CWE-287
5,228 CVEs • Abstraction: Class • Likelihood of Exploit: High
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVEs (5,228)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
6Gatehouse HarrisHughes Network Systems+3 more99201 94509502+6 moreApr 29, 2026 Feb 4, 2014 N/A· v4 N/A· v3 10.0 HIGH· v2 The firmware on GateHouse; Harris BGAN RF-7800B-VU204 and BGAN RF-7800B-DU204; Hughes Network Systems 9201, 9450, and 9502; Inmarsat; Japan Radio JUE-250 and JUE-500; and Thuraya IP satellite terminals does not require a...Show more |
cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request. |
2Brion Vibber Mediawiki2Centralauth Extension MediawikiApr 29, 2026 Jan 26, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 The CentralAuth extension for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 caches a valid CentralAuthUser object in the centralauth_User cookie even when a user has not successfully logg...Show more |
The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by setting the burden_user_rememberme cookie to 1. |
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirect...Show more |
1Cisco 1Video Surveillance Operations Manager Apr 29, 2026 Jan 24, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Cisco Video Surveillance Operations Manager (VSOM) does not require authentication for MySQL database connections, which allows remote attackers to obtain sensitive information, modify data, or cause a denial of service...Show more |
1Ibm 1Tivoli Federated Identity Manager Apr 29, 2026 Jan 21, 2014 N/A· v4 N/A· v3 2.1 LOW· v2 The Risk Based Access functionality in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.2 before FP9 does not prevent reuse of One Time Pas...Show more |
3Debian GoogleOpensuse3Chrome Debian LinuxOpensuseApr 29, 2026 Jan 16, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 The OneClickSigninBubbleView::WindowClosing function in browser/ui/views/sync/one_click_signin_bubble_view.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows attackers...Show more |
1Sierrawireless 19Airlink Mp At&t Airlink Mp At&t WifiAirlink Mp Bell+16 moreApr 29, 2026 Jan 15, 2014 N/A· v4 N/A· v3 10.0 HIGH· v2 The Sierra Wireless AirLink Raven X EV-DO gateway 4221_4.0.11.003 and 4228_4.0.11.003 allows remote attackers to reprogram the firmware via a replay attack using UDP ports 17336 and 17388. |
memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials. |
1Vasco 1Identikey Authentication Server Apr 29, 2026 Jan 13, 2014 N/A· v4 N/A· v3 3.5 LOW· v2 VASCO IDENTIKEY Authentication Server (IAS) 3.4.x allows remote authenticated users to bypass Active Directory (AD) authentication by entering only a DIGIPASS one-time password, instead of the intended combination of thi...Show more |
The Management Console in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4 and 12.x before 12.1.2 RU2 and Endpoint Protection Small Business Edition 12.x before 12.1.2 RU2 does not properly perform authentication,...Show more |
1Nisuta 4Ns Wir150ne Ns Wir150ne FirmwareNs Wir300n+1 moreApr 29, 2026 Jan 10, 2014 N/A· v4 N/A· v3 10.0 HIGH· v2 The management web interface on the Nisuta NS-WIR150NE router with firmware 5.07.41 and Nisuta NS-WIR300N router with firmware 5.07.36_NIS01 allows remote attackers to bypass authentication via a "Cookie: :language=en" H...Show more |
1Hot 2Hotbox Router Hotbox Router FirmwareApr 29, 2026 Dec 30, 2013 N/A· v4 N/A· v3 5.8 MEDIUM· v2 The HOT HOTBOX router with software 2.1.11 allows remote attackers to bypass authentication by configuring a source IP address that had previously been used for an authenticated session. |
Cybozu Garoon 3.5 through 3.7 SP2 allows remote attackers to bypass Keitai authentication via a modified user ID in a request. |
The VTY authentication implementation in Cisco IOS XE 03.02.xxSE and 03.03.xxSE incorrectly relies on the Linux-IOS internal-network configuration, which allows remote attackers to bypass authentication by leveraging acc...Show more |
3Debian FedoraprojectPhil Schwartz3Debian Linux DenyhostsFedoraApr 29, 2026 Dec 23, 2013 N/A· v4 N/A· v3 5.0 MEDIUM· v2 denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which allows remote attackers to cause a denial of service (incorrect block of IP addresses) via crafted login names. |
Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors. |
1Ibm 2Sterling B2b Integrator Sterling File GatewayApr 29, 2026 Dec 21, 2013 N/A· v4 N/A· v3 4.3 MEDIUM· v2 IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not invalidate a session upon a logout action, which allows remote attackers to bypass authentication by leveraging an unattended workstation. |
1Ibm 2Infosphere Master Data Management Collaboration Server Infosphere Master Data Management Server For Product Information ManagementApr 29, 2026 Dec 19, 2013 N/A· v4 N/A· v3 4.9 MEDIUM· v2 Session fixation vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1 IF5 and 11.0 before IF1 and InfoSphere Master Data Management Server for Product Information Management 9.x...Show more |