cve.bz

OWASP A07:2025 Authentication Failures vulnerabilities, newest first, page 151

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A07:2025 at MITRE.

Its weaknesses: 36

CWE-258, CWE-259, CWE-287, CWE-288, CWE-289, CWE-290, CWE-291, CWE-293, CWE-294, CWE-295, CWE-297, CWE-298, CWE-299, CWE-300, CWE-302, CWE-303, CWE-304, CWE-305, CWE-306, CWE-307, CWE-308, CWE-309, CWE-346, CWE-350, CWE-384, CWE-521, CWE-613, CWE-620, CWE-640, CWE-798, CWE-940, CWE-941, CWE-1390, CWE-1391, CWE-1392, CWE-1393

  1. 9.3CVE-2025-1907EPSS 0.8%

    Instantel Micromate lacks authentication on a configuration port which could allow an attacker to execute commands if connected.

  2. 4.6CVE-2025-31264EPSS 0.3%

    An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker with physical access to a locked device may be able to view sensitive u…

  3. 9.8CVE-2025-30466EPSS 0.3%

    This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. A website may be able to bypass Same Origin Policy.

  4. 9.8CVE-2023-41591EPSS 0.4%

    An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potentially execute a man-in-the-middle attack on communications between fake and real hosts.

  5. 10.0CVE-2025-48748EPSS 0.4%

    Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password.

  6. 6.3CVE-2025-5320EPSS 0.3%

    A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is_valid_origin of the component CORS Handler. The manipulation of the argument localhost_aliases leads to erweiterte Rec…

  7. 7.2CVE-2025-4687EPSS 0.5%

    In Teltonika Networks Remote Management System (RMS), it is possible to perform account pre-hijacking by misusing the invite functionality. If a victim has a pending invite and registers to the platform directly, they are added to the atta…

  8. 5.3CVE-2025-47748EPSS 0.4%

    Netwrix Directory Manager v.11.0.0.0 and before & after v.11.1.25134.03 contains a hardcoded password.

  9. 9.8CVE-2025-48929EPSS 0.3%

    The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovered by an adversary.

  10. 7.5CVE-2025-48926EPSS 0.3%

    The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers.

  11. 6.5CVE-2025-48746EPSS 0.3%

    Netwrix Directory Manager (formerly Imanami GroupID) v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Authentication for a Critical Function.

  12. 6.5CVE-2025-36572EPSS 0.3%

    Dell PowerStore, version(s) 4.0.0.0, contain(s) an Use of Hard-coded Credentials vulnerability in the PowerStore image file. A low privileged attacker with remote access, with the knowledge of the hard-coded credentials, could potentially …

  13. 7.2CVE-2025-22252EPSS 0.9%

    A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an exi…

  14. 4.8CVE-2025-5025EPSS 0.3%

    libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works…

  15. 6.5CVE-2025-4947EPSS 0.3%

    libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

  16. 9.8CVE-2025-32440EPSS 0.6%

    NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication mechanism of NetAlertX to update settings without authentication. An attacker can trigger sensitive functio…

  17. 7.0CVE-2025-5279EPSS 0.3%

    When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider. An insecure connection could allow an actor to i…

  18. 5.4CVE-2025-5067EPSS 0.4%

    Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  19. 6.9CVE-2024-13966EPSS 0.4%

    ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users should change their passwords (located under the Attendance Settings tab as "Sel…

  20. 2.7CVE-2025-48370EPSS 0.9%

    auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs.…

  21. 6.9CVE-2025-5247EPSS 0.5%

    A vulnerability, which was classified as critical, has been found in Gowabby HFish 0.1. This issue affects the function LoadUrl of the file \view\url.go. The manipulation of the argument r leads to improper authentication. The attack may b…

  22. 4.3CVE-2025-5263EPSS 0.3%

    Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Th…

  23. 9.8CVE-2025-41651EPSS 0.6%

    Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system c…

  24. 9.3CVE-2025-2407EPSS 0.5%

    Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network. The vulnerability is fixed in Version 1.5.

  25. 9.8CVE-2025-48742EPSS 0.4%

    The installer in SIGB PMB before and fixed in v.8.0.1.2 allows remote code execution.

  26. 9.3CVE-2025-40664EPSS 0.6%

    Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /frmGestionUser.aspx/GetData, /frmGestionUser.aspx/updateUser and /frmGestionUser.aspx/DeleteUser.

  27. 5.5CVE-2025-4057EPSS 0.2%

    A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies.

  28. 7.5CVE-2025-41655EPSS 0.5%

    An unauthenticated remote attacker can access a URL which causes the device to reboot.

  29. 8.2CVE-2025-41654EPSS 0.4%

    An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by the watchdog.

  30. 6.3CVE-2025-5164EPSS 0.8%

    A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack c…

  31. 6.3CVE-2025-5149EPSS 0.6%

    A vulnerability was found in WCMS up to 8.3.11. It has been declared as critical. Affected by this vulnerability is the function getMemberByUid of the file /index.php?articleadmin/getallcon of the component Login. The manipulation of the a…

  32. 9.2CVE-2025-5124EPSS 1.0%

    A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30. This affects an unknown part of the component Administrative Interface. The manipulation lead…

  33. 9.8CVE-2025-47646ExploitEPSS 25%

    Weak Password Recovery Mechanism for Forgotten Password vulnerability in Gilblas Ngunte Possi PSW Front-end Login & Registration psw-login-and-registration allows Password Recovery Exploitation.This issue affects PSW Front-end Login & Regi…

  34. 8.8CVE-2025-47461EPSS 0.5%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in mediaticus Subaccounts for WooCommerce subaccounts-for-woocommerce allows Authentication Abuse.This issue affects Subaccounts for WooCommerce: from n/a through <= 1.…

  35. 6.1CVE-2025-41380EPSS 0.1%

    Iridium Certus 700 version 1.0.1 has an embedded credentials vulnerability in the code. This vulnerability allows a local user to retrieve the SSH hash string.

  36. 4.7CVE-2025-2394EPSS 0.2%

    Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leading to sensitive data disclosure.

  37. 6.6CVE-2025-48372EPSS 0.3%

    Schule is open-source school management system software. The generateOTP() function generates a 4-digit numeric One-Time Password (OTP). Prior to version 1.0.1, even if a secure random number generator is used, the short length and limited…

  38. 5.8CVE-2024-7487EPSS 0.3%

    An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid object is passed. Exploitation of this vulnerability could en…

  39. 7.2CVE-2024-41199EPSS 0.6%

    An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.

  40. 9.8CVE-2024-41198EPSS 0.6%

    An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.

  41. 9.8CVE-2024-41197EPSS 0.6%

    An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.

  42. 9.8CVE-2024-41196EPSS 0.7%

    An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.

  43. 9.8CVE-2024-41195EPSS 0.6%

    An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.

  44. 8.8CVE-2024-13956EPSS 0.5%

    SSL Verification Bypass vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

  45. 5.6CVE-2025-48061EPSS 0.1%

    wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logg…

  46. 6.5CVE-2025-32815ExploitEPSS 41%

    An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.

  47. 4.3CVE-2025-0605EPSS 0.3%

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authentication requirements.

  48. 6.5CVE-2025-4575EPSS 0.4%

    Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected for a particular use it wil…

  49. 9.2CVE-2025-34026KEVExploitEPSS 82%

    The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged…

  50. 9.3CVE-2025-46412EPSS 0.6%

    Affected Vertiv products do not properly protect webserver functions that could allow an attacker to bypass authentication.