CWE-287

A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and p

AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session cont

/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote atta

Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed crede

An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, a

The web interface of Alcatel LINKZONE MW40-V-V1.0 MW40_LU_02.00_02 devices is vulnerable to an authentication bypass tha

eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco

A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco

The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.

A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker ca

In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application.

Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in t

SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 de

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved

The dbell Wi-Fi Smart Video Doorbell DB01-S Gen 1 allows remote attackers to launch commands with no authentication veri

The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454

Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected

TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechani

Undocumented TELNET service in TRENDnet TEW-691GR and TEW-692GR when a web page named backdoor contains an HTML paramete

An Authentication Bypass vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34 in http://<router_ip>/apply.

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypa

In all versions of ABB Power Generation Information Manager (PGIM) and Plant Connect, the affected product is vulnerable

BIG-IP configurations using Active Directory, LDAP, or Client Certificate LDAP for management authentication with multip

Anviz access control devices allow unverified password change which allows remote attackers to change the administrator

libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiu

A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used in

Monkey HTTP Daemon: broken user name authentication

A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The AdminSe

A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker

A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker

A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (C

python-requests-Kerberos through 0.5 does not handle mutual authentication

D-Link DIR-601 B1 2.00NA devices are vulnerable to authentication bypass. They do not check for authentication at the se

An authentication bypass exists in the web management interface in Belkin F5D8236-4 v2.

Belkin N900 router (F9K1104v1) contains an Authentication Bypass using "Javascript debugging".

Magnolia CMS before 4.5.9 has multiple access bypass vulnerabilities

Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials

AVTECH AVN801 DVR has a security bypass via the administration login captcha

beegfs-ctl in ThinkParQ BeeGFS through 7.1.3 allows Authentication Bypass via communication with a BeeGFS metadata serve

An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a re

An Incorrect Access Control vulnerability has been identified in Citrix XenMobile Server 10.8.0 before Rolling Patch 6 a

A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remot

Forcepoint Next Generation Firewall (Forcepoint NGFW) 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has

Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ direct

Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the man

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Through an undocumented sequence of