CWE-287

Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote

An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. FTP does not require authentication or auth

A vulnerability in the Cisco Umbrella API could allow an authenticated, remote attacker to view and modify data across t

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul

openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificat

An Improper Authentication issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Suc

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enter

A vulnerability has been identified in TeleControl Server Basic < V3.1. An authenticated attacker with a low-privileged

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impe

West Wind Web Server 6.x does not require authentication for /ADMIN.ASP.

Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a passwor

NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privil

A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API author

Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application

VMware Horizon DaaS (7.x before 8.0.0) contains a broken authentication vulnerability that may allow an attacker to bypa

The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an aut

IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IBM

Huawei iBMC V200R002C60 have an authentication bypass vulnerability. A remote attacker with low privilege may craft spec

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The OBD port is used to receive measurement data and

The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability.

There is an authentication bypass vulnerability in some Huawei servers. A remote attacker with low privilege may bypass

An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute

TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to var

Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, is vulnerable to an authentication

It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 fo

Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentia

SAP SRM MDM Catalog versions 3.73, 7.31, 7.32 in (SAP NetWeaver 7.3) - import functionality does not perform authenticat

IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monit

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to

Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email addres

It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison o

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which

BMC Remedy AR System before 9.1 SP3, when Remedy AR Authentication is enabled, allows attackers to obtain administrative

The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in

A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once

The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge o

The ActiveMQ admin user interface in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow

D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext.

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing chec

A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can d

An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, W

In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available

BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authent

Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate

The time-based one-time-password (TOTP) function in the application logic of the Green Electronics RainMachine Mini-8 (2

A vulnerability has been identified in SIMATIC IT LMS (All versions), SIMATIC IT Production Suite (Versions V7.1 < V7.1

Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-

An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/rem

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenti

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentica