CWE-287

Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API c

An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to ea

The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow

An authentication bypass vulnerability on UTStar WA3002G4 ADSL Broadband Modem WA3002G4-0021.01 devices allows attackers

Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via

The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote att

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr

Authentication bypass vulnerability in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allows attac

DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf

A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 could allow an

A vulnerability in the implementation of the Locator/ID Separation Protocol (LISP) in Cisco IOS XE 3.2 through 16.5 coul

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.

Remote manipulations with language pack updater lead to NTLM-relay attack for system user in Gemalto's HASP SRM, Sentine

The IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) default authentication protocol is vulnerable to a bru

An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01

The doFilter method in UrlAccessController in HPE Intelligent Management Center (iMC) PLAT 7.2 E0403P06 allows remote by

An Improper Authentication issue was discovered in JanTek JTC-200, all versions. The improper authentication could provi

An authentication bypass vulnerability in Juniper Networks Junos Space Network Management Platform may allow a remote un

Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal r

Xpress Server in SAP POS does not require authentication for read/write/delete file access. This is SAP Security Note 25

The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior

Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to some authentication meth

An exploitable vulnerability exists in the generation of authentication token functionality of Circle with Disney. Speci

The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers

In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.

A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System softw

On Jooan IP Camera A5 2.3.36 devices, an insecure FTP server does not require authentication, which allows remote attack

An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1

Missing authentication for the remote configuration port 1236/tcp on the Cohu 3960HD allows an attacker to change config

VCM5010 with software versions earlier before V100R002C50SPC100 has an authentication bypass vulnerability. This is due

EMC RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Ser

Improper authentication issue in PTW-WMS1 firmware version 2.000.012 allows remote attackers to log in to the device wit

Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote attackers to execute arbitrary commands vi

SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, and 4.30, does not perform authentica

An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquer

Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the admi

puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a databas

The RPC service in Tripwire (formerly nCircle) IP360 VnE Manager 7.2.2 before 7.2.6 allows remote attackers to bypass au

The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary comman

An Improper Authentication issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWas

An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11.

An issue was discovered in WAGO 750-8202/PFC200 prior to FW04 (released August 2015), WAGO 750-881 prior to FW09 (releas

An issue was discovered in Advantech WebAccess Version 8.1. By accessing a specific uniform resource locator (URL) on th

forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit, which might allow remote attackers to cause a denial of service

A vulnerability in the Ultra Automation Service (UAS) of the Cisco Ultra Services Framework could allow an unauthenticat

Session hijack vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W

A vulnerability in the mesh code of Cisco Wireless LAN Controller (WLC) software could allow an unauthenticated, remote

Siemens RUGGEDCOM ROX I (all versions) allow an authenticated user to bypass access restrictions in the web interface at

TRENDnet WiFi Baby Cam TV-IP743SIC has a password of admin for the backdoor root account.

An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes/