Filtered by CWE-288
Filtered by vendor Subscriptions
Total 534 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-23503 1 Apple 5 Ipados, Iphone Os, Macos and 2 more 2025-03-12 5.5 Medium
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3, iOS 15.7.3 and iPadOS 15.7.3, tvOS 16.3, watchOS 9.3. An app may be able to bypass Privacy preferences.
CVE-2023-22495 1 Maif 1 Izanami 2025-03-11 9.8 Critical
Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this application when deployed using the official Docker image. Because a hard coded secret is used to sign the authentication token (JWT), an attacker could compromise another instance of Izanami. This issue has been patched in version 1.11.0.
CVE-2022-3294 2 Kubernetes, Redhat 2 Kubernetes, Openshift 2025-03-07 6.6 Medium
Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.
CVE-2024-36470 1 Jetbrains 1 Teamcity 2025-02-07 8.1 High
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases
CVE-2023-21098 1 Google 1 Android 2025-02-05 7.8 High
In multiple functions of AccountManagerService.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-260567867
CVE-2022-40725 1 Pingidentity 1 Desktop 2025-02-04 7.3 High
PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before the time-based lockout is activated.
CVE-2025-24456 1 Jetbrains 1 Hub 2025-01-31 6.7 Medium
In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping
CVE-2023-31152 1 Selinc 20 Sel-2241 Rtac Module, Sel-2241 Rtac Module Firmware, Sel-3350 and 17 more 2025-01-24 4 Medium
An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface allows Authentication Bypass. See SEL Service Bulletin dated 2022-11-15 for more details.
CVE-2024-47574 1 Fortinet 2 Forticlient, Forticlientwindows 2025-01-22 7.4 High
A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0, and 6.4.10 through 6.4.0 allows low privilege attacker to execute arbitrary code with high privilege via spoofed named pipe messages.
CVE-2024-7125 2 Hitachi, Linux 2 Ops Center Common Services, Linux Kernel 2025-01-21 7.8 High
Authentication Bypass vulnerability in Hitachi Ops Center Common Services.This issue affects Hitachi Ops Center Common Services: from 10.9.3-00 before 11.0.2-01.
CVE-2024-11639 1 Ivanti 1 Cloud Services Appliance 2025-01-17 10 Critical
An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access
CVE-2023-41256 1 Doverfuelingsolutions 2 Maglink Lx 3, Maglink Lx Web Console Configuration 2025-01-17 9.1 Critical
Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 are vulnerable to authentication bypass that could allow an unauthorized attacker to obtain user access.
CVE-2024-13181 1 Ivanti 1 Avalanche 2025-01-17 7.3 High
Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes from CVE-2024-47010.
CVE-2024-13179 1 Ivanti 1 Avalanche 2025-01-17 7.3 High
Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.
CVE-2022-36249 1 Shopbeat 1 Shop Beat Media Player 2025-01-14 5.4 Medium
Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API level.
CVE-2023-34335 1 Ami 1 Megarac Spx 2025-01-03 7.7 High
AMI BMC contains a vulnerability in the IPMI handler, where an unauthenticated host is allowed to write to a host SPI flash, bypassing secure boot protections. An exploitation of this vulnerability may lead to a loss of integrity or denial of service.  
CVE-2024-25036 1 Ibm 1 Cognos Controller 2024-12-11 4.3 Medium
IBM Cognos Controller 11.0.0 and 11.0.1 could allow an authenticated user with local access to bypass security allowing users to circumvent restrictions imposed on input fields.
CVE-2024-7007 1 Positron 2 Tra7005, Tra7005 Firmware 2024-11-21 9.8 Critical
Positron Broadcast Signal Processor TRA7005 v1.20 is vulnerable to an authentication bypass exploit that could allow an attacker to have unauthorized access to protected areas of the application.
CVE-2024-38437 1 Dlink 2 Dsl-225, Dsl-225 Firmware 2024-11-21 9.8 Critical
D-Link - CWE-288:Authentication Bypass Using an Alternate Path or Channel
CVE-2024-38279 2 Motorola, Motorolasolutions 3 Vigilant Fixed Lpr Coms Box, Vigilant Fixed Lpr Coms Box Firmware, Vigilant Fixed Lpr Coms Box Bcav1f2 C600 2024-11-21 4.6 Medium
The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain password hashes.