cve.bz

CWE-287: Improper Authentication, page 70

Filter

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

What the weakness is: CWE-287 at MITRE

Ask an AI about CWE-287

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-287: Improper Authentication and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/287.html and https://cve.bz/cve/cwe/287?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2019-19825ExploitEPSS 30%

    On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker…

  2. 9.1CVE-2013-4462EPSS 2.8%

    WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability

  3. 8.8CVE-2020-5224EPSS 0.5%

    In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a probl…

  4. 5.3CVE-2013-1596ExploitEPSS 10%

    An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554.

  5. 9.8CVE-2012-6451EPSS 2.6%

    Lorex LNC116 and LNC104 IP Cameras have a Remote Authentication Bypass Vulnerability

  6. 5.5CVE-2020-1788EPSS 0.6%

    Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability. Certain applications do not properly validate the identity of another application who would call its interface. An atta…

  7. 6.0CVE-2020-1840EPSS 0.2%

    HUAWEI Mate 20 smart phones with versions earlier than 10.0.0.175(C00E70R3P8) have an insufficient authentication vulnerability. A local attacker with high privilege can execute a specific command to exploit this vulnerability. Successful …

  8. 5.3CVE-2020-7222EPSS 1.3%

    An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authenticate. An attacker who changes the result parameter (to true) in this JavaScript co…

  9. 4.6CVE-2019-3997EPSS 0.4%

    Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.0-1.3 allows a local, unauthenticated attacker to pair a rogue keypad to an armed system.

  10. 6.5CVE-2019-19857EPSS 0.9%

    An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. An admin can change their password without providing the current password, by using interfaces outside the Change Password screen. Thus, requiring…

  11. 7.5CVE-2012-3824EPSS 1.8%

    In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization.

  12. 9.8CVE-2014-5081ExploitEPSS 10%

    sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass

  13. 9.8CVE-2012-2714EPSS 3.3%

    The BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users via the audience identifier.

  14. 6.5CVE-2012-1258ExploitEPSS 3.3%

    cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate user permissions, which allow remote attackers to add user accounts with administrator privileges via the newuser, pwd,…

  15. 4.6CVE-2020-1786EPSS 0.2%

    HUAWEI Mate 20 Pro smartphones versions earlier than 10.0.0.175(C00E69R3P8) have an improper authentication vulnerability. The software does not sufficiently validate the name of apk file in a special condition which could allow an attacke…

  16. 6.6CVE-2020-1787EPSS 0.3%

    HUAWEI Mate 20 smartphones versions earlier than 9.1.0.139(C00E133R3P1) have an improper authentication vulnerability. The system has a logic error under certain scenario, successful exploit could allow the attacker who gains the privilege…

  17. 9.8CVE-2014-2651EPSS 1.7%

    Unify OpenStage/OpenScape Desk Phone IP SIP before V3 R3.11.0 has an authentication bypass in the default mode of the Workpoint Interface

  18. 6.5CVE-2019-17023EPSS 1.3%

    After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will …

  19. 9.8CVE-2019-19518EPSS 2.8%

    CA Automic Sysload 5.6.0 through 6.1.2 contains a vulnerability, related to a lack of authentication on the File Server port, that potentially allows remote attackers to execute arbitrary commands.

  20. 7.5CVE-2019-20360EPSS 2.5%

    A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. On…

  21. 9.8CVE-2013-5122EPSS 3.7%

    Cisco Linksys Routers EA2700, EA3500, E4200, EA4500: A bug can cause an unsafe TCP port to open which leads to unauthenticated access

  22. 7.8CVE-2019-6854EPSS 0.2%

    A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -with initial releases before 1 January 2019- which could cause a low privilege user to delete or modify database, setting…

  23. 7.5CVE-2018-19834EPSS 0.9%

    The quaker function of a smart contract implementation for BOMBBA (BOMB), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity.

  24. 7.5CVE-2018-19833EPSS 0.9%

    The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity.

  25. 7.5CVE-2018-19832EPSS 0.9%

    The NETM() function of a smart contract implementation for NewIntelTechMedia (NETM), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity.

  26. 7.5CVE-2018-19831EPSS 0.9%

    The ToOwner() function of a smart contract implementation for Cryptbond Network (CBN), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity.

  27. 5.3CVE-2018-20489EPSS 0.8%

    An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.

  28. 9.8CVE-2013-4982ExploitEPSS 13%

    AVTECH AVN801 DVR has a security bypass via the administration login captcha

  29. 9.8CVE-2013-4976ExploitEPSS 36%

    Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials

  30. 9.8CVE-2013-4621EPSS 1.8%

    Magnolia CMS before 4.5.9 has multiple access bypass vulnerabilities

  31. 9.8CVE-2013-3088EPSS 1.9%

    Belkin N900 router (F9K1104v1) contains an Authentication Bypass using "Javascript debugging".

  32. 9.8CVE-2013-3085EPSS 1.7%

    An authentication bypass exists in the web management interface in Belkin F5D8236-4 v2.

  33. 8.8CVE-2012-3462EPSS 1.6%

    A flaw was found in SSSD version 1.9.0. The SSSD's access-provider logic causes the result of the HBAC rule processing to be ignored in the event that the access-provider is also handling the setup of the user's SELinux user context.

  34. 9.8CVE-2019-16327EPSS 1.8%

    D-Link DIR-601 B1 2.00NA devices are vulnerable to authentication bypass. They do not check for authentication at the server side and rely on client-side validation, which is bypassable. NOTE: this is an end-of-life product.

  35. 5.3CVE-2019-19982EPSS 1.2%

    The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?es_skip=1&op…

  36. 6.5CVE-2019-5108EPSS 10%

    An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication pr…

  37. 8.8CVE-2019-5486EPSS 1.5%

    A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an attacker to create an account that bypassed domain restrictions and email verificat…

  38. 5.7CVE-2019-8804EPSS 0.4%

    An inconsistency in Wi-Fi network configuration settings was addressed. This issue is fixed in iOS 13.2 and iPadOS 13.2. An attacker in physical proximity may be able to force a user onto a malicious Wi-Fi network during device setup.

  39. 6.8CVE-2019-8760EPSS 0.3%

    This issue was addressed by improving Face ID machine learning models. This issue is fixed in iOS 13. A 3D model constructed to look like the enrolled user may authenticate via Face ID.

  40. 5.5CVE-2019-8704EPSS 0.3%

    An authentication issue was addressed with improved state management. This issue is fixed in tvOS 13. A local user may be able to leak sensitive user information.

  41. 8.8CVE-2019-8634EPSS 1.0%

    An authentication issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.5. A user may be unexpectedly logged in to another user’s account.

  42. 7.8CVE-2019-8533EPSS 0.3%

    A lock handling issue was addressed with improved lock handling. This issue is fixed in macOS Mojave 10.14.4. A Mac may not lock when disconnecting from an external monitor.

  43. 9.8CVE-2014-8650EPSS 3.6%

    python-requests-Kerberos through 0.5 does not handle mutual authentication

  44. 3.5CVE-2019-5252EPSS 0.2%

    There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attack…

  45. 5.9CVE-2019-5253EPSS 0.6%

    E5572-855 with versions earlier than 8.0.1.3(H335SP1C233) has an improper authentication vulnerability. The device does not perform a sufficient authentication when doing certain operations, successful exploit could allow an attacker to ca…

  46. 7.8CVE-2014-1867EPSS 0.4%

    suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code execution

  47. 6.5CVE-2019-5061EPSS 0.9%

    An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required authentication process has completed. This could lead to different…

  48. 5.3CVE-2019-18341EPSS 1.6%

    A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Control Center Server (CCS) contains an authentication bypass vulnerability. A remote attacker with …

  49. 9.8CVE-2019-18337EPSS 2.5%

    A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains an authentication bypass vulnerability in its XML-based communication protocol as provided by default on p…

  50. 5.3CVE-2019-18332EPSS 1.0%

    A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server could gain access to directory listings of the server by sending specifi…