CWE-287: Improper Authentication, page 51

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

What the weakness is: CWE-287 at MITRE

1. 5.3CVE-2022-21618EPSS 2.8%2022-10-18

   Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3 and 22.2.0…

2. 9.8CVE-2022-40684KEVExploitEPSS >99.9%2022-10-18

   An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 an…

3. 8.1CVE-2022-31122EPSS 0.7%2022-10-18

   Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Confusion. If an attacker has certain details of SAML IdP metadata, and configures their own SAML on th…

4. 6.5CVE-2022-22237EPSS 0.5%2022-10-18

   An Improper Authentication vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause an impact on confidentiality or integrity. A vulnerability in the processing of TCP-AO will allo…

5. 7.4CVE-2022-2533EPSS 0.9%2022-10-17

   An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab was not performing correct authentication…

6. 9.8CVE-2022-23769EPSS 1.1%2022-10-17

   Remote code execution vulnerability due to insufficient user privilege verification in reverseWall-MDS. Remote attackers can exploit the vulnerability such as stealing account, through remote code execution.

7. 9.1CVE-2022-41436EPSS 0.9%2022-10-14

   An issue in OXHOO TP50 OXH1.50 allows unauthenticated attackers to access the administrative panel via browsing to the URL http://device_ip/index1.html.

8. 9.8CVE-2022-38982EPSS 0.6%2022-10-14

   The fingerprint module has service logic errors.Successful exploitation of this vulnerability will cause the phone lock to be cracked.

9. 7.8CVE-2022-42488EPSS 0.2%2022-10-14

   OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application installed on the device could elevate its privileges to the root user, disable securit…

10. 8.8CVE-2022-42463EPSS 0.3%2022-10-14

    OpenHarmony-v3.1.2 and prior versions have an authenication bypass vulnerability in a callback handler function of Softbus_server in communication subsystem. Attackers can launch attacks on distributed networks by sending Bluetooth rfcomm …

11. 4.3CVE-2022-39229EPSS 1.1%2022-10-13

    Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafa…

12. 8.8CVE-2022-35135EPSS 1.0%2022-10-13

    Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/<uuid>.

13. 7.5CVE-2021-36369EPSS 1.9%2022-10-12

    An issue was discovered in Dropbear through 2020.81. Due to a non-RFC-compliant check of the available authentication methods in the client-side SSH code, it is possible for an SSH server to change the login process in its favor. This atta…

14. 9.8CVE-2022-3465EPSS 1.0%2022-10-12

    A vulnerability classified as critical was found in Mediabridge Medialink. This vulnerability affects unknown code of the file /index.asp. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit…

15. 9.8CVE-2022-40664EPSS 3.6%2022-10-12

    Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.

16. 6.5CVE-2022-39290ExploitEPSS 7.9%2022-10-07

    ZoneMinder is a free, open source Closed-circuit television software application. In affected versions authenticated users can bypass CSRF keys by modifying the request supplied to the Zoneminder web application. These modifications includ…

17. 7.5CVE-2022-39289EPSS 1.0%2022-10-07

    ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without Sy…

18. 6.5CVE-2022-21936EPSS 0.6%2022-10-07

    On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI.

19. 9.8CVE-2022-40494EPSS 2.1%2022-10-06

    NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameters.

20. 6.8CVE-2022-20662EPSS 0.4%2022-09-30

    A vulnerability in the smart card login authentication of Cisco Duo for macOS could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerability exists because the assigned user of a smart card is not…

21. 6.5CVE-2022-39254EPSS 0.7%2022-09-29

    matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded…

22. 7.5CVE-2022-39252EPSS 0.6%2022-09-29

    matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly rememb…

23. 7.5CVE-2022-39250EPSS 1.2%2022-09-29

    Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, inj…

24. 6.5CVE-2021-40693EPSS 0.8%2022-09-29

    An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.

25. 5.9CVE-2022-39264EPSS 0.8%2022-09-28

    nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to pro…

26. 8.1CVE-2022-39263EPSS 0.7%2022-09-28

    `@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` Email Provider and `@next-auth/upstash-redis-adapter` before v3.0.2 are affected …

27. 7.5CVE-2022-39257EPSS 1.0%2022-09-28

    Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will …

28. 7.5CVE-2022-39255EPSS 1.0%2022-09-28

    Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, with…

29. 7.5CVE-2022-39251EPSS 1.2%2022-09-28

    Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without an…

30. 7.5CVE-2022-39249EPSS 1.3%2022-09-28

    Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be mar…

31. 7.5CVE-2022-39248EPSS 1.0%2022-09-28

    matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as…

32. 5.3CVE-2022-39246EPSS 0.9%2022-09-28

    matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shie…

33. 7.5CVE-2022-22523EPSS 0.9%2022-09-28

    An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access i…

34. 7.8CVE-2022-39245EPSS 0.2%2022-09-26

    Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` variable can allow a local user to run arbitrary commands on the user's system with root permission…

35. 6.5CVE-2022-39219EPSS 1.2%2022-09-26

    Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow grou…

36. 7.5CVE-2022-3119EPSS 0.4%2022-09-26

    The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls,…

37. 8.8CVE-2022-35248EPSS 1.4%2022-09-23

    A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be bypassed when telling the server to use CAS during login.

38. 6.8CVE-2022-30124EPSS 0.6%2022-09-23

    An improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with physical access to a mobile device to bypass local authentication (PIN code).

39. 5.9CVE-2021-45035EPSS 0.5%2022-09-23

    Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.

40. 8.8CVE-2022-39238EPSS 0.5%2022-09-23

    Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentication Modules (PAM) for user authentication, if a user presented valid credentials but the account …

41. 3.7CVE-2022-39231EPSS 0.5%2022-09-23

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, validation of the authentication adapter app ID for _Facebook_ and _Spotify_ may …

42. 8.1CVE-2022-40616EPSS 0.6%2022-09-21

    IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass authentication and obtain sensitive information or perform tasks they should not have access to. IBM X-Force ID: 236311.

43. 6.8CVE-2021-33076EPSS 0.3%2022-09-20

    Improper authentication in firmware for some Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

44. 9.8CVE-2022-28321EPSS 1.6%2022-09-19

    The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via …

45. 9.8CVE-2022-40144EPSS 1.9%2022-09-19

    A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authentication by falsifying request parameters on affected installations.

46. 9.8CVE-2022-3218ExploitEPSS 74%2022-09-19

    Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.

47. 4.3CVE-2022-3173EPSS 0.9%2022-09-17

    Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.

48. 9.8CVE-2022-39009EPSS 0.7%2022-09-16

    The WLAN module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause third-party apps to affect WLAN functions.

49. 9.8CVE-2021-42949EPSS 7.3%2022-09-16

    The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks.

50. 7.8CVE-2022-25652EPSS 0.1%2022-09-16

    Cryptographic issues in BSP due to improper hash verification in Snapdragon Wired Infrastructure and Networking