The Disaster Recovery (DRA) feature on the Cisco ISB8320-E High-Definition IP-Only DVR allows remote attackers to bypass authentication by establishing a TELNET session during a recovery boot, aka Bug ID CSCup85422.

CVE-2014-8033NONECVSS 0.0EG 0.0

2015-01-09

The play/modules component in Cisco WebEx Meetings Server allows remote attackers to obtain administrator access via crafted API requests, aka Bug ID CSCuj40421.

CVE-2014-8329NONECVSS 0.0EG 0.0

2014-10-20

Schrack Technik microControl with firmware before 1.7.0 (937) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain access data for the ftp and telnet services via a direc…

CVE-2014-8347HIGHCVSS 7.8EG 7.8

2020-02-11

An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 and Filemaker Pro Advanced 12.04, which could let a malicious user obtain elevated privileges.

CVE-2014-8424NONECVSS 0.0EG 0.0

2014-11-28

ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication.

CVE-2014-8472NONECVSS 0.0EG 0.0

2014-11-04

CA Cloud Service Management (CSM) before Summer 2014 does not properly verify authentication tokens from an Identity Provider, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors.

CVE-2014-8522NONECVSS 0.0EG 0.0

2014-10-29

The MySQL database in McAfee Network Data Loss Prevention (NDLP) before 9.3 does not require a password, which makes it easier for remote attackers to obtain access.

CVE-2014-8650CRITICALCVSS 9.8EG 9.8

2019-12-15

python-requests-Kerberos through 0.5 does not handle mutual authentication

CVE-2014-8763NONECVSS 0.0EG 0.0

2014-10-22

DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0) character and a valid user name, which triggers an unauthenticated …

CVE-2014-8764NONECVSS 0.0EG 0.0

2014-10-22

DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null (\0) character, which triggers an anonymous bind.

CVE-2014-8896NONECVSS 0.0EG 0.0

2014-12-22

The Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4…

CVE-2014-9043NONECVSS 0.0EG 0.0

2015-02-04

The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which tri…

CVE-2014-9045NONECVSS 0.0EG 0.0

2015-02-04

The FTP backend in user_external in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted password.

CVE-2014-9184NONECVSS 0.0EG 0.0

2014-12-02

ZTE ZXDSL 831CII allows remote attackers to bypass authentication via a direct request to (1) main.cgi, (2) adminpasswd.cgi, (3) userpasswd.cgi, (4) upload.cgi, (5) conprocess.cgi, or (6) connect.cgi.

CVE-2014-9217NONECVSS 0.0EG 0.0

2014-12-08

Graylog2 before 0.92 allows remote attackers to bypass LDAP authentication via crafted wildcards.

CVE-2014-9278NONECVSS 0.0EG 0.0

2014-12-06

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which migh…

CVE-2014-9320CRITICALCVSS 9.8EG 9.8

2021-08-09

SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and consequently gain SYSTEM privileges via vectors involving CORBA calls, aka SAP Note 2039905.

CVE-2014-9578NONECVSS 0.0EG 0.0

2015-01-08

VDG Security SENSE (formerly DIVA) 2.3.13 performs authentication with a password hash instead of a password, which allows remote attackers to gain login access by leveraging knowledge of a password hash.

CVE-2014-9753CRITICALCVSS 9.8EG 9.8

2020-02-11

confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter.

CVE-2015-0102HIGHCVSS 8.1EG 8.1

2020-02-05

IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

CVE-2015-0198NONECVSS 0.0EG 0.0

2015-03-24

IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 in certain cipherList configurations allows remote attackers to bypass authentication and execute arbitrary programs as root via unspe…

CVE-2015-0607NONECVSS 0.0EG 0.0

2015-03-06

The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt…

CVE-2015-0653NONECVSS 0.0EG 0.0

2015-03-13

The management interface in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X7.2.4, X8 before X8.1.2, and X8.2 before X8.2.2 and Cisco TelePresence Conductor before X2.3.1 and XC2.4 before XC2.4.1 allows rem…

CVE-2015-0670NONECVSS 0.0EG 0.0

2015-03-21

The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML re…

CVE-2015-10083MEDIUMCVSS 6.3EG 9.8

2023-02-21

A vulnerability has been found in harrystech Dynosaur-Rails and classified as critical. Affected by this vulnerability is the function basic_auth of the file app/controllers/application_controller.rb. The manipulation leads to improper aut…

CVE-2015-1187CRITICALCVSS 9.8EG 9.8⚠ KEV

2017-09-21

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.

CVE-2015-2033NONECVSS 0.0EG 0.0

2015-02-20

Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request.

CVE-2015-2047NONECVSS 0.0EG 0.0

2015-02-23

The rsaauth extension in TYPO3 4.3.0 through 4.3.14, 4.4.0 through 4.4.15, 4.5.0 through 4.5.39, and 4.6.0 through 4.6.18, when configured for the frontend, allows remote attackers to bypass authentication via a password that is casted to …

CVE-2015-4987MEDIUMCVSS 6.5EG 6.5

2018-03-27

The search and replay servers in IBM Tealeaf Customer Experience 8.0 through 9.0.2 allow remote attackers to bypass authentication via unspecified vectors. IBM X-Force ID: 105896.

CVE-2015-5298MEDIUMCVSS 6.5EG 6.5

2022-07-07

The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modif…

CVE-2015-6922CRITICALCVSS 9.8EG 9.8

2020-02-17

Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an…

CVE-2015-6926HIGHCVSS 7.5EG 7.5

2018-01-19

The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token.

CVE-2015-7755CRITICALCVSS 9.8EG 9.8⚠ KEV

2015-12-19

Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r…

CVE-2015-7882HIGHCVSS 8.1EG 8.1

2019-07-19

Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access.

CVE-2016-0796HIGHCVSS 7.5EG 7.5

2022-07-28

WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities because it fails to properly verify user-supplied input. An attacke…

CVE-2016-10394HIGHCVSS 8.4EG 8.4

2024-11-26

Initial xbl_sec revision does not have all the debug policy features and critical checks.

CVE-2016-10434HIGHCVSS 7.5EG 7.5

2018-04-18

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 820 and SD 820A, the input to RPMB write response function is a buffer from HLOS that needs to be authenticated (using …

CVE-2016-10525CRITICALCVSS 9.8EG 9.8

2018-05-29

When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication.

CVE-2016-10532CRITICALCVSS 9.8EG 9.8

2018-05-31

console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier i…

CVE-2016-10732CRITICALCVSS 9.8EG 9.8

2018-10-29

ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.

CVE-2016-10826HIGHCVSS 8.8EG 8.8

2019-08-01

cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93).

CVE-2016-10831HIGHCVSS 7.2EG 7.2

2019-08-01

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).

CVE-2016-10832MEDIUMCVSS 6.5EG 6.5

2019-08-01

cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).

CVE-2016-10833HIGHCVSS 7.5EG 7.5

2019-08-01

cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104).

CVE-2016-10835MEDIUMCVSS 4.3EG 4.3

2019-08-01

cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107).

CVE-2016-10836MEDIUMCVSS 6.5EG 6.5

2019-08-01

cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108).

CVE-2016-10983MEDIUMCVSS 6.5EG 6.5

2019-09-17

The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.

CVE-2016-11041MEDIUMCVSS 4.6EG 4.6

2020-04-07

An issue was discovered on Samsung mobile devices with KK(4.4) software. Attackers can bypass the lockscreen by sending an AT command over USB. The Samsung ID is SVE-2015-5301 (June 2016).

CVE-2016-11042HIGHCVSS 7.5EG 7.5

2020-04-07

An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. There is a SIM Lock bypass. The Samsung ID is SVE-2016-5381 (June 2016).

CVE-2016-11057HIGHCVSS 7.5EG 7.5

2020-04-28

Certain NETGEAR devices are affected by mishandling of repeated URL calls. This affects JNR1010v2 before 2017-01-06, WNR614 before 2017-01-06, WNR618 before 2017-01-06, JWNR2000v5 before 2017-01-06, WNR2020 before 2017-01-06, JWNR2010v5 be…

CWE-287— Improper Authentication

CVEs classified under CWE-287page 20 of 87

Map vulnerabilities like CWE-287 to your infrastructure