CWE-305.

VMware ESXi contains an authentication bypass vulnerability.

• VMware ESXi
• VMware Cloud Foundation
• CWE-305

Ca: token authentication bypass vulnerability

• Red Hat Certificate System 10.4 EUS for RHEL-8
• Red Hat Enterprise Linux 7
• CWE-305

MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function

• MileSight DeviceHub
• CWE-305

Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process

• CWE-305
• CWE-620

<2.26.2 · fixed in 2.26.2

A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device.

• Cisco IP Phones with Multiplatform Firmware
• Cisco PhoneOS
• CWE-305

Google Chrome: Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed…

• Google Chrome
• CWE-305
• CWE-691

Authentication Bypass in TeoSOFT Software TeoBASE

• TeoSOFT Software TeoBASE
• CWE-305

Authentication Bypass in XPodas' Octopod

• XPodas Octopod
• CWE-305

Authentication Bypass in ZKSoftware's UFace 5

• ZKSoftware Biometric Security Solutions UFace 5
• CWE-305

Authentication Bypass in OpenEdge Authentication Gateway and AdminServer

• Progress OpenEdge
• CWE-305

In telephony, there is a possible escalation of privilege due to a permissions bypass.

• MediaTek, Inc. MT6739, MT6753, MT6757, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6781, MT6833, MT6835, MT6853, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8321, MT8667, MT8673, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8797, MT8798
• CWE-305

Windows Kerberos Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows Server 2019
• CWE-305

Lockscreen bypass in eWeLink App

• CoolKit Technology eWeLink - Smart Home
• CWE-305

SALESmanago <= 3.2.4 - Log Injection via Weak Authentication Token

• salesmanag0 SALESmanago & Leadoo
• CWE-305

NATS.io: Adding accounts for just the system account adds auth bypass

• CWE-305

>=2.2.0, <2.9.23 || >=2.10.0, <2.10.2 · fixed in 2.9.23, 2.10.2

Authentication bypass in OpenText (Micro Focus) Enterprise Server

• OpenText Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server
• Authentication bypass
• CWE-253

Authentication Bypass by Primary Weakness in mintplex-labs/anything-llm

• mintplex-labs/anything-llm
• CWE-305

Dover Fueling Solutions MAGLINK LX Web Console Authentication Bypass by Primary Weakness

• Dover Fueling Solutions MAGLINK LX Web Console Configuration
• CWE-305

Dapr API token authentication bypass in HTTP endpoints

• Authentication bypass
• CWE-305

<1.10.9 || >=1.11.0, <1.11.2 · fixed in 1.10.9, 1.11.2

Authentication Bypass by Primary Weakness in Oliva Expertise

• Oliva Expertise EKS
• CWE-305

SonicWall GMS: SonicWall GMS and Analytics CAS Web Services application use static values for…

• SonicWall GMS
• SonicWall Analytics
• CWE-305

SonicWall GMS: The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient…

• SonicWall GMS
• SonicWall Analytics
• CWE-305

Race condition in Avalanche

• Avalanche
• Race condition
• CWE-305

Configuration-based MFA Bypass in PingID RADIUS PCV.

• Ping Identity PingID Radius PCV
• Ping Identity PingID Integration Kit (includes Radius PCV)
• CWE-305

Authentication Bypass in Redline Router

• DTS Electronics Redline Router
• CWE-305

Panasonic AiSEG2: Panasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass…

• Panasonic AiSEG2
• CWE-305

An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have pr…

• https://github.com/curl/curl
• CWE-305

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to che…

• https://github.com/curl/curl
• CWE-305

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers.

• https://github.com/curl/curl
• CWE-305

Full authentication bypass if SASL authorization username is specified

• Authentication bypass
• CWE-305

>=0.2.0, <0.6.3 · fixed in 0.6.3

Froxlor is vulnerable to authentication bypass

• CWE-305

<2.0.13 · fixed in 2.0.13

Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.

• CWE-305

<2.0.4 · fixed in 2.0.4

A flaw was found in the openstack-barbican component.

• Red Hat OpenStack Platform
• CWE-305

Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.

• CWE-305

<2.5.5 · fixed in 2.5.5

Mist vulnerable to user providing a Sudo binary for authentication checks

• makedeb mist
• Authentication bypass
• CWE-305

Tokensync in security subsystem has a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerabi…

• OpenHarmony
• CWE-305

multimedia subsystem has a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.

• OpenHarmony
• CWE-305

windowmanager in window subsystem has a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.

• OpenHarmony
• CWE-305

Cockpit Content Platform vulnerable to 2FA bypass

• Authentication bypass
• CWE-212

<2.2.2 · fixed in 2.2.2

Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm

• bookwyrm-social/bookwyrm
• CWE-305

Keycloak Authentication Error

• Authentication bypass
• Weak cryptography or TLS

>=7.0.0, <=7.0.1 · no fixed version yet

Keycloak Authentication Error

• Authentication bypass
• CWE-305

>=7.0.0, <=7.0.1 · no fixed version yet

Weak Authentication in Login Function of USC+

• Mepsan USC+
• CWE-305

OpenVPN: OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external…

• OpenVPN
• CWE-305

When the device is in factory state, it can be access the shell without adb authentication process.

• LG mobile devices
• CWE-305

Auth bypass in Dark SDK

• Google LLC Dart SDK
• CWE-305

Remote code execution in Valmet DNA before Collection 2021

• Valmet DNA
• Command injection
• Information disclosure

Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/server

• Authentication bypass
• CWE-305

<1.3.21 · fixed in 1.3.21

Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers

• CWE-305

<=1.2.8 · no fixed version yet

In Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

• Arista Networks Arista EOS
• CWE-305

Authentication Bypass in ADOdb/ADOdb

• Authentication bypass
• CWE-305

<5.20.21 || >=5.21.0, <5.21.4 · fixed in 5.20.21, 5.21.4

GOautodial API: The GOautodial API prior to commit 3c3a979 made on October 13th…

• GOautodial API
• CWE-305

Authentication Bypass by CSRF Weakness

• Cross-site request forgery (CSRF)
• CWE-305

<2.11.12 || >=3.0.0, <3.0.3 || >=3.1.0, <3.1.3 · fixed in 2.11.12, 3.0.3, 3.1.3

Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui

• Authentication bypass
• CWE-305

>=1.26.0, <1.26.7 · fixed in 1.26.7

OpenVPN 3 Core Library: OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to…

• OpenVPN 3 Core Library
• CWE-305

OpenVPN Access Server: OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass…

• OpenVPN Access Server
• CWE-305

OpenVPN: OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and…

• OpenVPN
• CWE-305

Authentication Bypass in Symphony Plus

• ABB Ability™ Symphony® Plus Operations
• CWE-305
• CWE-602

A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16).

• Siemens SIMATIC HMI Unified Comfort Panels
• CWE-305

NCR SelfServ ATM: NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for…

• NCR SelfServ ATM
• CWE-305