cve.bz

CWE-287: Improper Authentication, page 69

Filter

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

What the weakness is: CWE-287 at MITRE

Ask an AI about CWE-287

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-287: Improper Authentication and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/287.html and https://cve.bz/cve/cwe/287?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2014-3879EPSS 2.7%

    OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, which causes the loaded policy chain to no be discarded and allows context-dependent attacker…

  2. 9.1CVE-2013-4454EPSS 3.7%

    WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities

  3. 6.8CVE-2020-1842EPSS 0.2%

    Huawei HEGE-560 version 1.0.1.20(SP2); OSCA-550 and OSCA-550A version 1.0.0.71(SP1); and OSCA-550AX and OSCA-550X version 1.0.0.71(SP2) have an insufficient authentication vulnerability. An attacker can access the device physically and per…

  4. 7.8CVE-2020-1812EPSS 0.6%

    HUAWEI P30 smartphones with versions earlier than 10.0.0.173(C00E73R1P11) have an improper authentication vulnerability. Due to improperly validation of certain application, an attacker should trick the user into installing a malicious app…

  5. 6.8CVE-2020-1789EPSS 0.2%

    Huawei OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X products with version 1.0.1.21(SP3) have an insufficient authentication vulnerability. The software does not require a strong credential when the user trying to do certain operations. S…

  6. 9.8CVE-2015-6922ExploitEPSS 82%

    Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an…

  7. 9.8CVE-2019-20046EPSS 2.2%

    The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. The affected product does not require adequate authentication, which may allow an attacker to read sensitive inform…

  8. 4.3CVE-2020-5532EPSS 0.9%

    ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker on the same network segment to bypass authentication and to view the images which were recorded by the other ilbo user's…

  9. 7.5CVE-2013-6360EPSS 1.0%

    TRENDnet TS-S402 has a backdoor to enable TELNET.

  10. 5.5CVE-2019-3998EPSS 0.4%

    Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to modify the Wi-Fi network the base station connects to.

  11. 6.7CVE-2019-14598EPSS 0.5%

    Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 14.0.10 may allow a privileged user to potentially enable escalation of privilege…

  12. 9.1CVE-2014-4198EPSS 1.3%

    A Two-Factor Authentication Bypass Vulnerability exists in BS-Client Private Client 2.4 and 2.5 via an XML request that neglects the use of ADPswID and AD parameters, which could let a malicious user access privileged function.

  13. 9.8CVE-2020-8953EPSS 1.3%

    OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication).

  14. 7.8CVE-2011-4338EPSS 0.4%

    Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root pass…

  15. 7.3CVE-2020-8595EPSS 2.6%

    Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configur…

  16. 8.8CVE-2020-0688KEVExploitEPSS >99.9%

    A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

  17. 8.4CVE-2013-2120EPSS 0.6%

    The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allows context-dependent attackers to bypass authentication via a brute-force attack.

  18. 7.8CVE-2013-5582ExploitEPSS 3.6%

    Ammyy Admin 3.2 and earlier stores the client ID at a fixed memory location, which might make it easier for user-assisted remote attackers to bypass authentication by running a local program that extracts a field from the AA_v3.2.exe file.

  19. 9.8CVE-2014-9753EPSS 2.9%

    confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter.

  20. 9.8CVE-2013-1359ExploitEPSS 89%

    An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0; Universal Management Appliance (UMA) 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, 5.1, and 6.0 via the s…

  21. 9.8CVE-2013-1360ExploitEPSS 23%

    An Authentication Bypass vulnerability exists in DELL SonicWALL Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0, Analyzer 7.0, Universal Management Appliance (UMA) 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, and 6.0 via a crafted …

  22. 7.8CVE-2014-8347ExploitEPSS 1.4%

    An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 and Filemaker Pro Advanced 12.04, which could let a malicious user obtain elevated privileges.

  23. 4.3CVE-2019-6744EPSS 0.4%

    This vulnerability allows local attackers to disclose sensitive information on affected installations of Samsung Knox 1.2.02.39 on Samsung Galaxy S9 build G9600ZHS3ARL1 Secure Folder. An attacker must first obtain physical access to the de…

  24. 9.8CVE-2019-20062EPSS 1.6%

    MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (the hash never expires until used).

  25. 8.1CVE-2017-18641EPSS 1.5%

    In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.

  26. 5.9CVE-2013-3096EPSS 1.3%

    D-Link DIR865L v1.03 suffers from an "Unauthenticated Hardware Linking" vulnerability.

  27. 9.8CVE-2013-3091EPSS 3.7%

    An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication using "Javascript debugging."

  28. 4.6CVE-2012-6340EPSS 1.2%

    An Authentication vulnerability exists in NETGEAR WGR614 v7 and v9 due to a hardcoded credential used for serial programming, a related issue to CVE-2006-1002.

  29. 9.8CVE-2020-8771ExploitEPSS 46%

    The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.

  30. 9.8CVE-2013-2681ExploitEPSS 10%

    Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to gain unauthorized access.

  31. 8.1CVE-2015-0102EPSS 1.7%

    IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

  32. 2.7CVE-2019-15620EPSS 0.8%

    Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature.

  33. 5.4CVE-2019-15617EPSS 0.6%

    A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.

  34. 6.1CVE-2019-15615EPSS 0.4%

    A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past.

  35. 8.8CVE-2013-7051ExploitEPSS 16%

    D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters

  36. 9.8CVE-2020-8591EPSS 1.4%

    eG Manager 7.1.2 allows authentication bypass via a com.egurkha.EgLoginServlet?uname=admin&upass=&accessKey=eGm0n1t0r request.

  37. 9.8CVE-2020-8510EPSS 1.2%

    An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en (user+perms+lang), one can login as any user without a password.

  38. 7.5CVE-2016-2032EPSS 2.7%

    A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the management interface of an underlying system component called RabbitMQ, which could let a malicious user obtain sensitive information. This interface l…

  39. 7.1CVE-2013-5116EPSS 0.5%

    Evernote prior to 5.5.1 has insecure password change

  40. 6.1CVE-2013-5114EPSS 0.6%

    LastPass prior to 2.5.1 allows secure wipe bypass.

  41. 4.6CVE-2013-5112EPSS 0.5%

    Evernote before 5.5.1 has insecure PIN storage

  42. 10.0CVE-2020-5206EPSS 1.3%

    In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allow…

  43. 9.8CVE-2013-3317EPSS 4.8%

    Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass via the NtgrBak key.

  44. 9.8CVE-2013-3316EPSS 4.8%

    Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass due to the server skipping checks for URLs containing a ".jpg".

  45. 9.8CVE-2013-3215ExploitEPSS 69%

    vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function.

  46. 7.5CVE-2013-2569ExploitEPSS 31%

    A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, which could let a malicious user obtain unauthorized access to the live video stream.

  47. 9.8CVE-2013-3071EPSS 2.1%

    NETGEAR Centria WNDR4700 devices with firmware 1.0.0.34 allow authentication bypass.

  48. 5.3CVE-2013-1600ExploitEPSS 19%

    An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-2121 1.06_FR, 1.06, and 1.05_RU, DCS-2102 1.06_FR. 1.06, and 1.05_RU, which cou…

  49. 8.8CVE-2013-4863ExploitEPSS 12%

    The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute arbitrary Lua code via a RunLua action in a request to upnp/control/hag on port 49451 or (2) remote authenticated users …

  50. 9.8CVE-2019-15585EPSS 1.6%

    Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integration had a validation issue that permitted an attacker to takeover another user's a…