Skip to content
Noroxi

CWE-592 · 21 records

DEPRECATED: Authentication Bypass Issues

CVEs in this class

21 records

  • CVE-2018-10933
    64This week

    A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4.

    CriticalCVSS 9.1WeaponizedEPSS 91%

    libssh · libsshOct 17, 2018

  • CVE-2018-14643
    41Plan

    An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman.

    CriticalCVSS 9.8No exploitEPSS 6%

    theforeman · foremanSep 21, 2018

  • CVE-2014-5432
    40Plan

    Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 is remotely accessible via

    CriticalCVSS 9.8No exploitEPSS 2%

    baxter · sigma spectrum infusion system firmwareMar 26, 2019

  • CVE-2018-1085
    40Plan

    openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to

    CriticalCVSS 9.8No exploitEPSS 2%

    redhat · openshift container platformJun 15, 2018

  • CVE-2019-3899
    39Monitor

    It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misus

    CriticalCVSS 9.8No exploitEPSS 1%

    redhat · openshift container platformApr 22, 2019

  • CVE-2026-43512
    39Monitor

    Apache Tomcat: Digest authenticator will authenticate any unknown user

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    apache · tomcatMay 12, 2026

  • CVE-2017-2684
    37Monitor

    Siemens SIMATIC Logon prior to V1.5 SP3 Update 2 could allow an attacker with knowledge of a valid user name, and physical or network access

    CriticalCVSS 9.0No exploitEPSS 1%

    siemens · simatic logonFeb 21, 2017

  • CVE-2018-10847
    35Monitor

    prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass.

    HighCVSS 8.8No exploitEPSS 1%

    prosody · prosodyJul 30, 2018

  • CVE-2019-14843
    35Monitor

    A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester.

    HighCVSS 8.8No exploitEPSS 1%

    redhat · single sign-onJan 7, 2020

  • CVE-2017-2650
    34Monitor

    It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM comm

    HighCVSS 8.5No exploitEPSS 1%

    jenkins · pipeline classpath stepJul 27, 2018

  • CVE-2016-8371
    32Monitor

    The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled.

    HighCVSS 7.3Proof of conceptEPSS 10%

    phoenixcontact · ilc plcs firmwareApr 5, 2018

  • CVE-2019-10201
    32Monitor

    It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures.

    HighCVSS 8.1No exploitEPSS 0%

    redhat · keycloakAug 14, 2019

  • CVE-2012-4688
    30Monitor

    I-GEN opLYNX Central Authentication Bypass

    HighCVSS 7.5No exploitEPSS 1%

    i-gen · oplynxDec 31, 2012

  • CVE-2017-7537
    30Monitor

    It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package befor

    HighCVSS 7.5No exploitEPSS 1%

    redhat · enterprise linux desktopJul 26, 2018

  • CVE-2017-7536
    28Monitor

    In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, whi

    HighCVSS 7.0No exploitEPSS 0%

    redhat · hibernate validatorJan 10, 2018

  • CVE-2023-30971
    27Monitor

    Gaia unauthenticated endpoints

    MediumCVSS 6.8No exploitEPSS 0%

    palantir · com.palantir.acme.gaia:gaiaDec 19, 2025

  • CVE-2019-10198
    26Monitor

    An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7.

    MediumCVSS 6.5No exploitEPSS 1%

    theforeman · foreman-tasksJul 31, 2019

  • CVE-2017-12164
    25Monitor

    A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin.

    MediumCVSS 6.4No exploitEPSS 0%

    gnome · gnome display managerJul 26, 2018

  • CVE-2024-42759
    25Monitor

    An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint.

    MediumCVSS 6.3No exploitEPSS 0%

    ellevo · ellevoSep 9, 2024

  • CVE-2016-8616
    24Monitor

    A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and pass

    MediumCVSS 5.9No exploitEPSS 3%

    haxx · curlAug 1, 2018

  • CVE-2014-2367
    17Monitor

    Advantech WebAccess Authentication Bypass Issues

    MediumCVSS 4.3No exploitEPSS 1%

    advantech · advantech webaccessJul 19, 2014

All vulnerability classes