CWE-287

An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An at

Authentication bypass vulnerability in mod_nss 1.0.8 allows remote attackers to assume the identity of a valid user by u

A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controller

A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series ve

PAM exposure enabling unauthenticated access to remote host

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which

The Password Manager Extension in Abine Blur 7.8.242* before 7.8.2428 allows attackers to bypass the Multi-Factor Authen

curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015

The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed befo

Unsecured way of firmware update in Hanwha Techwin Smartcams

Authentication bypass in Hanwha Techwin Smartcams

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x

Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name

It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, w

A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordP

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not r

GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions are affected these devices use default or

GE GEMNet License server (EchoServer) all current versions are affected these devices use default or hard-coded credenti

GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use d

GE Centricity PACS RA1000, diagnostic image analysis, all current versions are affected these devices use default or har

Unauthentication vulnerabilities have been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-21

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent repl

An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Versi

Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light i

In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does not

A vulnerability has been identified in TIM 1531 IRC (All versions < V1.1). A remote attacker with network access to port

In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile, Snapdragon Automobile APQ8096AU, MDM9206, MD

Western Digital WD My Cloud v04.05.00-320 devices embed the session token (aka PHPSESSID) in filenames, which makes it e

X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canonic

FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header.

FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass by ignoring the parent.location='login.html' JavaScr

The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated

A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormB

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming

An authorization bypass vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC,

An issue was discovered in phpLiteAdmin 1.9.5 through 1.9.7.1. Due to loose comparison with '==' instead of '===' in cla

Meross MSS110 devices through 1.1.24 contain an unauthenticated admin.htm administrative interface.

An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images

An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TC

An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm referenc

A vulnerability in the API gateway of the Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated

A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B0

When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby peo

console-io is a module that allows users to implement a web console in their application. A malicious user could bypass

An issue was discovered on Canon LBP6650, LBP3370, LBP3460, and LBP7750C devices. It is possible to bypass the Administr

A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN

Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior ma

In ABB IP GATEWAY 3.39 and prior, by accessing a specific uniform resource locator (URL) on the web server, a malicious

A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenti

A vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthe