CWE-287
4,511 CVEs • Abstraction: Class • Likelihood of Exploit: High
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVEs (4,511)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Dahuasecurity 19Ipc Hum7xxx Firmware Ipc Hx3xxx FirmwareIpc Hx5xxx Firmware+16 moreJun 17, 2026 Sep 15, 2021 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. |
SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowing his/her password. The attacker could so obtain highly sens...Show more |
Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbit...Show more |
In Ionic Identity Vault before 5, a local root attacker on an Android device can bypass biometric authentication. |
1Zohocorp 1Manageengine Desktop Central Jun 17, 2026 Sep 10, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication. |
Improper scheme check vulnerability in Samsung Internet prior to version 15.0.2.47 allows attackers to perform Man-in-the-middle attack and obtain Samsung Account token. |
A PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI data. |
In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system. |
1Arista 1Metamako Operating System Jun 17, 2026 Sep 9, 2021 N/A· v4 9.8 CRITICAL· v3 6.8 MEDIUM· v2 In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authentication can be bypassed when API access is enabled via the JSON-RPC APIs. This issue...Show more |
1Arista 1Metamako Operating System Jun 17, 2026 Sep 9, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication is bypassed by unprivileged users who are accessing the Web UI. This issue affect...Show more |
1Arista 1Metamako Operating System Jun 17, 2026 Sep 9, 2021 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, a user may be able to execute commands despite not having the privileges to do so. This issue af...Show more |
1Cisco 1Broadworks Commpilot Application Software Jun 17, 2026 Sep 9, 2021 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or gain elevated privileges on an affected system. |
1Cisco 1Broadworks Commpilot Application Software Jun 17, 2026 Sep 9, 2021 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or gain elevated privileges on an affected system. |
1Google 1Chrome Os Readiness Tool Jun 17, 2026 Sep 8, 2021 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Inappropriate implementation in the ChromeOS Readiness Tool installer on Windows prior to 1.0.2.0 loosens DCOM access rights on two objects allowing an attacker to potentially bypass discretionary access controls. |
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A person with physical access to a Mac may be abl...Show more |
This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.4. A person with physical access to a Mac may be able to bypass Login Window during a software update. |
A logic issue was addressed with improved validation. This issue is fixed in iOS 14.6 and iPadOS 14.6. An attacker in WiFi range may be able to force a client to use a less secure authentication mechanism. |
An issue existed with authenticating the action triggered by an NFC tag. The issue was addressed with improved action authentication. This issue is fixed in iOS 14.5 and iPadOS 14.5. A person with physical access to an i...Show more |
A logic issue was addressed with improved validation. This issue is fixed in iOS 14.7, tvOS 14.7, watchOS 7.6. An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations. |
A logic issue was addressed with improved state management. This issue is fixed in iOS 14.7, tvOS 14.7, watchOS 7.6. A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authenticat...Show more |