Filtered by CWE-288
Filtered by vendor Subscriptions
Total 368 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-1283 1 Dingtian-tech 8 Dt-r002, Dt-r002 Firmware, Dt-r008 and 5 more 2025-04-10 9.8 Critical
The Dingtian DT-R0 Series is vulnerable to an exploit that allows attackers to bypass login requirements by directly navigating to the main page.
CVE-2022-3614 1 Octopus 1 Octopus Server 2025-04-10 6.1 Medium
In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation.
CVE-2022-3841 1 Redhat 2 Acm, Advanced Cluster Management For Kubernetes 2025-04-09 7.8 High
RHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery (SSRF) vulnerability was found in the console API endpoint from Red Hat Advanced Cluster Management for Kubernetes (RHACM). An attacker could take advantage of this as the console API endpoint is missing an authentication check, allowing unauthenticated users making requests.
CVE-2022-42275 1 Nvidia 2 Bmc, Dgx A100 2025-04-07 7.7 High
NVIDIA BMC IPMI handler allows an unauthenticated host to write to a host SPI flash bypassing secureboot protections. This may lead to a loss of integrity and denial of service.
CVE-2022-42276 1 Nvidia 2 Dgx A100, Dgx A100 Firmware 2025-04-07 7.5 High
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.
CVE-2022-42277 1 Nvidia 2 Dgx Station A100, Dgx Station A100 Firmware 2025-04-07 7.5 High
NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.
CVE-2025-24095 1 Apple 3 Ipados, Iphone Os, Visionos 2025-04-07 7.6 High
This issue was addressed with additional entitlement checks. This issue is fixed in visionOS 2.4, iOS 18.4 and iPadOS 18.4. An app may be able to bypass Privacy preferences.
CVE-2024-11703 1 Mozilla 1 Firefox 2025-04-05 5.7 Medium
On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication. This vulnerability affects Firefox < 133.
CVE-2025-0245 1 Mozilla 1 Firefox 2025-04-03 3.3 Low
Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed. This vulnerability affects Firefox < 134.
CVE-2024-13771 1 Uxper 1 Civi 2025-04-03 9.8 Critical
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.
CVE-2024-13446 1 Amentotech 1 Workreap 2025-04-02 9.8 Critical
The Workreap plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.2.5. This is due to the plugin not properly validating a user's identity prior to (1) performing a social auto-login or (2) updating their profile details (e.g. password). This makes it possible for unauthenticated attackers to (1) login as an arbitrary user if their email address is known or (2) change an arbitrary user's password, including administrators, and leverage that to gain access to their account. NOTE: This vulnerability was partially fixed in version 3.2.5.
CVE-2025-27658 1 Printerlogic 2 Vasion Print, Virtual Appliance 2025-04-01 9.8 Critical
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Authentication Bypass OVE-20230524-0001.
CVE-2025-22277 2025-04-01 8.8 High
Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos allows Authentication Abuse. This issue affects Vitepos: from n/a through 3.1.4.
CVE-2023-50915 1 Gog 1 Galaxy 2025-03-28 6.5 Medium
An issue exists in GalaxyClientService.exe in GOG Galaxy (Beta) 2.0.67.2 through 2.0.71.2 that could allow authenticated users to overwrite and corrupt critical system files via a combination of an NTFS Junction and an RPC Object Manager symbolic link and could result in a denial of service.
CVE-2025-30112 2025-03-27 7.1 High
On 70mai Dash Cam 1S devices, by connecting directly to the dashcam's network and accessing the API on port 80 and RTSP on port 554, an attacker can bypass the device authorization mechanism from the official mobile app that requires a user to physically press on the power button during a connection.
CVE-2025-22230 2025-03-27 7.8 High
VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges on a guest VM may gain ability to perform certain high privilege operations within that VM.
CVE-2024-31814 1 Totolink 2 Ex200, Ex200 Firmware 2025-03-18 8.8 High
TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to bypass login through the Form_Login function.
CVE-2023-37057 1 Jlink 1 Ax1800 2025-03-14 9.8 Critical
An issue in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to execute arbitrary code via the router's authentication mechanism.
CVE-2025-29996 2025-03-13 N/A
This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.
CVE-2025-2080 2025-03-13 N/A
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.