Fallos del tipo CWE-287

2806 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2023-6344MEDIUMTyler Technologies Court Case Management Plus use of Aquaforest TIFF Server te003.aspx and te004.aspx allows authentication bypassEPSS 0.9%CVE-2020-11101CRITICALSierra Wireless AirLink Mobility Manager (AMM) before 2.17 mishandles sessions and thus an unauthenticated attacker can obtain a login sessiEPSS 0.9%CVE-2021-28495HIGHIn Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authenticatEPSS 0.9%CVE-2026-26077MEDIUMDiscourse doesn't ensure webhooks require a tokenEPSS 0.9%CVE-2021-44056HIGHImproper authentication in Video StationEPSS 0.9%CVE-2021-44057HIGHImproper authentication in Photo StationEPSS 0.9%CVE-2022-23555CRITICALauthentik vulnerable to Improper Authentication via invitation URL token reuseEPSS 0.9%CVE-2026-32173HIGHAzure SRE Agent Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-1202MEDIUMCRMEB LoginController.php appleLogin improper authenticationEPSS 0.9%CVE-2025-2771MEDIUMBEC Technologies Multiple Routers Authentication Bypass VulnerabilityEPSS 0.9%CVE-2026-62825CRITICALAzure Key Vault Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2022-44620HIGHImproper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote aEPSS 0.9%CVE-2026-17142CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.9%CVE-2021-37172—A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (V4.5.0). Affected devices fail to authenticate agEPSS 0.9%CVE-2024-6057CRITICALImproper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that EPSS 0.9%CVE-2023-22334MEDIUMUse of password hash instead of password for authentication vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remotEPSS 0.9%CVE-2023-20214CRITICALA vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, rEPSS 0.9%CVE-2026-75816CRITICALFrontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object IdentifierEPSS 0.9%CVE-2023-34388MEDIUMImproper authentication could lead to session hijackingEPSS 0.9%CVE-2022-3173MEDIUMImproper Authentication in snipe/snipe-itEPSS 0.9%