CWE-592 · Authentication
21CVEs
SortMost likely exploited
21 CVEs with CWE-592 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2018-10933A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication,…Libssh · libssh · CVSS 9.1 · 2018-10-17 | 9.1 | 92% | 2018-10-17 |
| CVE-2016-8371The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled.Phoenix Contact · Phoenix Contact ILC PLCs · 2018-04-05 | – | 11% | 2018-04-05 |
| CVE-2018-14643An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on mach…Theforeman · smart_proxy_dynflow · CVSS 9.8 · 2018-09-21 | 9.8 | 6.2% | 2018-09-21 |
| CVE-2016-8616A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. Thi…The Curl Project · curl · CVSS 3.7 · 2018-08-01 | 3.7 | 3.5% | 2018-08-01 |
| CVE-2014-5432Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 is remotely accessible via Port 22/SSH without authentication. A…Baxter · SIGMA Spectrum Infusion System · 2019-03-26 | – | 2.6% | 2019-03-26 |
| CVE-2018-1085openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the valu…Redhat · openshift-ansible · CVSS 9 · 2018-06-15 | 9.0 | 2.3% | 2018-06-15 |
| CVE-2017-2684Siemens SIMATIC Logon prior to V1.5 SP3 Update 2 could allow an attacker with knowledge of a valid user name, and physical or network access to the affected system, to bypass the…Siemens · SIMATIC Logon All versions < V1.5 SP3 Update 2 · 2017-02-22 | – | 2.0% | 2017-02-22 |
| CVE-2012-4688I-GEN opLYNX Central Authentication Bypassi-GEN Solutions Corporation · opLYNX · CVSS 7.5 · 2012-12-31 | 7.5 | 1.6% | 2012-12-31 |
| CVE-2019-10198An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which performed authorization c…The Foreman Project · foreman-tasks · CVSS 6.5 · 2019-07-31 | 6.5 | 1.6% | 2019-07-31 |
| CVE-2018-10847prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same acr…Prosody · prosody · CVSS 4.2 · 2018-07-30 | 4.2 | 1.6% | 2018-07-30 |
| CVE-2014-2367Advantech WebAccess Authentication Bypass IssuesAdvantech · WebAccess · CVSS 7.5 · 2014-07-19 | 7.5 | 1.5% | 2014-07-19 |
| CVE-2017-7537It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially…Dogtag PKI · pki-core · CVSS 5.9 · 2018-07-26 | 5.9 | 1.5% | 2018-07-26 |
| CVE-2019-3899It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as shi…The Heketi Project · heketi · CVSS 7.3 · 2019-04-22 | 7.3 | 1.4% | 2019-04-22 |
| CVE-2026-43512Apache Tomcat: Digest authenticator will authenticate any unknown userApache Software Foundation · Apache Tomcat · CVSS 9.8 · 2026-05-12 | 9.8 | 1.3% | 2026-05-12 |
| CVE-2019-14843A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app…Red Hat · wildfly-security-manager · CVSS 7.5 · 2020-01-07 | 7.5 | 1.2% | 2020-01-07 |
| CVE-2017-2650It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commit access, as well as users with e.g. J…Jenkins project · Pipeline: Classpath Step Jenkins plugin · 2018-07-27 | – | 1.1% | 2018-07-27 |
| CVE-2019-10201It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> se…Red Hat · keycloak · CVSS 8.1 · 2019-08-14 | 8.1 | 0.7% | 2019-08-14 |
| CVE-2017-7536In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private memb…Red Hat, Inc. · hibernate-validator · 2018-01-10 | – | 0.5% | 2018-01-10 |
| CVE-2017-12164A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If autologin was enabled for a victim, an attacker could simply…GNOME · gdm · CVSS 4.1 · 2018-07-26 | 4.1 | 0.4% | 2018-07-26 |
| CVE-2024-42759An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint.Ellevo · Ellevo · CVSS 6.3 · 2024-09-09 | 6.3 | 0.4% | 2024-09-09 |
| CVE-2024-38884An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform an Authentication Bypass attac…Horizoncloud · Caterease · CVSS 7.8 · 2024-08-02 | 7.8 | 0.2% | 2024-08-02 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.