Weak Authentication

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

CVEs (89)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-36787 1Netgear 1Wnr614 Firmware Jun 17, 2026 Jun 7, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 An issue in Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 allows attackers to bypass authentication and access the administrative interface via unspecified vectors.
CVE-2024-29837 1Cs Technologies 1Evolution Jun 17, 2026 Apr 15, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already s...Show more The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in.Show less
CVE-2023-49340 - - Jun 17, 2026 Mar 9, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to escalate privileges and bypass authentication via incorrect access control in the web management...Show more An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to escalate privileges and bypass authentication via incorrect access control in the web management portal.Show less
CVE-2024-0822 1Ovirt 1Ovirt Engine Jun 17, 2026 Jan 25, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command.
CVE-2023-4094 1Fujitsu 1Arconte Aurea Jun 17, 2026 Sep 19, 2023 N/A· v4 8.2 HIGH· v3 N/A· v2 ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate account and cause a denial of service. In addition, a resource ha...Show more ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate account and cause a denial of service. In addition, a resource has been identified that could allow circumventing the attempt limit set in the login form.Show less
CVE-2023-41900 2Debian Eclipse 2Debian Linux Jetty Jun 17, 2026 Sep 15, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, a...Show more Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.Show less
CVE-2022-45860 1Fortinet 2Fortinac Fortinac F Jun 17, 2026 May 3, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow a...Show more A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated attacker to perform password spraying attacks with an increased chance of success.Show less
CVE-2023-24890 1Microsoft 1Onedrive Jun 17, 2026 Mar 14, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Microsoft OneDrive for iOS Security Feature Bypass Vulnerability
CVE-2022-43400 1Siemens 1Siveillance Video Mobile Server Jun 17, 2026 Oct 21, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 (All versions < V22.2a (80)). The mobile server component of affected applications improperly handles the log in for Active Directory accoun...Show more A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 (All versions < V22.2a (80)). The mobile server component of affected applications improperly handles the log in for Active Directory accounts that are part of Administrators group. This could allow an unauthenticated remote attacker to access the application without a valid account.Show less

Previous 1 2 3 45