CWE-287— Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.— MITRE CWE catalog

4,931 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-287page 46 of 99

CVE-2020-7297MEDIUMCVSS 5.7EG 5.7
2020-09-16
Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via improper access control in the user interface.
CVE-2020-7323MEDIUMCVSS 6.9EG 6.9
2020-09-09
Authentication Protection Bypass vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows physical local users to bypass the Windows lock screen via triggering certain detection events while …
CVE-2020-7378CRITICALCVSS 9.1EG 9.1
2020-11-24
CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standa…
CVE-2020-7533CRITICALCVSS 9.8EG 9.8
2020-12-01
CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.
CVE-2020-7591HIGHCVSS 8.8EG 8.8
2020-10-15
A vulnerability has been identified in SIPORT MP (All versions < 3.2.1). Vulnerable versions of the device could allow an authenticated attacker to impersonate other users of the system and perform (potentially administrative) actions on b…
CVE-2020-7787HIGHCVSS 8.2EG 8.2
2020-12-09
This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-gen…
CVE-2020-7856HIGHCVSS 7.5EG 7.5
2021-04-20
A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient authentication validation.
CVE-2020-7968HIGHCVSS 7.5EG 7.5
2020-02-05
GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.
CVE-2020-7995CRITICALCVSS 9.8EG 9.8
2020-01-26
The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.
CVE-2020-8097HIGHCVSS 8.1EG 8.1
2020-08-30
An improper authentication vulnerability in Bitdefender Endpoint Security Tools for Windows and Bitdefender Endpoint Security SDK allows an unprivileged local attacker to escalate privileges or tamper with the product's security settings. …
CVE-2020-8108HIGHCVSS 8.2EG 8.2
2020-08-03
Improper Authentication vulnerability in Bitdefender Endpoint Security for Mac allows an unprivileged process to restart the main service and potentially inject third-party code into a trusted process. This issue affects: Bitdefender Endpo…
CVE-2020-8148MEDIUMCVSS 5.3EG 5.3
2020-04-13
UniFi Cloud Key firmware < 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request. This affects Cloud Key gen2 and Cloud Key gen2 Plus.
CVE-2020-8193CRITICALCVSS 6.5EG 9.0⚠ KEV
2020-07-10
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to cer…
CVE-2020-8196CRITICALCVSS 4.3EG 9.0⚠ KEV
2020-07-10
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information dis…
CVE-2020-8200MEDIUMCVSS 6.5EG 6.5
2020-09-18
Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domain as a Citrix StoreFront server to read arbitrary files from that server.
CVE-2020-8206HIGHCVSS 8.1EG 8.1
2020-07-30
An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP.
CVE-2020-8207HIGHCVSS 8.8EG 8.8
2020-07-24
Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the automatic updater service is running.
CVE-2020-8236MEDIUMCVSS 6.8EG 6.8
2020-11-02
A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it.
CVE-2020-8253HIGHCVSS 7.5EG 7.5
2020-09-18
Improper authentication in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Citrix XenMobile Server before 10.9 RP5 leads to the ability to access sensitive fi…
CVE-2020-8267MEDIUMCVSS 5.3EG 5.3
2020-11-05
A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was using “x-token” improperly, allowing attackers to use the API to send authenticated messages without…
CVE-2020-8272HIGHCVSS 7.5EG 7.5
2020-11-16
Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8
CVE-2020-8350HIGHCVSS 8.8EG 8.8
2020-10-14
An authentication bypass vulnerability was reported in Lenovo ThinkPad Stack Wireless Router firmware version 1.1.3.4 that could allow escalation of privilege.
CVE-2020-8465CRITICALCVSS 9.8EG 9.8
2020-12-17
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combination of CSRF bypass (CVE-2020-8461) and authentication bypass (CVE-2020-8464) to execute co…
CVE-2020-8510CRITICALCVSS 9.8EG 9.8
2020-02-03
An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en (user+perms+lang), one can login as any user without a password.
CVE-2020-8591CRITICALCVSS 9.8EG 9.8
2020-02-03
eG Manager 7.1.2 allows authentication bypass via a com.egurkha.EgLoginServlet?uname=admin&upass=&accessKey=eGm0n1t0r request.
CVE-2020-8595HIGHCVSS 7.3EG 7.3
2020-02-12
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configur…
CVE-2020-8606CRITICALCVSS 9.8EG 9.8
2020-05-27
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance.
CVE-2020-8664MEDIUMCVSS 5.3EG 5.3
2020-03-04
CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static…
CVE-2020-8685MEDIUMCVSS 4.4EG 4.4
2020-08-13
Improper authentication in subsystem for Intel (R) LED Manager for NUC before version 1.2.3 may allow privileged user to potentially enable denial of service via local access.
CVE-2020-8708HIGHCVSS 8.8EG 8.8
2020-08-13
Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
CVE-2020-8709HIGHCVSS 8.8EG 8.8
2020-08-13
Improper authentication in socket services for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
CVE-2020-8713HIGHCVSS 8.8EG 8.8
2020-08-13
Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
CVE-2020-8714HIGHCVSS 7.8EG 7.8
2020-08-13
Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2020-8771CRITICALCVSS 9.8EG 9.8
2020-02-06
The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.
CVE-2020-8828HIGHCVSS 8.8EG 8.8
2020-04-08
As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the m…
CVE-2020-8861HIGHCVSS 8.8EG 8.8
2020-02-22
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders. Authentication is not required to exploit this vulnerability. The specific flaw …
CVE-2020-8862HIGHCVSS 8.8EG 8.8
2020-02-22
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists …
CVE-2020-8863CRITICALCVSS 8.8EG 9.0
2020-03-23
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. Th…
CVE-2020-8953CRITICALCVSS 9.8EG 9.8
2020-02-13
OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication).
CVE-2020-8994MEDIUMCVSS 6.8EG 6.8
2020-03-05
An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. Attackers can get root shell by accessing the UART interface and then they can read Wi-Fi SSID or password, read the dialogue text files between users and XIAOMI …
CVE-2020-9049HIGHCVSS 7.1EG 7.1
2020-11-19
A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an…
CVE-2020-9064MEDIUMCVSS 5.5EG 5.5
2020-03-12
Huawei smartphone Honor V30 with versions earlier than OxfordS-AN00A 10.0.1.167(C00E166R4P1) have an improper authentication vulnerability. Authentication to target component is improper when device performs an operation. Attackers exploit…
CVE-2020-9066HIGHCVSS 7.8EG 7.8
2020-03-26
Huawei smartphones OxfordP-AN10B with versions earlier than 10.0.1.169(C00E166R4P1) have an improper authentication vulnerability. The Application doesn't perform proper authentication when user performs certain operations. An attacker can…
CVE-2020-9068CRITICALCVSS 9.8EG 9.8
2020-04-27
Huawei AR3200 products with versions of V200R007C00SPC900, V200R007C00SPCa00, V200R007C00SPCb00, V200R007C00SPCc00, V200R009C00SPC500 have an improper authentication vulnerability. Attackers need to perform some operations to exploit the v…
CVE-2020-9070MEDIUMCVSS 5.5EG 5.5
2020-04-20
Huawei smartphones Taurus-AL00B with versions earlier than 10.0.0.205(C00E201R7P2) have an improper authentication vulnerability. The software insufficiently validate the user's identity when a user wants to do certain operation. An attack…
CVE-2020-9073LOWCVSS 2.4EG 2.4
2020-05-15
Huawei P20 smartphones with versions earlier than 10.0.0.156(C00E156R1P4) have an improper authentication vulnerability. The vulnerability is due to that when an user wants to do certain operation, the software insufficiently validate the …
CVE-2020-9076MEDIUMCVSS 6.8EG 6.8
2020-06-15
HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B smartphones with versions earlier than 10.1.0.135(C00E135R2P11); versions earlier than 10.1.0.135(C00E135R2P8), versions earlier than 10.1.0.135 have an improper authentication vulnerability. Due to the…
CVE-2020-9077LOWCVSS 3.3EG 3.3
2020-07-27
HUAWEI P30 smart phones with versions earlier than 10.1.0.160(C00E160R2P11) have an information exposure vulnerability. The system does not properly authenticate the application that access a specified interface. Attackers can trick users …
CVE-2020-9099CRITICALCVSS 9.8EG 9.8
2020-06-08
Huawei products IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospace USG6300; Secospace USG6500; Secospace USG6600; USG9500 with versions of V500R001C00; V500R001C20; V500R001C30; V500R001C50; V500R001C60; V500R001C80; V500R005C00…
CVE-2020-9109MEDIUMCVSS 4.6EG 4.6
2020-10-12
There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the vic…

Map vulnerabilities like CWE-287 to your infrastructure

EchelonGraph correlates every CVE — across CWE-287 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →