CWE-287

An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The FingerprintManager class for B

An authentication bypass vulnerability in the initial boot sequence of Juniper Networks Junos OS on vSRX Series may allo

Teltonika RUT9XX routers with firmware before 00.04.233 provide a root terminal on a serial interface without proper acc

Some Huawei smartphones ALP-AL00B 8.0.0.118D(C00), ALP-TL00B 8.0.0.118D(C01), BLA-AL00B 8.0.0.118D(C00), BLA-L09C 8.0.0.

The Floureon IP Camera SP012 provides a root terminal on a UART serial interface without proper access control. This all

Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices before 4.4.2

The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of ci

A vulnerability in the shell access request mechanism of Cisco IOS XE Software could allow an authenticated, local attac

Authentication Bypass vulnerability in TPM autoboot in McAfee Drive Encryption (MDE) 7.1.0 and above allows physically p

A local, authenticated attacker can bypass the passcode in the VideoLAN VLC media player app before 3.1.5 for iOS by ope

In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authent

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests pro

The search and replay servers in IBM Tealeaf Customer Experience 8.0 through 9.0.2 allow remote attackers to bypass auth

A vulnerability in the 802.1x multiple-authentication (multi-auth) feature of Cisco IOS Software could allow an unauthen

In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when maki

Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain

An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. The impacted products used a single sh

A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having acces

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker

An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of cli

A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowled

An issue was discovered in myStrom WiFi Switch V1 before 2.66, WiFi Switch V2 before 3.80, WiFi Switch EU before 3.80, W

Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's acco

It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos au

ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper cha

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not prope

An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS. The LAContext class for Biometric (TouchID) val

An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The Passcode feature allows authen

An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The LAContext class for Biometric (TouchID)

An unauthenticated root login may allow upon reboot when a commit script is used. A commit script allows a device admini

Huawei smart phones Mate 10 and Mate 10 Pro with earlier versions than 8.0.0.129(SP2C00) and earlier versions than 8.0.0

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertion

An XML parsing vulnerability affects IBM SAML-based single sign-on (SSO) systems (IBM Security Access Manager 9.0.0 - 9.

paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it shou

Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a

IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication (TFA) while resetting a user

HPE StorageWorks XP7 Automation Director (AutoDir) version 8.5.2-02 to earlier than 8.6.1-00 has a local and remote auth

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a kno

The "XML Interface to Messaging, Scheduling, and Signaling" (XIMSS) protocol implementation in CommuniGate Pro (CGP) 6.2

A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link sha

A local authentication bypass vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.

A vulnerability in the FTP server of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attac

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privile

Authentication bypass in the Intel RAID Web Console 3 for Windows before 4.186 may allow an unprivileged user to potenti

Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" comp

NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted acces

A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java,

IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass

A vulnerability has been identified in TeleControl Server Basic < V3.1. An attacker with network access to the TeleContr

An issue was discovered in Extreme Networks ExtremeWireless WiNG 5.x before 5.8.6.9 and 5.9.x before 5.9.1.3. There is N