Fallos del tipo CWE-287

2781 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2022-42458CRITICALAuthentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticatEPSS 1.1%CVE-2023-1778CRITICALDefault Credential Vulnerability in GajShield Data Security FirewallEPSS 1.1%CVE-2023-25601—Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authenticationEPSS 1.1%CVE-2022-38119CRITICALPOWERCOM CO., LTD. UPSMON PRO - Broken AuthenticationEPSS 1.1%CVE-2025-4268MEDIUMTOTOLINK A720R cstecgi.cgi missing authenticationEPSS 1.1%CVE-2020-10916HIGHThis vulnerability allows network-adjacent attackers to escalate privileges on affected installations of TP-Link TL-WA855RE Firmware Ver: 85EPSS 1.1%CVE-2024-34340CRITICALAuthentication Bypass when using using older password hashesEPSS 1.1%CVE-2023-44302HIGH Dell DM5500 5.14.0.0 and prior contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploiEPSS 1.1%CVE-2021-3046MEDIUMPAN-OS: Improper SAML Authentication Vulnerability in GlobalProtect PortalEPSS 1.1%CVE-2022-39366CRITICALDataHub missing JWT signature checkEPSS 1.1%CVE-2019-18906CRITICALcryptctl: client side password hashing is equivalent to clear text password storageEPSS 1.1%CVE-2021-3827—A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behaviEPSS 1.1%CVE-2019-14880MEDIUMA vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not EPSS 1.1%CVE-2023-52161HIGHThe Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthEPSS 1.1%CVE-2022-36092HIGHXWiki Platform Old Core vulnerable to Authentication Bypass Using the Login ActionEPSS 1.1%CVE-2018-0435—Cisco Umbrella API Unauthorized Access VulnerabilityEPSS 1.1%CVE-2023-29032HIGHApache OpenMeetings: allows bypass authenticationEPSS 1.1%CVE-2025-11942MEDIUM70mai X200 Pairing missing authenticationEPSS 1.1%CVE-2021-41126HIGHDeleted Admin Can Sign In to Admin InterfaceEPSS 1.1%CVE-2020-16098CRITICALIt is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8EPSS 1.1%