cve.bz

OWASP A07:2025 Authentication Failures vulnerabilities, newest first, page 183

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A07:2025 at MITRE.

Its weaknesses: 36

CWE-258, CWE-259, CWE-287, CWE-288, CWE-289, CWE-290, CWE-291, CWE-293, CWE-294, CWE-295, CWE-297, CWE-298, CWE-299, CWE-300, CWE-302, CWE-303, CWE-304, CWE-305, CWE-306, CWE-307, CWE-308, CWE-309, CWE-346, CWE-350, CWE-384, CWE-521, CWE-613, CWE-620, CWE-640, CWE-798, CWE-940, CWE-941, CWE-1390, CWE-1391, CWE-1392, CWE-1393

  1. 8.7CVE-2024-39874EPSS 0.4%

    A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force protection against user credentials in its Client Communication component. This…

  2. 8.7CVE-2024-39873EPSS 0.4%

    A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force protection against user credentials in its web API. This could allow an attacke…

  3. 8.6CVE-2024-5634EPSS 0.2%

    Longse model LBH30FE200W cameras, as well as products based on this device, make use of telnet passwords which follow a specific pattern. Once the pattern is known, brute-forcing the password becomes relatively easy.  Additionally, every c…

  4. 5.3CVE-2024-5632EPSS 0.2%

    Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, create a WiFi network with a default password. A user is neither advised to change it during the installation process, nor such a need is des…

  5. 5.3CVE-2024-37430EPSS 0.4%

    Authentication Bypass by Spoofing vulnerability in patreon Patreon WordPress patreon-connect.This issue affects Patreon WordPress: from n/a through <= 1.9.0.

  6. 5.3CVE-2024-5810EPSS 0.4%

    The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the i…

  7. 9.1CVE-2024-28751EPSS 0.6%

    An high privileged remote attacker can enable telnet access that accepts hardcoded credentials.

  8. 9.8CVE-2024-28747EPSS 0.7%

    An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges.

  9. 8.8CVE-2024-22062EPSS 0.2%

    There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrator permissions by modifying the configuration.

  10. 8.1CVE-2024-5549EPSS 0.3%

    A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability also enables attack…

  11. 2.3CVE-2024-6580EPSS 0.1%

    The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or certificate. To be exploitable, an application calling the SFTPServer component…

  12. 5.3CVE-2024-39312EPSS 0.3%

    Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates m…

  13. 9.8CVE-2023-46685EPSS 1.0%

    A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specially crafted network packets can lead to arbitrary command execution.

  14. 5.3CVE-2024-6163EPSS 0.5%

    Certain http endpoints of Checkmk in Checkmk < 2.3.0p10 < 2.2.0p31, < 2.1.0p46, <= 2.0.0p39 allows remote attacker to bypass authentication and access data

  15. 4.6CVE-2024-39723EPSS 0.2%

    IBM FlashSystem 5300 USB ports may be usable even if the port has been disabled by the administrator. A user with physical access to the system could use the USB port to cause loss of access to data. IBM X-Force ID: 295935.

  16. 7.5CVE-2024-37767EPSS 0.4%

    Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request.

  17. 8.2CVE-2024-27715EPSS 0.4%

    An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via a crafted request to the Password Change mechanism.

  18. 7.8CVE-2024-36041EPSS 0.3%

    KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to…

  19. 5.9CVE-2024-1573EPSS 0.6%

    Missing Authentication for Critical Function vulnerability in the mobile monitoring feature of Mitsubishi Electric GENESIS64 versions 10.97.2 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.2 and prior, Mitsubishi Electric Hype…

  20. 5.9CVE-2024-39830EPSS 0.4%

    Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled, fail to use constant time comparison for remote cluster tokens which allows an attacker to retrieve the remote cluster…

  21. 9.1CVE-2024-37082EPSS 0.5%

    When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypass mTLS authentication to Cloud Foundry applications.  You are affected if you …

  22. 9.3CVE-2024-4708EPSS 1.0%

    mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.

  23. 8.6CVE-2024-3826EPSS 0.3%

    In versions of Akana in versions prior to and including 2022.1.3 validation is broken when using the SAML Single Sign-On (SSO) functionality.

  24. 7.5CVE-2024-34596EPSS 0.5%

    Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the owner.

  25. 3.3CVE-2024-20900EPSS 0.1%

    Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentication.

  26. 8.8CVE-2024-20890EPSS 0.2%

    Improper input validation in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to trigger abnormal behavior.

  27. 4.3CVE-2024-20889EPSS 0.2%

    Improper authentication in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to pair with devices.

  28. 7.2CVE-2023-41923EPSS 0.3%

    The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords.

  29. 9.8CVE-2023-41920EPSS 0.4%

    The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.

  30. 9.8CVE-2023-41919EPSS 0.4%

    Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access.

  31. 10.0CVE-2023-41918EPSS 0.6%

    A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functi…

  32. 9.8CVE-2024-39309EPSS 20%

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL databas…

  33. 9.1CVE-2024-5322EPSS 0.4%

    The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass. This vulnerability is present in all Entra-supported deployments of N-central prior to …

  34. 9.8CVE-2024-28200ExploitEPSS 1.9%

    The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2. This vulnerability was discovered through internal N-central source code …

  35. 9.8CVE-2024-38513EPSS 0.7%

    Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id valu…

  36. 7.5CVE-2024-36421EPSS 8.5%

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the …

  37. 8.7CVE-2024-4007ExploitEPSS 1.5%

    Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.

  38. 4.0CVE-2024-38480EPSS 0.2%

    "Piccoma" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the API key. Note that the users of the app are not directly affected by this vulnerab…

  39. 9.8CVE-2024-20080EPSS 0.3%

    In gnss service, there is a possible escalation of privilege due to improper certificate validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for explo…

  40. 9.1CVE-2024-39848EPSS 0.4%

    Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways. This is related to internet2.middleware.grouper.ws.security.WsGrouperLdapAuthentication and the use of the UyY29r password for the …

  41. 9.1CVE-2019-25211EPSS 0.4%

    parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and ht…

  42. 5.9CVE-2024-25053EPSS 0.3%

    IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Planning Analytics Data Source Connection. This could allow an attacker to spoof a …

  43. 6.5CVE-2024-25031EPSS 0.2%

    IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute force account credentials. IBM X-Force ID: 281678.

  44. 6.2CVE-2024-35137EPSS 0.3%

    IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 292413.

  45. 3.3CVE-2024-29038EPSS 0.4%

    tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7.

  46. 7.5CVE-2024-39350EPSS 0.7%

    A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality. This allows man-in-the-middle attackers to obtain privileges without consent via unspecified vectors. The following models with Synology Camera…

  47. 10.0CVE-2024-2973EPSS 1.1%

    An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or conductor running with a redundant peer allows a network based attacker to bypass authentication and take full control of…

  48. 9.8CVE-2024-39208EPSS 0.6%

    luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials.

  49. 7.5CVE-2024-38523EPSS 0.5%

    Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security s…

  50. 6.3CVE-2024-31802EPSS 0.3%

    DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code.