Fallos del tipo CWE-287

2431 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2024-23647MEDIUMPKCE downgrade attack in AuthentikEPSS 0.5%CVE-2024-45823CRITICALFactoryTalk® Batch View™ Authentication Bypass Vulnerability via shared secretsEPSS 0.5%CVE-2023-47222CRITICALMedia Streaming add-onEPSS 0.5%CVE-2022-26508MEDIUMImproper authentication in the Intel(R) SDP Tool before version 3.0.0 may allow an unauthenticated user to potentially enable information diEPSS 0.5%CVE-2023-23857CRITICALImproper Access Control in SAP NetWeaver AS for JavaEPSS 0.5%CVE-2026-2991HIGHKiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login TokenEPSS 0.5%CVE-2026-18786HIGHCheckView < 2.3.2 - Administrator Account Creation via REST API Authentication BypassEPSS 0.5%CVE-2024-41199HIGHAn issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to AdministratorEPSS 0.5%CVE-2025-30361CRITICALWeGIA Vulnerable to Broken Authentication - Old Password ValidationEPSS 0.5%CVE-2026-50623MEDIUMApache CXF: Authentication Bypass in OAuth2 TokenIntrospectionServiceEPSS 0.5%CVE-2026-56080MEDIUMCap-go - Authentication Logic Flaw in Enforce Password PolicyEPSS 0.5%CVE-2024-41798CRITICALA vulnerability has been identified in SENTRON 7KM PAC3200 (All versions). Affected devices only provide a 4-digit PIN to protect from adminEPSS 0.5%CVE-2026-50365HIGHRemote Access Management service/API (RPC server) Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-11529MEDIUMChurchCRM API Endpoint AuthMiddleware.php AuthMiddleware missing authenticationEPSS 0.5%CVE-2026-64665HIGHStatamic: Account takeover via OAuth email matching without email-verification checkEPSS 0.5%CVE-2024-56336CRITICALA vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FSEPSS 0.5%CVE-2025-30116HIGHAn issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Remotely Dumping of Video Footage and the Live Video Stream can oEPSS 0.5%CVE-2026-73054HIGHSiYuan before v3.7.4 Authentication Bypass via WebSocketEPSS 0.5%CVE-2024-10114HIGHSocial Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth providerEPSS 0.5%CVE-2025-6533MEDIUMxxyopen/201206030 novel-plus CATCHA LoginController.java ajaxLogin authentication replayEPSS 0.5%