Fallos del tipo CWE-287

2853 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2023-48747MEDIUMWordPress Booster for WooCommerce plugin <= 7.1.2 - Authenticated Production Creation/Modification VulnerabilityEPSS 0.4%CVE-2026-93744MEDIUMIBM i Improper AuthenticationEPSS 0.4%CVE-2026-49448CRITICALauthentik: SourceStage bypass via empty POSTEPSS 0.4%CVE-2026-124573MEDIUMlogseq Local HTTP API server.cljs validate-auth-token missing authenticationEPSS 0.4%CVE-2026-10777MEDIUMealpha072 Student-Management-System Administrative Backend config.php improper authenticationEPSS 0.4%CVE-2026-125075MEDIUMSourceCodester Smart Attendance System with QR Code Scanner Admin Account Creation create_admin.php getMessage missing authenticationEPSS 0.4%CVE-2026-18215MEDIUMKeycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenantEPSS 0.4%CVE-2026-15089CRITICALCommerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079EPSS 0.4%CVE-2026-101808CRITICALVulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). Supported versions that are affected aEPSS 0.4%CVE-2026-87263HIGHVulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported vEPSS 0.4%CVE-2023-21455MEDIUMImproper authorization implementation in Exynos baseband prior to SMR Mar-2023 Release 1 allows incorrect handling of unencrypted message.EPSS 0.4%CVE-2026-8214MEDIUMIndustrial Application Software IAS Canias ERP RMI doAction improper authenticationEPSS 0.4%CVE-2026-46921HIGHVulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that EPSS 0.4%CVE-2026-101280MEDIUMTrusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofingEPSS 0.4%CVE-2026-91259HIGHVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are afEPSS 0.4%CVE-2026-116239HIGHpgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same usernameEPSS 0.4%CVE-2026-91222CRITICALVulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)). SuppoEPSS 0.4%CVE-2026-8737MEDIUMSanluan PublicCMS Trade Address Query TradeAddressListDirective.java execute missing authenticationEPSS 0.4%CVE-2026-110653CRITICALAppointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts CounterEPSS 0.4%CVE-2026-8244MEDIUMIndustrial Application Software IAS Canias ERP Login RMI improper authenticationEPSS 0.4%