Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CVEs (5,234)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-14147 1Fiberhome 1Adsl An1020 25 Firmware May 13, 2026 Sep 7, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a router to its factory settings by simply browsing to the link http://[Default-Router-...Show more An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a router to its factory settings by simply browsing to the link http://[Default-Router-IP]/restoreinfo.cgi & execute it. Due to improper authentication on this page, the software accepts the request hence allowing attacker to reset the router to its default configurations which later could allow attacker to login to router by using default username/password.Show less
CVE-2015-3442 1Soreco 1Xpert.line May 13, 2026 Sep 7, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call.
CVE-2017-14117 1Att 1U Verse Firmware May 13, 2026 Sep 3, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to esta...Show more The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending \x2a\xce\x01 followed by other predictable values.Show less
CVE-2015-7746 1Netapp 1Data Ontap May 13, 2026 Sep 1, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 NetApp Data ONTAP before 8.2.4, when operating in 7-Mode, allows remote attackers to bypass authentication and (1) obtain sensitive information from or (2) modify volumes via vectors related to UTF-8 in the volume langua...Show more NetApp Data ONTAP before 8.2.4, when operating in 7-Mode, allows remote attackers to bypass authentication and (1) obtain sensitive information from or (2) modify volumes via vectors related to UTF-8 in the volume language.Show less
CVE-2017-14032 2Arm Trustedfirmware 2Mbed Tls Mbed Tls Jun 5, 2026 Aug 30, 2017 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed...Show more ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.Show less
CVE-2017-12698 1Advantech 1Webaccess May 13, 2026 Aug 30, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Specially crafted requests allow a possible authentication bypass that could allow remote code execution.
CVE-2015-8332 1Huawei 2Vcm5010 Firmware Vcm5020 Firmware May 13, 2026 Aug 28, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote authenticated users to gain privileges and perform a case operati...Show more Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote authenticated users to gain privileges and perform a case operation as another user via a crafted message, aka "Horizontal Privilege Escalation Vulnerability."Show less
CVE-2015-1401 1Ldap / Sso Authentication Project 1Ldap / Sso Authentication May 13, 2026 Aug 28, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3.
CVE-2017-7934 1Osisoft 1Pi Data Archive May 13, 2026 Aug 25, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017. PI Network Manager using older protocol versions contains a flaw that could allow a malicious user to auth...Show more An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017. PI Network Manager using older protocol versions contains a flaw that could allow a malicious user to authenticate with a server and then cause PI Network Manager to behave in an undefined manner.Show less
CVE-2017-7930 1Osisoft 1Pi Data Archive May 13, 2026 Aug 25, 2017 N/A· v4 7.4 HIGH· v3 5.8 MEDIUM· v2 An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017. PI Data Archive has protocol flaws with the potential to expose change records in the clear and allow a ma...Show more An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017. PI Data Archive has protocol flaws with the potential to expose change records in the clear and allow a malicious party to spoof a server within a collective.Show less
CVE-2015-3206 1Apple 1Pykerberos May 13, 2026 Aug 25, 2017 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by...Show more The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack.Show less
CVE-2014-7860 1D Link 2Dns 320l Firmware Dns 327l Firmware May 13, 2026 Aug 25, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows remote attackers to obtain arbitrary photos and publish them to...Show more The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows remote attackers to obtain arbitrary photos and publish them to an arbitrary Facebook profile via a target album_id and access_token.Show less
CVE-2014-7858 1D Link 1Dnr 326 Firmware May 13, 2026 Aug 25, 2017 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the username cookie parameter to an arbitrary string.
CVE-2014-7857 1D Link 7Dnr 326 Firmware Dns 320b FirmwareDns 320l Firmware+4 more May 13, 2026 Aug 25, 2017 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2.00b07 allow remote attackers to bypass authentication and lo...Show more D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2.00b07 allow remote attackers to bypass authentication and log in with administrator permissions by passing the cgi_set_wto command in the cmd parameter, and setting the spawned session's cookie to username=admin.Show less
CVE-2015-8308 1Lxdm Project 1Lxdm May 13, 2026 Aug 24, 2017 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections.
CVE-2016-4460 1Apache 1Pony Mail May 13, 2026 Aug 22, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Apache Pony Mail 0.6c through 0.8b allows remote attackers to bypass authentication.
CVE-2016-2102 1Haproxy 1Haproxy May 13, 2026 Aug 22, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network.
CVE-2017-7557 1Powerdns 1Dnsdist May 13, 2026 Aug 22, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
CVE-2017-7420 1Microfocus 3Enterprise Developer Enterprise ServerEnterprise Server Monitor And Control May 13, 2026 Aug 21, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Updat...Show more An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter configuration information and alter the state of the running product (CWE-275).Show less
CVE-2015-4464 1Kguardsecurity 2Kg Sha104 Firmware Kg Sha108 Firmware May 13, 2026 Aug 18, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Kguard Digital Video Recorder 104, 108, v2 does not have any authorization or authentication between an ActiveX client and the application server.

Previous 1...203204205...262 Next