Falhas do tipo CWE-287

2.850 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2018-17926—The product M2M ETHERNET (FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior) is vulnerable in that an attacker can upload a malicioEPSS 0.8%CVE-2025-3268MEDIUMqinguoyi TinyWebServer http_conn.cpp improper authenticationEPSS 0.8%CVE-2023-1464HIGHSourceCodester Medicine Tracker System improper authenticationEPSS 0.8%CVE-2017-12213—A vulnerability in the dynamic access control list (ACL) feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches couEPSS 0.8%CVE-2022-39184CRITICALEXFO - BV-10 Performance Endpoint Unit Authentication bypassEPSS 0.8%CVE-2026-8979CRITICALAuthentication BypassEPSS 0.8%CVE-2023-21817HIGHWindows Kerberos Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-14714MEDIUMzhayujie chatgpt-on-wechat CowAgent wx Endpoint common.py verify_server missing authenticationEPSS 0.8%CVE-2023-3065CRITICALMobatime mobile application - Authentication bypassEPSS 0.8%CVE-2026-112595HIGHThis issue was addressed with improved authentication. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. AEPSS 0.8%CVE-2024-10963HIGHPam: improper hostname interpretation in pam_access leads to access control bypassEPSS 0.8%CVE-2025-4494MEDIUMJAdmin-JAVA JAdmin Admin Backend NoNeedLoginController.java toLogin improper authenticationEPSS 0.8%CVE-2022-31131MEDIUMOwnership check missing when updating or deleting mail attachments in Nextcloud mailEPSS 0.8%CVE-2024-25313HIGHCode-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/teacher_logEPSS 0.8%CVE-2024-1817HIGHDemososo DM Enterprise Website Building System Cookie indexDM_load.php dmlogin improper authenticationEPSS 0.8%CVE-2021-3424—A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can registeEPSS 0.8%CVE-2026-17000HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.8%CVE-2026-84839MEDIUMtsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authenticationEPSS 0.8%CVE-2024-7012CRITICALPuppet-foreman: an authentication bypass vulnerability exists in foremanEPSS 0.8%CVE-2025-14567MEDIUMhaxxorsid Stock-Management-System employees missing authenticationEPSS 0.8%