cve.bz

OWASP A07:2025 Authentication Failures vulnerabilities, newest first, page 170

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A07:2025 at MITRE.

Its weaknesses: 36

CWE-258, CWE-259, CWE-287, CWE-288, CWE-289, CWE-290, CWE-291, CWE-293, CWE-294, CWE-295, CWE-297, CWE-298, CWE-299, CWE-300, CWE-302, CWE-303, CWE-304, CWE-305, CWE-306, CWE-307, CWE-308, CWE-309, CWE-346, CWE-350, CWE-384, CWE-521, CWE-613, CWE-620, CWE-640, CWE-798, CWE-940, CWE-941, CWE-1390, CWE-1391, CWE-1392, CWE-1393

  1. 7.2CVE-2024-49597EPSS 0.6%

    Dell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of Excessive Authentication Attempts vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading…

  2. 4.9CVE-2024-49595EPSS 0.5%

    Dell Wyse Management Suite, version WMS 4.4 and before, contain an Authentication Bypass by Capture-replay vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of serv…

  3. 5.4CVE-2024-11671EPSS 0.5%

    Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user to bypass the MFA validation via data source switching.

  4. 1.0CVE-2020-12492EPSS 0.2%

    Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information.

  5. 4.8CVE-2020-12491EPSS 0.2%

    Improper control of framework service permissions with possibility of some sensitive device information leakage.

  6. 6.7CVE-2022-33862EPSS 0.2%

    IPP software prior to v1.71 is vulnerable to default credential vulnerability. This could lead attackers to identify and access vulnerable systems.

  7. 5.9CVE-2024-10451EPSS 0.9%

    A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure…

  8. 6.5CVE-2024-35160EPSS 0.4%

    IBM Watson Query on Cloud Pak for Data 1.8, 2.0, 2.1, 2.2 and IBM Db2 Big SQL on Cloud Pak for Data 7.3, 7.4, 7.5, and 7.6 could allow an authenticated user to obtain sensitive information due to insufficient session expiration.

  9. 9.8CVE-2024-10961EPSS 1.2%

    The Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.9.0. This is due to insufficient verification on the user being returned by the social login token. This makes it possible…

  10. 9.3CVE-2024-47138EPSS 0.8%

    The administrative interface listens by default on all interfaces on a TCP port and does not require authentication when being accessed.

  11. 9.2CVE-2024-45369EPSS 0.6%

    The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource.

  12. 6.9CVE-2024-11630EPSS 0.6%

    A vulnerability has been found in E-Lins H685, H685f, H700, H720, H750, H820, H820Q, H820Q0 and H900 up to 3.2 and classified as critical. This vulnerability affects unknown code of the component OEM Backend. The manipulation leads to hard…

  13. 7.5CVE-2024-6248EPSS 1.0%

    Wyze Cam v3 Cloud Infrastructure Improper Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. Authenticatio…

  14. 8.8CVE-2024-5722EPSS 1.1%

    Logsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Logsign Unified SecOps P…

  15. 8.1CVE-2024-5721ExploitEPSS 6.0%

    Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication i…

  16. 8.1CVE-2024-5718EPSS 1.5%

    Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication i…

  17. 9.8CVE-2024-5716EPSS 1.6%

    Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploi…

  18. 9.8CVE-2023-51638EPSS 1.4%

    Allegra Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. T…

  19. 7.5CVE-2023-51634EPSS 0.6%

    NETGEAR RAX30 Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR RAX30 route…

  20. 5.3CVE-2024-51072EPSS 0.2%

    An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to cause a Denial of Service (DoS) via ECU reset UDS service. NOTE: this is disputed by the Supplier because the findings came from a potent…

  21. 9.3CVE-2024-38643EPSS 0.9%

    A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to gain access to and execute certain functions. We have already fixed …

  22. 9.8CVE-2024-21855EPSS 2.0%

    A lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger this vul…

  23. 7.8CVE-2018-9477EPSS 0.09%

    In the development options section of the Settings app, there is a possible authentication bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User inte…

  24. 8.8CVE-2024-52438EPSS 0.5%

    Missing Authentication for Critical Function vulnerability in deco.agency de:branding debranding allows Privilege Escalation.This issue affects de:branding: from n/a through <= 1.0.2.

  25. 8.8CVE-2024-52437EPSS 0.5%

    Missing Authentication for Critical Function vulnerability in Saul Morales Pacheco Banner System banner-system allows Privilege Escalation.This issue affects Banner System: from n/a through <= 1.0.0.

  26. 7.5CVE-2024-11494EPSS 0.7%Unsupported when assigned

    The improper authentication vulnerability in the Zyxel P-6101C ADSL modem firmware version P-6101CSA6AP_20140331 could allow an unauthenticated attacker to read some device information via a crafted HTTP HEAD method.

  27. 9.2CVE-2024-10127EPSS 0.6%

    Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user authentication without a password when the LDAP server itself had the vulnerable co…

  28. 5.3CVE-2024-47865EPSS 0.4%

    Missing authentication for critical function vulnerability exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote unauthenticated attacker may update or downgrade the firmware on the d…

  29. 10.0CVE-2024-42450EPSS 0.6%

    The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Director. The default configuration has a common password across all instances of Vers…

  30. 8.0CVE-2024-52789EPSS 0.4%

    Tenda W30E v2.0 V16.01.0.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.

  31. 8.0CVE-2024-52788EPSS 0.4%

    Tenda W9 v1.0.0.7(4456) was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.

  32. 9.8CVE-2024-47533ExploitEPSS 4.0%

    Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()…

  33. 9.3CVE-2024-0012KEVExploitEPSS 99.7%

    An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with t…

  34. 8.8CVE-2024-41969EPSS 0.5%

    A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full system access and/or DoS.

  35. 5.4CVE-2024-41968EPSS 0.3%

    A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.

  36. 8.1CVE-2024-41967EPSS 0.4%

    A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denial-of-service attack.

  37. 8.8CVE-2024-49060EPSS 0.4%

    Azure Stack HCI Elevation of Privilege Vulnerability

  38. 5.3CVE-2024-51037EPSS 0.3%

    An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function.

  39. 7.5CVE-2024-52510EPSS 0.8%

    The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty ini…

  40. 5.4CVE-2024-52518EPSS 0.5%

    Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the passwor…

  41. 7.5CVE-2024-50654EPSS 1.6%

    lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quantity limit by capturing and sending the data packets for coupon collection in high concurrency.

  42. 7.4CVE-2022-20814EPSS 0.9%

    A vulnerability in the certificate validation of Cisco&nbsp;Expressway-C and Cisco&nbsp;TelePresence VCS could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data.&nbsp;&nbsp;The vulnerability is due to …

  43. 8.1CVE-2023-20154EPSS 0.9%

    A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web interface with administrative privileges. This vulnerability is due to the improper handli…

  44. 8.6CVE-2024-10534EPSS 0.4%

    Origin Validation Error vulnerability in Dataprom Informatics Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS) allows Traffic Injection. This issue affects Personnel Attendance Control Systems (PACS) / …

  45. 5.9CVE-2024-0787EPSS 0.5%

    phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header. The issue lies in the 'get_user_ip()' function in 'class.Common.ph…

  46. 6.8CVE-2021-3740EPSS 0.2%

    A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This can lea…

  47. 8.8CVE-2024-10311EPSS 0.4%

    The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing capability check in the 'edba_admin_handle' function. This makes it possible fo…

  48. 9.8CVE-2024-10924ExploitEPSS 82%

    The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with…

  49. 9.3CVE-2024-48971EPSS 0.2%

    The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventilator and use it to gain unauthorized access to the device, …

  50. 10.0CVE-2024-48966EPSS 0.7%

    The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the tes…