CWE-305

Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Bire

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family database

Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Byp

OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middlewa

Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl a

Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge beca

Authentication bypass vulnerability in the device authentication module. Impact: Successful exploitation of this vulnera

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoint

A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain con

Authentication bypass in Brocade ASCG 3.4.0 Could allow an unauthorized user to perform ASCG operations related to Broca

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is config

Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. Se

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when

A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external

An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6

ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication m

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based o

In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/ent

Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0

A vulnerability in the secure configuration of authentication and management services in Brocade Fabric OS before Fabri

A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >= V1.7.6 < V1.15.17), Industrial

A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality o

Authentication bypass by primary weakness vulnerability in ABB Freelance. This issue affects Freelance: through 2013, 2

libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS r

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses diffe

Pachno 1.0.6 contains an open redirection vulnerability that allows attackers to redirect users to arbitrary external we

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon

A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a spec

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4 fail to verify whether a guest account is deactivated before crea

A vulnerability in the authentication service feature of Cisco AsyncOS Software for Cisco Secure Web Appliance could all

Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attack

Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows Exploitation of

IBM MQ 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.40 LTS, 9.3.0.0 through 9.3.0.36 LTS, 9.30.0 through 9.3.5.1

Cryptomator is an open-source client-side encryption application for cloud storage. Version 1.19.1 contains a logic flaw

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth autho

Authentication Bypass by Primary Weakness vulnerability in Jamf Jamf Pro allows unspecified impact.This issue affects Ja

A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may g

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint va

The SafeLine SL6 and SL6+ devices integrated into elevator emergency intercom systems are vulnerable to an authenticatio

Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key v

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access.

A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service i

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under sp