CWE-287: Improper Authentication, page 53

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

What the weakness is: CWE-287 at MITRE

1. 4.3CVE-2022-2303EPSS 0.8%2022-08-05

   An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement…

2. 9.8CVE-2022-2664EPSS 0.7%2022-08-05

   A vulnerability classified as critical has been found in Private Cloud Management Platform. Affected is an unknown function of the file /management/api/rcx_management/global_config_query of the component POST Request Handler. The manipulat…

3. 7.5CVE-2022-35142EPSS 1.6%2022-08-04

   An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter.

4. 4.3CVE-2022-27484EPSS 0.5%2022-08-03

   A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypass the Old Password check in the password change form via a crafted HTTP request.

5. 9.8CVE-2022-35925EPSS 1.8%2022-08-02

   BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instan…

6. 5.4CVE-2022-35629EPSS 0.5%2022-07-29

   Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, to send messages to the server claiming to come from another client ID. This issu…

7. 7.5CVE-2016-0796EPSS 1.3%2022-07-28

   WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities because it fails to properly verify user-supplied input. An attacke…

8. 6.5CVE-2022-2553EPSS 1.3%2022-07-28

   The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with …

9. 9.8CVE-2022-30270EPSS 0.9%2022-07-26

   The Motorola ACE1000 RTU through 2022-05-02 has default credentials. It exposes an SSH interface on port 22/TCP. This interface is used for remote maintenance and for SFTP file-transfer operations that are part of engineering software func…

10. 9.8CVE-2022-36412EPSS 5.4%2022-07-26

    In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. (An API request may, in effect, be executed with the credentials of a user who authenticated in the past.)

11. 5.7CVE-2022-34575EPSS 0.6%2022-07-25

    An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing fctest.shtml.

12. 9.8CVE-2022-34839EPSS 1.1%2022-07-22

    Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress.

13. 7.5CVE-2022-31164EPSS 0.7%2022-07-22

    Tovy is a a staff management system for Roblox groups. A vulnerability in versions prior to 0.7.51 allows users to log in as other users, including privileged users such as the other of the instance. The problem has been patched in version…

14. 5.3CVE-2022-28666ExploitEPSS 1.5%2022-07-21

    Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-content-toggle option update.

15. 9.8CVE-2022-26136EPSS 5.7%2022-07-20

    A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. …

16. 9.8CVE-2022-2141EPSS 1.3%2022-07-20

    SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.

17. 7.5CVE-2022-34535EPSS 0.8%2022-07-19

    Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows unauthenticated attackers to view internal paths and scripts via web files.

18. 7.5CVE-2022-30624EPSS 0.3%2022-07-18

    Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password.

19. 9.8CVE-2022-30623EPSS 0.4%2022-07-18

    The server checks the user's cookie in a non-standard way, and a value is entered in the cookie value name of the status and its value is set to true to bypass the identification with the system using a username and password.

20. 9.8CVE-2021-40874EPSS 1.2%2022-07-18

    An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST password validation service (for another LemonLDAP::NG instance, for example) and using the Kerberos authentication met…

21. 8.8CVE-2022-30550EPSS 2.3%2022-07-17

    An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to pass…

22. 5.3CVE-2022-2133EPSS 1.2%2022-07-17

    The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.

23. 9.8CVE-2017-20133EPSS 0.7%2022-07-16

    A vulnerability, which was classified as critical, was found in Itech Job Portal Script 9.13. This affects an unknown part of the file /admin. The manipulation leads to improper authentication. It is possible to initiate the attack remotel…

24. 3.3CVE-2022-33689EPSS 0.09%2022-07-12

    Improper access control vulnerability in TelephonyUI prior to SMR Jul-2022 Release 1 allows attackers to change preferred network type by unprotected binder call.

25. 7.8CVE-2022-30755EPSS 0.1%2022-07-12

    Improper authentication vulnerability in AppLock prior to SMR Jul-2022 Release 1 allows attacker to bypass password confirm activity by hijacking the implicit intent.

26. 7.5CVE-2022-33736EPSS 1.3%2022-07-12

    A vulnerability has been identified in Opcenter Quality V13.1 (All versions < V13.1.20220624), Opcenter Quality V13.2 (All versions < V13.2.20220624). The affected applications do not properly validate login information during authenticati…

27. 9.8CVE-2022-2302EPSS 2.1%2022-07-11

    Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote attacker can get full access without knowledge of the password.

28. 6.5CVE-2015-5298EPSS 0.7%2022-07-07

    The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modif…

29. 4.3CVE-2022-31131EPSS 0.8%2022-07-06

    Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have b…

30. 9.8CVE-2022-31125ExploitEPSS 20%2022-07-06

    Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to bypass authentication and access admin functionality by sending a s…

31. 8.8CVE-2021-43116ExploitEPSS 7.5%2022-07-05

    An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.

32. 5.3CVE-2022-28713EPSS 1.1%2022-07-04

    Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information without logging in to the product.

33. 7.5CVE-2021-41995EPSS 0.8%2022-06-30

    A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.

34. 9.8CVE-2022-2197EPSS 1.6%2022-06-30

    By using a specific credential string, an attacker with network access to the device’s web interface could circumvent the authentication scheme and perform administrative operations.

35. 4.6CVE-2022-1955EPSS 0.4%2022-06-30

    Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulatio…

36. 9.8CVE-2021-41506EPSS 2.3%2022-06-30

    Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.…

37. 4.3CVE-2022-29858EPSS 1.2%2022-06-28

    Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changing an existing image short code on website content.

38. 8.1CVE-2022-33202EPSS 0.4%2022-06-27

    Authentication bypass vulnerability in the setup screen of L2Blocker(on-premise) Ver4.8.5 and earlier and L2Blocker(Cloud) Ver4.8.5 and earlier allows an adjacent attacker to perform an unauthorized login and obtain the stored information …

39. 5.3CVE-2022-29578EPSS 1.1%2022-06-24

    Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address, and daily energy usage.

40. 7.5CVE-2021-41638EPSS 1.7%2022-06-24

    The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files only by using a valid username.

41. 9.8CVE-2021-26638EPSS 3.8%2022-06-23

    Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and information exposure. Remote attackers can use this vulerability to take control of the home environment including indoor con…

42. 9.8CVE-2021-26637EPSS 1.9%2022-06-23

    There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unauthorized users can remotely control the device.

43. 9.8CVE-2022-29775ExploitEPSS 61%2022-06-21

    iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.

44. 9.8CVE-2022-33139EPSS 1.3%2022-06-21

    A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-def…

45. 7.5CVE-2022-1801EPSS 1.2%2022-06-20

    The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check…

46. 7.5CVE-2022-31083EPSS 0.9%2022-06-17

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, aut…

47. 7.5CVE-2022-32276EPSS 3.9%2022-06-17

    Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability

48. 7.8CVE-2020-36548EPSS 0.2%2022-06-17

    A vulnerability classified as problematic has been found in GE Voluson S8. Affected is the file /uscgi-bin/users.cgi of the Service Browser. The manipulation leads to improper authentication and elevated access possibilities. It is possibl…

49. 8.8CVE-2018-25043EPSS 1.2%2022-06-17

    A vulnerability classified as critical was found in uTorrent. This vulnerability affects unknown code of the component PRNG. The manipulation leads to weak authentication. The attack can be initiated remotely. The exploit has been disclose…

50. 9.8CVE-2022-33750EPSS 1.7%2022-06-16

    CA Automic Automation 12.2 and 12.3 contain an authentication error vulnerability in the Automic agent that could allow a remote attacker to potentially execute arbitrary commands.