Fallos del tipo CWE-287

2803 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2020-1718HIGHA flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized accesEPSS 1.0%CVE-2022-30238HIGHA CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacksEPSS 1.0%CVE-2020-16239MEDIUMPhilips SureSigns VS4 Improper AuthenticationEPSS 1.0%CVE-2025-58060HIGHcups has Authentication bypass with AuthType NegotiateEPSS 1.0%CVE-2024-6248HIGHWyze Cam v3 Cloud Infrastructure Improper Authentication Remote Code Execution VulnerabilityEPSS 1.0%CVE-2021-0193HIGHImproper authentication in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enabEPSS 1.0%CVE-2023-1784MEDIUMjeecg-boot API Documentation improper authenticationEPSS 1.0%CVE-2022-22730CRITICALImproper authentication in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an unauthenticated user to poteEPSS 1.0%CVE-2022-3465HIGHMediabridge Medialink index.asp improper authenticationEPSS 1.0%CVE-2022-39257HIGHMatrix iOS SDK vulnerable to impersonation via forwarded Megolm sessionsEPSS 1.0%CVE-2022-39248HIGHmatrix-android-sdk2 vulnerable to Olm/Megolm protocol confusionEPSS 1.0%CVE-2021-39138MEDIUMNew anonymous user session acts as if it's created with passwordEPSS 1.0%CVE-2022-2662CRITICALSequi PortBloque S Improper AuthenticationEPSS 1.0%CVE-2020-10754MEDIUMIt was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when cEPSS 1.0%CVE-2020-3197MEDIUMCisco Meetings App Missing TURN Server Credentials Expiration VulnerabilityEPSS 1.0%CVE-2023-6354MEDIUMTyler Technologies Magistrate Court Case Management Plus PDFViewer.aspx allows authentication bypassEPSS 1.0%CVE-2023-6353MEDIUMTyler Technologies Civil and Criminal Electronic Filing Upload.aspx allows authentication bypassEPSS 1.0%CVE-2021-28174MEDIUMMitake Smart Stock Selection System - Broken AuthenticationEPSS 1.0%CVE-2026-75429CRITICALPowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the SeEPSS 1.0%CVE-2023-7210HIGHOneNav API improper authenticationEPSS 1.0%