697
Reference Description
https://www.cve.org/CVERecord?id=CVE-2022-30317
CVE-2022-33139 SCADA system only uses client-side authentication, allowing adversaries to
impersonate other users.
https://www.cve.org/CVERecord?id=CVE-2022-33139
CVE-2021-3116 Chain: Python-based HTTP Proxy server uses the wrong boolean operators
(CWE-480) causing an incorrect comparison (CWE-697) that identifies an
authN failure if all three conditions are met instead of only one, allowing
bypass of the proxy authentication (CWE-1390)
https://www.cve.org/CVERecord?id=CVE-2021-3116
CVE-2021-21972 Chain: Cloud computing virtualization platform does not require authentication
for upload of a tar format file (CWE-306), then uses .. path traversal sequences
(CWE-23) in the file to access unexpected files, as exploited in the wild per
CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-21972
CVE-2021-37415 IT management product does not perform authentication for some REST API
requests, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-37415
CVE-2021-35033 Firmware for a WiFi router uses a hard-coded password for a BusyBox shell,
allowing bypass of authentication through the UART port
https://www.cve.org/CVERecord?id=CVE-2021-35033
CVE-2020-10263 Bluetooth speaker does not require authentication for the debug functionality
on the UART port, allowing root shell access
https://www.cve.org/CVERecord?id=CVE-2020-10263
CVE-2020-13927 Default setting in workflow management product allows all API requests
without authentication, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-13927
CVE-2021-35395 Stack-based buffer overflows in SFK for wifi chipset used for IoT/embedded
devices, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-35395
CVE-2021-34523 Mail server does not properly check an access token before executing a
Powershell command, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-34523
CVE-2020-12812 Chain: user is not prompted for a second authentication factor (CWE-287)
when changing the case of their username (CWE-178), as exploited in the wild
per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-12812
CVE-2020-10148 Authentication bypass by appending specific parameters and values to a URI,
as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-10148
CVE-2020-0688 Mail server does not generate a unique key during installation, as exploited in
the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-0688
CVE-2017-14623 LDAP Go package allows authentication bypass using an empty password,
causing an unauthenticated LDAP bind
https://www.cve.org/CVERecord?id=CVE-2017-14623
CVE-2009-3421 login script for guestbook allows bypassing authentication by setting a
"login_ok" parameter to 1.
https://www.cve.org/CVERecord?id=CVE-2009-3421
CVE-2009-2382 admin script allows authentication bypass by setting a cookie value to
"LOGGEDIN".
https://www.cve.org/CVERecord?id=CVE-2009-2382
CVE-2009-1048 VOIP product allows authentication bypass using 127.0.0.1 in the Host header.
https://www.cve.org/CVERecord?id=CVE-2009-1048
CWE Version 4.14
CWE-287: Improper Authentication
CWE-287: Improper Authentication