← Back
CWE-287

4,504 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

JSON object

Loading...

CVEs (4,504)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-40874
2Debian
Lemonldap Ng
2Debian Linux
Lemonldap\
Jun 17, 2026
Jul 18, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST password validation service (for another LemonLDAP::NG instance, for example) and using the Kerberos...Show more
An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST password validation service (for another LemonLDAP::NG instance, for example) and using the Kerberos authentication method combined with another method with the Combination authentication plug-in, any password will be recognized as valid for an existing user.Show less
CVE-2022-30550
2Debian
Dovecot
2Debian Linux
Dovecot
Jun 17, 2026
Jul 17, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can...Show more
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.Show less
CVE-2022-2133
1Miniorange
1Oauth Single Sign On
Jun 17, 2026
Jul 17, 2022
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.
CVE-2017-20133
1Itechscripts
1Job Portal Script
Nov 21, 2024
Jul 16, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
A vulnerability, which was classified as critical, was found in Itech Job Portal Script 9.13. This affects an unknown part of the file /admin. The manipulation leads to improper authentication. It is possible to initiate...Show more
A vulnerability, which was classified as critical, was found in Itech Job Portal Script 9.13. This affects an unknown part of the file /admin. The manipulation leads to improper authentication. It is possible to initiate the attack remotely.Show less
CVE-2022-33689
1Google
1Android
Jun 17, 2026
Jul 12, 2022
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
Improper access control vulnerability in TelephonyUI prior to SMR Jul-2022 Release 1 allows attackers to change preferred network type by unprotected binder call.
CVE-2022-30755
1Google
1Android
Jun 17, 2026
Jul 12, 2022
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Improper authentication vulnerability in AppLock prior to SMR Jul-2022 Release 1 allows attacker to bypass password confirm activity by hijacking the implicit intent.
CVE-2022-33736
1Siemens
1Opcenter Quality
Jun 17, 2026
Jul 12, 2022
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
A vulnerability has been identified in Opcenter Quality V13.1 (All versions < V13.1.20220624), Opcenter Quality V13.2 (All versions < V13.2.20220624). The affected applications do not properly validate login information...Show more
A vulnerability has been identified in Opcenter Quality V13.1 (All versions < V13.1.20220624), Opcenter Quality V13.2 (All versions < V13.2.20220624). The affected applications do not properly validate login information during authentication. This could lead to denial of service condition for existing users or allow unauthenticated remote attackers to successfully login without credentials.Show less
CVE-2022-2302
1Lenze
3C520 Firmware
C550 FirmwareC750 Firmware
Jun 17, 2026
Jul 11, 2022
N/A· v4
9.8 CRITICAL· v3
9.3 HIGH· v2
Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote attacker can get full access without knowledge of the password.
CVE-2015-5298
1Jenkins
1Google Login
Nov 21, 2024
Jul 7, 2022
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client...Show more
The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification.Show less
CVE-2022-31131
1Nextcloud
1Nextcloud Mail
Jun 17, 2026
Jul 6, 2022
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Att...Show more
Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have been exposed to incorrect system users. It is recommended that the Nextcloud Mail app is upgraded to 1.12.2. There are no known workarounds for this issue. ### Workarounds No workaround available ### References * [Pull request](https://github.com/nextcloud/mail/pull/6600) * [HackerOne](https://hackerone.com/reports/1579820) ### For more information If you have any questions or comments about this advisory: * Create a post in [nextcloud/security-advisories](https://github.com/nextcloud/security-advisories/discussions) * Customers: Open a support ticket at [support.nextcloud.com](https://support.nextcloud.com)Show less
CVE-2022-31125
1Roxy Wi
1Roxy Wi
Jun 17, 2026
Jul 6, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to bypass authentication and access admin functiona...Show more
Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to bypass authentication and access admin functionality by sending a specially crafted HTTP request. This affects Roxywi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.Show less
CVE-2021-43116
1Alibaba
1Nacos
Jun 17, 2026
Jul 5, 2022
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.
CVE-2022-28713
1Cybozu
1Garoon
Jun 17, 2026
Jul 4, 2022
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information without logging in to the product.
CVE-2021-41995
1Pingidentity
1Pingid Integration For Mac Login
Jun 17, 2026
Jun 30, 2022
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.
CVE-2022-2197
1Exemys
1Rme1 Firmware
Jun 17, 2026
Jun 30, 2022
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
By using a specific credential string, an attacker with network access to the device’s web interface could circumvent the authentication scheme and perform administrative operations.
CVE-2022-1955
1Opft
1Session
Jun 17, 2026
Jun 30, 2022
N/A· v4
4.6 MEDIUM· v3
2.1 LOW· v2
Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynam...Show more
Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation.Show less
CVE-2021-41506
1Xiongmaitech
8Ahb7008t Mh V2 Firmware
Ahb7804r Els FirmwareAhb7804r Lms Firmware+5 more
Jun 17, 2026
Jun 30, 2022
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onv...Show more
Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205, V4.02.R11.Nat.20170301, V4.02.R12.Nat.OnvifS.20170727 is affected by a backdoor in the macGuarder and dvrHelper binaries of DVR/NVR/IP camera firmware due to static root account credentials in the system.Show less
CVE-2022-29858
1Silverstripe
1Assets
Jun 17, 2026
Jun 28, 2022
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changing an existing image short code on website content.
CVE-2022-33202
1Softcreate
1L2blocker
Jun 17, 2026
Jun 27, 2022
N/A· v4
8.1 HIGH· v3
4.8 MEDIUM· v2
Authentication bypass vulnerability in the setup screen of L2Blocker(on-premise) Ver4.8.5 and earlier and L2Blocker(Cloud) Ver4.8.5 and earlier allows an adjacent attacker to perform an unauthorized login and obtain the...Show more
Authentication bypass vulnerability in the setup screen of L2Blocker(on-premise) Ver4.8.5 and earlier and L2Blocker(Cloud) Ver4.8.5 and earlier allows an adjacent attacker to perform an unauthorized login and obtain the stored information or cause a malfunction of the device by using alternative paths or channels for Sensor.Show less
CVE-2022-29578
1Meridian
1Meridian
Jun 17, 2026
Jun 24, 2022
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address, and daily energy usage.