cve.bz

CWE-287: Improper Authentication, page 46

Filter

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

What the weakness is: CWE-287 at MITRE

Ask an AI about CWE-287

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-287: Improper Authentication and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/287.html and https://cve.bz/cve/cwe/287?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2023-2499EPSS 1.3%

    The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verification on the user being supplied during a Google social login through the plugi…

  2. 9.8CVE-2023-23450EPSS 0.7%

    Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to use a password hash instead o…

  3. 6.5CVE-2023-32081EPSS 0.5%

    Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4.4.2, a Vert.x STOMP server processes client STOMP frames without checking that t…

  4. 9.8CVE-2023-27823ExploitEPSS 54%

    An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.

  5. 9.8CVE-2023-32243ExploitEPSS 76%

    Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.

  6. 8.1CVE-2023-29032EPSS 1.1%

    An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0

  7. 6.5CVE-2023-28325EPSS 0.4%

    An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target roo…

  8. 5.3CVE-2023-0858EPSS 0.6%

    Improper Authentication of RemoteUI of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger unauthorized access to the product. *:Satera LBP660C Series/LBP620C Ser…

  9. 8.8CVE-2023-31152EPSS 0.4%

    An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface allows Authentication Bypass. See SEL Service Bulletin dated 202…

  10. 7.5CVE-2022-41985EPSS 1.5%

    An authentication bypass vulnerability exists in the Authentication functionality of Weston Embedded uC-FTPs v 1.98.00. A specially crafted set of network packets can lead to authentication bypass and denial of service. An attacker can sen…

  11. 8.8CVE-2022-44610EPSS 0.6%

    Improper authentication in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via network access.

  12. 5.3CVE-2023-27919EPSS 0.7%

    Authentication bypass vulnerability in NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) all versions allows a remote unauthenticated attacker to alter the information stored in the system.

  13. 5.9CVE-2023-28125EPSS 2.3%

    An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to the server by registering to receive messages from the server and perform an authentication bypass.

  14. 8.8CVE-2023-31127EPSS 0.9%

    libspdm is a sample implementation that follows the DMTF SPDM specifications. A vulnerability has been identified in SPDM session establishment in libspdm prior to version 2.3.1. If a device supports both DHE session and PSK session with m…

  15. 9.1CVE-2023-31123EPSS 0.6%

    `effectindex/tripreporter` is a community-powered, universal platform for submitting and analyzing trip reports. Prior to commit bd80ba833b9023d39ca22e29874296c8729dd53b, any user with an account on an instance of `effectindex/tripreporter…

  16. 6.5CVE-2023-28182EPSS 0.7%

    The issue was addressed with improved authentication. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A user in a privileged network position m…

  17. 9.8CVE-2023-30328EPSS 1.1%

    An issue in the helper tool of Mailbutler GmbH Shimo VPN Client for macOS v5.0.4 allows attackers to bypass authentication via PID re-use.

  18. 3.3CVE-2023-21487EPSS 0.1%

    Improper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows local attackers to change a call setting.

  19. 7.8CVE-2023-21484EPSS 0.1%

    Improper access control vulnerability in AppLock prior to SMR May-2023 Release 1 allows local attackers without proper permission to execute a privileged operation.

  20. 7.5CVE-2022-45860EPSS 0.5%

    A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated a…

  21. 7.5CVE-2022-30995ExploitEPSS 3.3%

    Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545.

  22. 9.8CVE-2023-30869ExploitEPSS 3.1%

    Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.

  23. 9.8CVE-2022-35898EPSS 0.6%

    OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation. This allows any authenticated user to change the password of any other user, including the Administrator account.

  24. 7.5CVE-2023-30063EPSS 1.1%

    D-Link DIR-890L FW1.10 A1 is vulnerable to Authentication bypass.

  25. 7.5CVE-2023-30061EPSS 1.1%

    D-Link DIR-879 v105A1 is vulnerable to Authentication Bypass via phpcgi.

  26. 8.8CVE-2023-1477EPSS 0.6%

    Improper Authentication vulnerability in HYPR Keycloak Authenticator Extension allows Authentication Abuse.This issue affects HYPR Keycloak Authenticator Extension: before 7.10.2, before 8.0.3.

  27. 3.3CVE-2023-28473EPSS 0.8%

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section.

  28. 9.8CVE-2023-1778EPSS 1.1%

    This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default credentials which allows remote attacker to login as superuser by using default username/password via web…

  29. 8.1CVE-2023-2297EPSS 1.0%

    The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, w…

  30. 9.8CVE-2023-30845EPSS 0.7%

    ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 contains an authentication bypass vulnerability. API clients can craft a malicious `X-HTTP-Method-Override`…

  31. 7.5CVE-2022-45456EPSS 0.3%

    Denial of service due to unauthenticated API endpoint. The following products are affected: Acronis Agent (Windows, macOS, Linux) before build 30161.

  32. 6.5CVE-2022-40723EPSS 0.5%

    The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.

  33. 9.8CVE-2023-25131EPSS 1.0%

    Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, P…

  34. 7.8CVE-2023-0209EPSS 0.2%

    NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary code execution, denial of service, escalation of privileges assisted by a firmwa…

  35. 7.5CVE-2023-27351KEVExploitEPSS 78%

    This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRe…

  36. 4.3CVE-2023-25601EPSS 1.1%

    On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For u…

  37. 7.5CVE-2023-22893ExploitEPSS 4.1%

    Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algori…

  38. 8.8CVE-2023-25556EPSS 0.4%

    A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX installation.

  39. 9.8CVE-2021-40507EPSS 0.7%

    An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not being updated correctly for the subtract instruction, which results in an incorrect value in the ov…

  40. 9.8CVE-2021-40506EPSS 0.7%

    An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not being updated for the msb and mac instructions, which results in an incorrect value in the overflow…

  41. 7.1CVE-2023-28973EPSS 0.1%

    An Improper Authorization vulnerability in the 'sysmanctl' shell command of Juniper Networks Junos OS Evolved allows a local, authenticated attacker to execute administrative commands that could impact the integrity of the system or system…

  42. 5.3CVE-2023-28963EPSS 0.5%

    An Improper Authentication vulnerability in cert-mgmt.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to read arbitrary files from temporary folders on the device. This issue …

  43. 9.8CVE-2023-28962EPSS 0.6%

    An Improper Authentication vulnerability in upload-file.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to upload arbitrary files to temporary folders on the device. This issu…

  44. 9.8CVE-2023-24831EPSS 1.2%

    Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3. Attackers could login without authorization. This is fixed in 0.13.4.

  45. 6.5CVE-2022-48314EPSS 0.2%

    The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect confidentiality.

  46. 9.8CVE-2023-2027EPSS 1.0%

    The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is due to insufficient verification on the user being supplied during a Facebook login through the plugi…

  47. 5.9CVE-2023-25597EPSS 0.7%

    A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a crafted request - including the exact path and filename - due to improper authentic…

  48. 9.8CVE-2023-1833EPSS 0.8%

    Authentication Bypass by Primary Weakness vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass. This issue affects Redline Router: before 7.17.

  49. 9.8CVE-2023-1803EPSS 0.8%

    Authentication Bypass by Alternate Name vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass. This issue affects Redline Router: before 7.17.

  50. 9.8CVE-2022-45174EPSS 1.0%

    An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication for SAML Users can occur under the /login/backup_code endpoint and the /api/v1/vdeskintegration/challenge endpoint. The correctness …