CWE-287

BIOTRONIK CardioMessenger II, The affected products allow credential reuse for multiple authentication purposes. An atta

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14

When OTRS uses multiple backends for user authentication (with LDAP), agents are able to login even if the account is se

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except on

In Philips Ultrasound ClearVue Versions 3.2 and prior, Ultrasound CX Versions 5.0.2 and prior, Ultrasound EPIQ/Affiniti

Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user t

An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (released in China or India) software.

HUAWEI P30 smart phones with versions earlier than 10.1.0.160(C00E160R2P11) have an information exposure vulnerability.

Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked th

Huawei P20 smartphones with versions earlier than 10.0.0.156(C00E156R1P4) have an improper authentication vulnerability.

Honor 9X smartphones with versions earlier than 9.1.1.172(C00E170R8P1) have an improper authentication vulnerability. A

An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communicat

A vulnerability in the REST API of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attack

A vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software could allow an unauthenticated

On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the v

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are

D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* b

INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the p

INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the p

In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, a logic e

Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication

WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication

PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) may allow an attacker to be able t

An Authentication Bypass issue exists in Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versi

License Manager Service of YOKOGAWA products (CENTUM VP (R5.01.00 - R6.06.00), CENTUM VP Entry Class (R5.01.00 - R6.06.0

An issue was discovered on D-Link DIR-878 1.12B01 devices. At the /HNAP1 URI, an attacker can log in with a blank passwo

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This cou

Kentix MultiSensor-LAN 5.63.00 devices and previous allow Authentication Bypass via an Alternate Path or Channel.

An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM33

Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 is rem

On Grandstream GXV3611IR_HD before 1.0.3.23 devices, the root account lacks a password.

EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the Networker C

Detcon Sitewatch Gateway, all versions without cellular, Passwords are presented in plaintext in a file that is accessib

Hanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000_v2.16_170401, A specially crafted http request and

application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-bas

Contao 4.7 allows Use of a Key Past its Expiration Date.

FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a si

A default username and password in Dentsply Sirona Sidexis 4.3.1 and earlier allows an attacker to gain administrative a

Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, t

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 anyone can change the administrator and moderator

A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quant

A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 wh

Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authen

Improper authentication can happen on Remote command handling due to inappropriate handling of events in Snapdragon Auto

The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious command

Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue

In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing app

A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than versio

EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information (Password) without being authenticated,

The Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 allows login with root level access with the user "