Fallos del tipo CWE-287

2853 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2018-1106—An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signeEPSS 0.4%CVE-2018-16877HIGHA flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attackerEPSS 0.4%CVE-2024-0879MEDIUMAuthentication bypass in vector-admin domain restrictionEPSS 0.4%CVE-2024-39830HIGHTiming attack during remote cluster token comparison when shared channels are enabledEPSS 0.4%CVE-2026-30831HIGHRocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamerEPSS 0.4%CVE-2024-6078HIGHRockwell Automation Authentication Bypass Vulnerability in DataMosaix™EPSS 0.4%CVE-2023-4985MEDIUMSupcon InPlant SCADA Project.xml improper authenticationEPSS 0.4%CVE-2026-56312MEDIUMCapgo - Account Creation Before CAPTCHA Validation in accept_invitation EndpointEPSS 0.4%CVE-2020-3388HIGHCisco SD-WAN vManage Software Command Injection VulnerabilityEPSS 0.4%CVE-2026-95718MEDIUMAuthentication Bypass Vulnerability in the PAPI Protocol of AOS-8EPSS 0.4%CVE-2022-20662MEDIUMCisco Duo for macOS Authentication Bypass VulnerabilityEPSS 0.4%CVE-2026-19273MEDIUMThe Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Improper Access ControlEPSS 0.4%CVE-2026-95676HIGHAuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication BypassEPSS 0.4%CVE-2025-67791CRITICALAn issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent aEPSS 0.4%CVE-2024-23251MEDIUMAn authentication issue was addressed with improved state management. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadEPSS 0.4%CVE-2026-61739HIGHSOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)EPSS 0.4%CVE-2025-6524LOW70mai 1S Video Services improper authenticationEPSS 0.4%CVE-2026-12526HIGHAdvanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update ActionEPSS 0.4%CVE-2023-51511MEDIUMWordPress Booster Elite for WooCommerce plugin < 7.1.3 - Authenticated Production Creation/Modification VulnerabilityEPSS 0.4%CVE-2024-5201HIGHDimensions RM - Privilege EscalationEPSS 0.4%