contains a vulnerability that allows unauthenticated users to directly access Common Gateway Interface (CGI) scripts without proper identification or authorization. This vulnerab…

  8. 6.5CVE-2023-31007EPSS 1.0%

    Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is co…

  9. 9.8CVE-2023-3127EPSS 0.6%

    An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.

  10. 8.1CVE-2023-31190EPSS 0.4%

    DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an Improper Authentication vulnerability during the firmware update procedure. Specifically, the firmware update procedure ignores and does not check the validit…

  11. 5.5CVE-2023-30675EPSS 0.2%

    Improper authentication in Samsung Pass prior to version 4.2.03.1 allows local attacker to access stored account information when Samsung Wallet is not installed.

  12. 7.5CVE-2023-35940EPSS 0.7%

    GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to be able to access dashboards data. Version 10.0.8 contain…

  13. 6.5CVE-2023-32620EPSS 0.3%

    Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireless network.

  14. 9.8CVE-2023-33190EPSS 0.7%

    Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control (RBAC) permissions resulted in an attacker being a…

  15. 9.8CVE-2023-32222EPSS 1.9%

    D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method.

  16. 6.6CVE-2023-20199EPSS 0.3%

    A vulnerability in Cisco Duo Two-Factor Authentication for macOS could allow an authenticated, physical attacker to bypass secondary authentication and access an affected macOS device. This vulnerability is due to the incorrect handling of…

  17. 9.8CVE-2023-30945EPSS 0.7%

    Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A m…

  18. 8.8CVE-2023-32524EPSS 2.6%

    Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentially chain with other vulnerabilities. Please note: an attacker must first obt…

  19. 8.8CVE-2023-32523EPSS 2.6%

    Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentially chain with other vulnerabilities. Please note: an attacker must first obt…

  20. 6.5CVE-2023-35154EPSS 0.4%

    Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can register and activate their account without having to click on the link included in the email, allow…

  21. 7.8CVE-2023-28073EPSS 0.2%

    Dell BIOS contains an improper authentication vulnerability. A locally authenticated malicious user may potentially exploit this vulnerability by bypassing certain authentication mechanisms in order to elevate privileges on the system.

  22. 9.8CVE-2023-3326EPSS 1.1%

    pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is…

  23. 9.8CVE-2023-34340EPSS 1.4%

    Improper Authentication vulnerability in Apache Software Foundation Apache Accumulo. This issue affects Apache Accumulo: 2.1.0. Accumulo 2.1.0 contains a defect in the user authentication process that may succeed when invalid credentials …

  24. 9.8CVE-2023-3337EPSS 0.7%

    A vulnerability was found in PuneethReddyHC Online Shopping System Advanced 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/reg.php of the component Admin Registration. T…

  25. 7.5CVE-2022-48496EPSS 0.3%

    Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized.

  26. 7.5CVE-2022-48494EPSS 0.3%

    Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized.

  27. 7.5CVE-2023-30223EPSS 1.1%

    A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to send crafted TCP packets containing requests to perform arbitrary actions.

  28. 6.5CVE-2023-34367EPSS 1.2%

    Windows 7 is vulnerable to a full blind TCP/IP hijacking attack. The vulnerability exists in Windows 7 (any Windows until Windows 8) and in any implementation of TCP/IP, which is vulnerable to the Idle scan attack (including many IoT devic…

  29. 5.0CVE-2023-2638EPSS 0.2%

    Rockwell Automation's FactoryTalk System Services does not verify that a backup configuration archive is password protected.   Improper authorization in FTSSBackupRestore.exe may lead to the loading of malicious configuration archives.  …

  30. 3.9CVE-2023-20867KEVEPSS 14%

    A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

  31. 9.8CVE-2023-30762EPSS 0.7%

    Improper authentication vulnerability exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed on the product or the device settings may be altered. Affected products and versi…

  32. 9.8CVE-2023-29129EPSS 0.9%

    A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 …

  33. 9.8CVE-2023-32220EPSS 0.6%

    Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method.

  34. 6.5CVE-2023-34246EPSS 0.7%

    Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inh…

  35. 9.8CVE-2023-33553EPSS 1.0%

    An issue in Planet Technologies WDRT-1800AX v1.01-CP21 allows attackers to bypass authentication and escalate privileges to root via manipulation of the LoginStatus cookie.

  36. 5.4CVE-2023-32682EPSS 0.8%

    Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are…

  37. 7.5CVE-2022-40536EPSS 0.4%

    Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network.

  38. 7.5CVE-2022-40521EPSS 0.4%

    Transient DOS due to improper authorization in Modem

  39. 9.1CVE-2023-3065EPSS 0.8%

    Improper Authentication vulnerability in Mobatime mobile application AMXGT100 allows Authentication Bypass.This issue affects Mobatime mobile application AMXGT100 through 1.3.20.

  40. 9.8CVE-2023-3069EPSS 0.6%

    Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.

  41. 9.8CVE-2023-3028EPSS 0.2%

    Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected to…

  42. 6.5CVE-2023-2283EPSS 1.1%

    A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or…

  43. 5.3CVE-2023-0117EPSS 0.4%

    The online authentication provided by the hwKitAssistant lacks strict identity verification of applications. Successful exploitation of this vulnerability may affect availability of features,such as MeeTime.

  44. 9.8CVE-2023-27388EPSS 1.3%

    Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unauthenticated attacker to login to the product as a registered user. Affected products and versions are as follows: T&D Cor…

  45. 8.8CVE-2023-25946EPSS 0.4%

    Authentication bypass vulnerability in Qrio Lock (Q-SL2) firmware version 2.0.9 and earlier allows a network-adjacent attacker to analyze the product's communication data and conduct an arbitrary operation under certain conditions.

  46. 9.8CVE-2023-2586EPSS 1.0%

    Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously unregistered devices through the RMS platform. If the user has not disabled the "RMS management feature" enabled by defau…

  47. 9.8CVE-2023-32347EPSS 0.7%

    Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the user perspective for device claiming and from the device perspective for authentication. If an attacker …

  48. 7.5CVE-2023-2024EPSS 1.1%

    Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances.

  49. 8.8CVE-2023-0863EPSS 0.3%

    Improper Authentication vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB, ABB Terra…

  50. 8.1CVE-2023-2706EPSS 1.7%

    The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these cod…