CWE-592 DEPRECATED: Authentication Bypass Issues
classThis weakness has been deprecated because it covered redundant concepts already described in CWE-287.
01
vulnerabilities (47)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-10933US | critical9.1 | Exploit | ||
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, r… | ||||
| CVE-2015-7871US | critical9.8 | Exploit | ||
Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication. | ||||
| CVE-2016-8371US | high7.3 | Exploit | ||
The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled. | ||||
| CVE-2016-4510US | critical9.1 | — | ||
The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and read arbitrary files via unspecified vect… | ||||
| CVE-2019-1006US | high7.5 | Exploit | ||
An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary symmet… | ||||
| CVE-2013-5946US | high10.0 | — | ||
The runShellCmd function in systemCheck.htm in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44… | ||||
| CVE-2018-14643US | critical9.8 | — | ||
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machi… | ||||
| CVE-2013-6920US | high10.0 | — | ||
Siemens SINAMICS S/G controllers with firmware before 4.6.11 do not require authentication for FTP and TELNET sessions, which allows remote attackers to bypass intended access rest… | ||||
| CVE-2013-5944US | high10.0 | — | ||
The integrated web server on Siemens SCALANCE X-200 switches with firmware before 4.5.0 and X-200IRT switches with firmware before 5.1.0 does not properly enforce authentication re… | ||||
| CVE-2014-5432US | critical9.8 | — | ||
Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 is remotely accessible via Port 22/SSH without authentication. A r… | ||||
| CVE-2017-3143US | medium5.9 | Exploit | ||
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be ab… | ||||
| CVE-2018-1085US | critical9.8 | — | ||
openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the value… | ||||
| CVE-2015-7938US | critical9.8 | — | ||
Advantech EKI-132x devices with firmware before 2015-12-31 allow remote attackers to bypass authentication via unspecified vectors. | ||||
| CVE-2019-14910US | critical9.8 | — | ||
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case… | ||||
| CVE-2019-3899US | critical9.8OT elevated | — | ||
It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as ship… | ||||
| CVE-2017-2684US | critical9.0 | — | ||
Siemens SIMATIC Logon prior to V1.5 SP3 Update 2 could allow an attacker with knowledge of a valid user name, and physical or network access to the affected system, to bypass the a… | ||||
| CVE-2017-5152US | critical9.1 | — | ||
An issue was discovered in Advantech WebAccess Version 8.1. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access pages unres… | ||||
| CVE-2018-10847US | high8.8 | — | ||
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same acro… | ||||
| CVE-2023-34274US | high8.8 | — | ||
D-Link DIR-2150 LoginPassword Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypa… | ||||
| CVE-2019-14843US | high8.8OT elevated | — | ||
A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app… | ||||
02
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan