Fallos del tipo CWE-287

2853 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2026-91495CRITICALVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are EPSS 0.5%CVE-2022-24885LOWImproper Authentication in Nextcloud Android FilesEPSS 0.5%CVE-2026-91220CRITICALVulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow). Supported veEPSS 0.5%CVE-2025-5437MEDIUMMultilaser Sirius RE016 Password Change cstecgi.cgi improper authenticationEPSS 0.5%CVE-2026-91234CRITICALVulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected aEPSS 0.5%CVE-2026-91236CRITICALVulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected aEPSS 0.5%CVE-2026-91214CRITICALVulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected aEPSS 0.5%CVE-2026-91235CRITICALVulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected aEPSS 0.5%CVE-2026-50191HIGH4gaBoards: Pre-Account Takeover via SSO Email LinkageEPSS 0.5%CVE-2026-111639HIGHbbs-go through 4.4.6 Account Takeover via Google One Tap LoginEPSS 0.5%CVE-2024-25618MEDIUMExternal OpenID Connect Account Takeover by E-Mail Change in mastodonEPSS 0.5%CVE-2026-83397CRITICALVulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). Supported versiEPSS 0.5%CVE-2026-91233CRITICALVulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Supported versions thaEPSS 0.5%CVE-2026-104732CRITICALAdvanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login HandlerEPSS 0.5%CVE-2026-83396CRITICALVulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). Supported versiEPSS 0.5%CVE-2025-13427MEDIUMAuthentication Bypass in Dialogflow CX MessengerEPSS 0.5%CVE-2025-0637CRITICALInadequate access control in Beta10EPSS 0.5%CVE-2024-45346HIGHGetApps application has code execution vulnerabilityEPSS 0.5%CVE-2026-48812HIGHFreeScout Allows Unauthenticated Access to Legacy Attachment FilesEPSS 0.5%CVE-2026-73771HIGHImproper Authentication Handling in AOS-CX Management Interface and APIEPSS 0.5%