cve.bz

CWE-287: Improper Authentication, page 47

Filter

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

What the weakness is: CWE-287 at MITRE

Ask an AI about CWE-287

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-287: Improper Authentication and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/287.html and https://cve.bz/cve/cwe/287?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2022-45173EPSS 1.0%

    An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /api/v1/vdeskintegration/challenge endpoint. Because only the client-side verifies whether a check was successfu…

  2. 9.8CVE-2023-1617EPSS 0.7%

    Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules).  This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on aff…

  3. 9.8CVE-2023-28121ExploitEPSS 87%

    An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain …

  4. 6.5CVE-2023-1980EPSS 0.5%

    Two factor authentication bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to cancel the two factor authentication via the application user interface and open entries.

  5. 5.3CVE-2023-23761EPSS 0.5%

    An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users' secret gists by authenticating through an SSH certificate authority. To do so, a user had to know…

  6. 7.2CVE-2023-27091EPSS 0.7%

    An unauthorized access issue found in XiaoBingby TeaCMS 2.3.3 allows attackers to escalate privileges via the id and keywords parameter(s).

  7. 4.3CVE-2023-1752EPSS 0.5%

    The listed versions of Nexx Smart Home devices could allow any user to register an already registered alarm or associated device with only the device’s MAC address.

  8. 9.8CVE-2021-28235EPSS 1.6%

    Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

  9. 9.8CVE-2023-1784EPSS 1.0%

    A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication. The attack may be initiated remotel…

  10. 9.8CVE-2023-28862EPSS 1.0%

    An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny se…

  11. 8.8CVE-2023-28727EPSS 0.4%

    Panasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass authentication due to mishandling of X-Forwarded-For headers.

  12. 5.5CVE-2023-27538EPSS 1.5%

    An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool …

  13. 5.9CVE-2023-27536EPSS 1.8%

    An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DEL…

  14. 5.9CVE-2023-27535EPSS 1.8%

    An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool f…

  15. 6.8CVE-2023-28647EPSS 0.3%

    Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app an…

  16. 2.4CVE-2023-28646EPSS 0.2%

    Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcod…

  17. 9.8CVE-2023-28503ExploitEPSS 62%

    Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can…

  18. 8.8CVE-2022-43620EPSS 1.0%

    This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the hand…

  19. 9.8CVE-2023-28398EPSS 0.9%

    Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication, thereby gaining unauthorized access to the system. A threat actor could exploit this vulnerability to create a user acc…

  20. 9.8CVE-2022-4126EPSS 0.6%

    Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: before 4.40 230207.

  21. 7.5CVE-2023-21027EPSS 0.5%

    In multiple functions of PasspointXmlUtils.java, there is a possible authentication misconfiguration due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User in…

  22. 7.5CVE-2022-45124EPSS 13%

    An information disclosure vulnerability exists in the User authentication functionality of WellinTech KingHistorian 35.01.00.05. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can sniff ne…

  23. 9.8CVE-2023-28609EPSS 0.9%

    api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication.

  24. 9.8CVE-2023-1464EPSS 0.8%

    A vulnerability, which was classified as critical, was found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file Users.php?f=save_user. The manipulation of the argument firstname/middlename/lastname/user…

  25. 9.8CVE-2023-1460EPSS 1.0%

    A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admin/ajax.php?action=save_user of the component Password Change Handler. The manipu…

  26. 4.4CVE-2023-21460EPSS 0.2%

    Improper authentication in SecSettings prior to SMR Mar-2023 Release 1 allows attacker to reset the setting.

  27. 9.1CVE-2023-21455EPSS 0.4%

    Improper authorization implementation in Exynos baseband prior to SMR Mar-2023 Release 1 allows incorrect handling of unencrypted message.

  28. 9.8CVE-2023-28461KEVEPSS 68%

    Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could t…

  29. 6.5CVE-2022-46773EPSS 0.5%

    IBM Robotic Process Automation 21.0.0 - 21.0.7 and 23.0.0 is vulnerable to client-side validation bypass for credential pools. Invalid credential pools may be created as a result. IBM X-Force ID: 242951.

  30. 6.5CVE-2022-46774EPSS 0.3%

    IBM Manage Application 8.8.0 and 8.9.0 in the IBM Maximo Application Suite is vulnerable to incorrect default permissions which could give access to a user to actions that they should not have access to. IBM X-Force ID: 242953.

  31. 9.8CVE-2023-1327EPSS 0.9%

    Netgear RAX30 (AX2400), prior to version 1.0.6.74, was affected by an authentication bypass vulnerability, allowing an unauthenticated attacker to gain administrative access to the device's web management interface by resetting the admin p…

  32. 7.5CVE-2023-25957EPSS 0.6%

    A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), Mendix SAML (Mendix 9 latest compatible, New Track) (All ver…

  33. 8.6CVE-2023-23857EPSS 0.5%

    Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services which can be used to perfo…

  34. 9.8CVE-2023-27582EPSS 1.0%

    maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL authorization username is specified when using the PLAIN authentication mechanisms. In…

  35. 7.5CVE-2022-44574EPSS 64%

    An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port.

  36. 7.8CVE-2022-33242EPSS 0.1%

    Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD.

  37. 10.0CVE-2023-27482ExploitEPSS 72%

    homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation t…

  38. 4.3CVE-2022-48364EPSS 0.7%

    The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the …

  39. 8.8CVE-2023-0228EPSS 0.3%

    Improper Authentication vulnerability in ABB Symphony Plus S+ Operations.This issue affects Symphony Plus S+ Operations: from 2.X through 2.1 SP2, 2.2, from 3.X through 3.3 SP1, 3.3 SP2.

  40. 6.8CVE-2023-25931EPSS 0.3%

    Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthori…

  41. 5.3CVE-2023-1065EPSS 0.6%

    This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relevant, security issues. It does not expose the user of the integration to any dire…

  42. 7.5CVE-2023-25264EPSS 1.0%

    An issue was discovered in Docmosis Tornado prior to version 2.9.5. An unauthenticated attacker can bypass the authentication check filter completely by introducing a specially crafted request with relative path segments.

  43. 3.3CVE-2023-23493EPSS 0.2%

    A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.2, macOS Monterey 12.6.3. An encrypted volume may be unmounted and remounted by a different user without prompting for the password.

  44. 5.5CVE-2022-48305EPSS 0.1%

    There is an identity authentication bypass vulnerability in Huawei Children Smart Watch (Simba-AL00) 1.1.1.274. Successful exploitation of this vulnerability may cause the access control function of specific applications to fail.

  45. 4.6CVE-2022-48254EPSS 0.2%

    There is a data processing error vulnerability in Leia-B29 2.0.0.49(M03). Successful exploitation could bypass lock screen authentication.

  46. 7.5CVE-2022-34908EPSS 0.6%

    An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It possesses an authentication mechanism; however, some features do not require any token or cookie in a request. Therefore, an attacker may send a simple H…

  47. 4.6CVE-2023-20012EPSS 0.3%

    A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender (FEX) when used in UCS Fabric Interconnect deployments could allow an unauthenticated attacker with physical access to bypass authentica…

  48. 9.8CVE-2023-24093EPSS 0.8%

    An access control issue in H3C A210-G A210-GV100R005 allows attackers to authenticate without a password.

  49. 9.8CVE-2015-10083EPSS 1.1%

    A vulnerability has been found in harrystech Dynosaur-Rails and classified as critical. Affected by this vulnerability is the function basic_auth of the file app/controllers/application_controller.rb. The manipulation leads to improper aut…

  50. 7.5CVE-2023-0905ExploitEPSS 3.2%

    A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file changePasswordForEmployee.php. The manipulation leads to improper authentication. It i…