CWE-287: Improper Authentication, page 65

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

What the weakness is: CWE-287 at MITRE

1. 9.8CVE-2020-26105EPSS 1.4%2020-09-25

   In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).

2. 9.8CVE-2020-26101EPSS 1.4%2020-09-25

   In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).

3. 8.1CVE-2020-15222EPSS 0.9%2020-09-24

   In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked. When using client authentication method "priva…

4. 9.8CVE-2019-16028EPSS 3.4%2020-09-23

   A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an af…

5. 5.3CVE-2019-15993ExploitEPSS 10%2020-09-23

   A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to in…

6. 7.5CVE-2020-8253EPSS 1.7%2020-09-18

   Improper authentication in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Citrix XenMobile Server before 10.9 RP5 leads to the ability to access sensitive fi…

7. 6.5CVE-2020-8200EPSS 1.3%2020-09-18

   Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domain as a Citrix StoreFront server to read arbitrary files from that server.

8. 5.7CVE-2020-7297EPSS 0.4%2020-09-16

   Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via improper access control in the user interface.

9. 5.7CVE-2020-7296EPSS 0.4%2020-09-15

   Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected configuration files via improper access control in the user interface.

10. 4.6CVE-2020-7295EPSS 0.5%2020-09-15

    Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected log data via improper access controls in the user interface.

11. 4.6CVE-2020-7294EPSS 0.4%2020-09-15

    Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected files via improper access controls in the REST interface.

12. 9.0CVE-2020-7293EPSS 0.7%2020-09-15

    Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user with low permissions to change the system's root password via improper access controls in the user interface.

13. 9.8CVE-2020-16098EPSS 1.1%2020-09-15

    It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8.20 prior to v8.20.1166(MR3), versions of 8.10 prior to v8.10.1211(MR5), versions of 8.00 prior to …

14. 6.5CVE-2020-13303EPSS 1.3%2020-09-15

    A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can access a private repository within a public project.

15. 5.9CVE-2020-15802EPSS 7.1%2020-09-11

    Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2 and v5.0 may permit an unauthenticated user to establish a bonding with one tra…

16. 8.8CVE-2020-16222EPSS 0.5%2020-09-11

    In Patient Information Center iX (PICiX) Version B.02, C.02, C.03, and PerformanceBridge Focal Point Version A.01, when an actor claims to have a given identity, the software does not prove or insufficiently proves the claim is correct.

17. 9.1CVE-2020-25251EPSS 1.2%2020-09-11

    An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Client-side authentication is used for critical functions such as adding users or r…

18. 9.8CVE-2020-15787EPSS 1.5%2020-09-09

    A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attempts as the information given can be truncated to match only a set number of chara…

19. 6.9CVE-2020-7323EPSS 0.3%2020-09-09

    Authentication Protection Bypass vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows physical local users to bypass the Windows lock screen via triggering certain detection events while …

20. 7.8CVE-2019-10562EPSS 0.2%2020-09-08

    u'Improper authentication and signature verification of debug polices in secure boot loader will allow unverified debug policies to be loaded into secure memory and leads to memory corruption' in Snapdragon Auto, Snapdragon Compute, Snapdr…

21. 9.8CVE-2020-24987EPSS 3.1%2020-09-04

    Tenda AC18 Router through V15.03.05.05_EN and through V15.03.05.19(6318) CN devices could cause a remote code execution due to incorrect authentication handling of vulnerable logincheck() function in /usr/lib/lua/ngx_authserver/ngx_wdas.lu…

22. 9.8CVE-2020-24029EPSS 2.0%2020-09-02

    Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request. NOTE: as of 2025-10-14, the Supplier's perspective is that this is "corrected in all m…

23. 9.8CVE-2020-5777ExploitEPSS 23%2020-09-01

    MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql set…

24. 9.8CVE-2020-24786EPSS 13%2020-08-31

    An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus befo…

25. 7.8CVE-2020-8097EPSS 0.4%2020-08-30

    An improper authentication vulnerability in Bitdefender Endpoint Security Tools for Windows and Bitdefender Endpoint Security SDK allows an unprivileged local attacker to escalate privileges or tamper with the product's security settings. …

26. 10.0CVE-2020-15164EPSS 1.2%2020-08-28

    in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscore(s), since those are treated as whitespace and trimmed by MediaWiki. This af…

27. 8.1CVE-2020-15605EPSS 2.6%2020-08-27

    If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Vulnerability Protection 2.0 SP2 could allow an unauthenticated attacker with prior knowledge of the targeted organization to bypass manager auth…

28. 8.1CVE-2020-15601EPSS 2.6%2020-08-27

    If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Deep Security 10.x-12.x could allow an unauthenticated attacker with prior knowledge of the targeted organization to bypass manager authenticatio…

29. 6.5CVE-2020-4167EPSS 1.0%2020-08-27

    IBM Security Guardium Insights 2.0.1 could allow an attacker to obtain sensitive information or perform unauthorized actions due to improper authenciation mechanisms. IBM X-Force ID: 174403.

30. 6.7CVE-2020-3151EPSS 0.3%2020-08-26

    A vulnerability in the CLI of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to bypass restrictions on the CLI. The vulnerability is due to insufficient security mechan…

31. 7.8CVE-2020-15482EPSS 0.2%2020-08-26

    An issue was discovered on Nescomed Multipara Monitor M1000 devices. The device enables an unencrypted TELNET service by default, with a blank password for the admin account. This allows an attacker to gain root access to the device over t…

32. 8.2CVE-2020-16251EPSS 2.8%2020-08-26

    HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

33. 4.7CVE-2020-24612EPSS 0.3%2020-08-24

    An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the use…

34. 5.9CVE-2020-19888EPSS 0.7%2020-08-24

    DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\page.php for empty cache operation. This vulnerability can be exploited to empty a table.

35. 5.3CVE-2020-10123EPSS 0.4%2020-08-21

    The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host computer, allowing an attacker with physical access to internal ATM components …

36. 4.9CVE-2020-16239EPSS 1.0%2020-08-21

    When an actor claims to have a given identity, Philips SureSigns VS4, A.07.107 and prior does not prove or insufficiently proves the claim is correct.

37. 9.9CVE-2020-15149EPSS 2.4%2020-08-20

    NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. Th…

38. 7.5CVE-2020-3411EPSS 2.2%2020-08-17

    A vulnerability in Cisco DNA Center software could allow an unauthenticated remote attacker access to sensitive information on an affected system. The vulnerability is due to improper handling of authentication tokens by the affected softw…

39. 9.1CVE-2020-9233EPSS 0.8%2020-08-17

    FusionCompute 8.0.0 have an insufficient authentication vulnerability. An attacker may exploit the vulnerability to delete some files and cause some services abnormal.

40. 8.8CVE-2020-4662EPSS 1.3%2020-08-14

    IBM Event Streams 10.0.0 could allow an authenticated user to perform tasks to a schema due to improper authentication validation. IBM X-Force ID: 186233.

41. 4.4CVE-2020-8685EPSS 0.3%2020-08-13

    Improper authentication in subsystem for Intel (R) LED Manager for NUC before version 1.2.3 may allow privileged user to potentially enable denial of service via local access.

42. 7.8CVE-2020-8714EPSS 0.3%2020-08-13

    Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access.

43. 8.8CVE-2020-8713EPSS 0.7%2020-08-13

    Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.

44. 8.8CVE-2020-8709EPSS 0.7%2020-08-13

    Improper authentication in socket services for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.

45. 8.8CVE-2020-8708EPSS 0.7%2020-08-13

    Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.

46. 7.2CVE-2020-13290EPSS 1.1%2020-08-12

    In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page

47. 9.6CVE-2020-13292EPSS 1.0%2020-08-10

    In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow.

48. 8.8CVE-2020-15063EPSS 0.9%2020-08-07

    DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.

49. 8.8CVE-2020-15059EPSS 0.9%2020-08-07

    Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.

50. 8.8CVE-2020-15055EPSS 0.9%2020-08-07

    TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.