CWE-305.

Information Disclosure in Birebirsoft's Sufirmam

• Birebirsoft Software and Technology Solutions Sufirmam
• CWE-305
• CWE-640

Authentication bypass in Aries due to misconfiguration

• com.palantir.aries:aries
• CWE-305

[PI141230] Fixed A broken access control issue.

• Jamf Pro
• CWE-305

Authentication bypass in IBM API Connect

• IBM API Connect
• CWE-305

Glutton V1 endpoints missing authentication

• com.palantir.gotham:glutton
• CWE-305

Zerobyte has Authentication Bypass by Primary Weakness

• nicotsx zerobyte
• CWE-305

A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protection and failed attempt restrictions by faking X-Real-IP and X…

• CWE-305

Possible malfunction credential injection

• METZ CONNECT Energy-Controlling EWIO2-M
• METZ CONNECT Energy-Controlling EWIO2-M-BM
• CWE-305

MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling

• CWE-305
• CWE-697

<2.27.2 · fixed in 2.27.2

There is a vulnerability in the IBM Maximo Manage application in IBM Maximo Application Suite for Cognos Analytics

• IBM Maximo Application Suite
• CWE-305

go-f3 Vulnerable to Cached Justification Verification Bypass in github.com/filecoin-project/go-f3

• CWE-305

<0.8.9 · fixed in 0.8.9

On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.

• Mercku M6a
• CWE-305

Junos OS: When a user with the name ftp or anonymous is configured unauthenticated filesystem access is allowed

• Juniper Networks Junos OS
• CWE-305

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality.

• CWE-305

RatPanel can perform remote command execution without authorization in github.com/tnborg/panel in github.com/TheTNB/panel

• CWE-305

>=0.0.0-20241111062800-91ecd04c2700 · no fixed version yet

Binding authentication bypass vulnerability in the devicemanager module.

• Huawei HarmonyOS
• CWE-305

HCL BigFix Remote Control is affected by an authorization bypass vulnerability

• HCL Software BigFix Remote Control
• CWE-305

File Browser’s insecure JWT handling can lead to session replay attacks after logout

• Authentication bypass
• CWE-305

<=2.39.0 · no fixed version yet

Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei HarmonyOS
• CWE-305

File Browser's password protection of links is bypassable

• CWE-305

<=1.11.0 · no fixed version yet

PgPool Global Development Group Pgpool-II: Pgpool-II provided by PgPool Global Development Group contains an authentication bypass…

• PgPool Global Development Group Pgpool-II
• CWE-305

OPKSSH Vulnerable to Authentication Bypass in github.com/openpubkey/opkssh

• CWE-305

<0.5.0 · fixed in 0.5.0

OpenPubkey Vulnerable to Authentication Bypass in github.com/openpubkey/openpubkey

• CWE-305

<0.10.0 · fixed in 0.10.0

Authentication Bypass

• Schweitzer Engineering Laboratories SEL-3350-1
• Schweitzer Engineering Laboratories SEL-3355-2
• CWE-305

Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2

• Danfoss AK-SM 8xxA Series
• CWE-305

KUNBUS Revolution Pi Authentication Bypass by Primary Weakness

• KUNBUS GmbH Revolution Pi PiCtory
• CWE-305

KUNBUS Revolution Pi Authentication Bypass by Primary Weakness

• KUNBUS GmbH Revolution Pi OS Bookworm
• CWE-305

CrushFTP: CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover…

• CrushFTP
• CWE-305

This issue was addressed through improved state management.

• Apple iOS and iPadOS
• Apple iPadOS
• CWE-305

The issue was addressed with improved checks.

• Apple Safari
• Apple iOS and iPadOS
• CWE-305

Authentication Bypass in langgenius/dify

• langgenius/dify
• CWE-305

Security Update for the OPC UA .NET Standard Stack

• Authentication bypass
• CWE-305

<1.5.374.158 · fixed in 1.5.374.158

i-Drive i11/i12 Device Pairing authentication bypass

• i-Drive i11
• i-Drive i12
• Authentication bypass
• CWE-305

IETF RFC 7523: In certain IETF OAuth 2.0-related specifications…

• IETF RFC 7523
• CWE-305

OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations.

• OpenID Connect
• CWE-305

WorkOS Hosted AuthKit: WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by…

• WorkOS Hosted AuthKit
• CWE-305

ZF Roll Stability Support Plus (RSSPlus) Authentication Bypass By Primary Weakness

• ZF RSSPlus 2M
• CWE-305

Duplicate Advisory: Authentication Bypass by Spoofing in OPC UA .NET Standard Stack

• Authentication bypass
• CWE-305

<1.5.374.158 · fixed in 1.5.374.158

Sunshine improperly enforces pairing protocol request order

• LizardByte Sunshine
• Memory corruption
• CWE-305

SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Mic…

• SonicWall SonicOS
• CWE-305

WordPress YOP Poll plugin <= 6.5.28 - Vote Manipulation Due to Broken Captcha Control Vulnerability

• yourownprogrammer YOP Poll
• CWE-305

Huawei HiLink AI Life product has an identity authentication bypass vulnerability.

• Huawei HarmonyOS AILife Solution 6.0
• CWE-305

Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service

• Red Hat Service Interconnect 1 for RHEL 9
• Red Hat Service Interconnect 1
• CWE-305

Fortinet FortiWAN: A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below…

• Fortinet FortiWAN
• CWE-305

TShock Security Escalation Exploit

• Authentication bypass
• Broken access control

>=4.3.21, <5.2.1 · fixed in 5.2.1

Cisco Modeling Labs External Authentication Bypass Vulnerability

• Cisco Modeling Labs
• CWE-305

Theft of credentials in Unix client PAGs

• OpenAFS
• CWE-305

codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service

• Weak cryptography or TLS
• CWE-305

<6.24.2 · fixed in 6.24.2

WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerability

• Swoop 1-Click Login: Passwordless Authentication
• CWE-305

Quay: quay allows successful authentication with trucated version of the password

• Red Hat Quay 3
• CWE-305

Cisco ATA 190 Series Analog Telephone Adapter Firmware Command Injection and Denial of Service Vulnerability

• Cisco Analog Telephone Adaptor (ATA) Software
• Broken access control
• CWE-305

Eclipse Dataspace Components's ConsumerPullTransferTokenValidationApiController doesn't check for token validit

• Authentication bypass
• CWE-305

>=0.5.0, <0.9.0 · fixed in 0.9.0

This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager.

• Trellix Intrusion Prevention System (IPS) Manager
• CWE-305

This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix IPS Manager with garbage data in response mostly

• Trellix Intrusion Prevention System (IPS) Manager
• CWE-305

Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai

• Red Hat RHOAI-2.14-RHEL-8
• Red Hat OpenShift Data Science (RHODS)
• CWE-305

Authentication Bypass by Primary Weakness in GitLab

• GitLab
• CWE-305

WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password

• WPWeb WooCommerce - Social Login
• CWE-305

Nuvoton - CWE-305: Authentication Bypass by Primary Weakness

• Nuvoton NPCM7xx (Poleg) BootBlock
• CWE-305

PrivateBin allows shortening of URLs for other domains

• CWE-305
• CWE-791

>=1.5.0, <1.7.4 · fixed in 1.7.4

Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices

• Kiloview P1/P2
• CWE-305