CWE-288 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-288 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 랜섬웨어 캠페인에 사용됨CVE-2023-42793In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was p…100.0%심각9.8● 랜섬웨어 캠페인에 사용됨CVE-2024-1709ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alterna…100.0%심각10.0● 랜섬웨어 캠페인에 사용됨CVE-2024-27198In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was p…99.9%심각9.8● 실제 악용이 확인됨CVE-2025-4427An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior a…99.9%높음7.5● 실제 악용이 확인됨CVE-2025-2747An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Sta…97.2%심각9.8● 랜섬웨어 캠페인에 사용됨CVE-2023-46747Undisclosed requests may bypass configuration utility authentication, allowing an attacker with netw…96.7%심각9.8● 랜섬웨어 캠페인에 사용됨CVE-2026-23760SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability…96.4%심각9.3● 실제 악용이 확인됨CVE-2025-57819FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are v…95.2%심각10.0
전체 목록
98건
CVE-2024-55591랜섬웨어 악용An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version …94.3%심각9.8
CVE-2020-10148악용 확인The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execu…92.0%심각9.8
CVE-2026-20079악용 확인A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an …88.7%심각10.0
CVE-2026-1603악용 확인An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated at…88.3%높음7.5
CVE-2026-24858악용 확인An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet …86.6%심각9.8
CVE-2025-34026악용 확인The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reve…81.8%심각9.2
CVE-2025-2746악용 확인An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync …74.1%심각9.8
CVE-2026-19490악용 확인Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from…32.7%심각9.3
CVE-2023-20269랜섬웨어 악용A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco…26.6%심각9.1
CVE-2026-18577악용 확인An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Vers…14.6%높음8.2
CVE-2026-18556악용 확인Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authenticati…7.9%높음8.2
CVE-2025-24472랜섬웨어 악용An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 th…7.2%높음8.1
CVE-2026-83527An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthent…1.5%높음8.1
CVE-2026-27546An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in…1.0%심각9.8
CVE-2026-107656An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 throu…0.9%심각9.8
CVE-2026-79855An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to…0.8%심각9.8
CVE-2026-116606An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthe…0.7%심각9.3
CVE-2026-79850Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass ex…0.7%심각10.0
CVE-2026-79844Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remot…0.7%심각10.0
CVE-2026-14917A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature …0.7%높음7.7
CVE-2026-63190FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to versio…0.5%심각9.4
CVE-2026-62916Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker…0.6%심각9.1
CVE-2026-104075TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass…0.6%심각9.3
CVE-2026-89067Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue…0.6%높음8.8
CVE-2026-110130Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication fo…0.6%심각10.0
CVE-2026-19863An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the reque…0.5%심각9.3
CVE-2026-76169fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the cust…0.5%높음7.5
CVE-2026-93866An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access…0.4%심각9.2
CVE-2026-119420Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to…0.4%높음8.7
CVE-2026-93928Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager…0.4%높음7.3
CVE-2026-114732Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability…0.4%보통6.8
CVE-2026-19572A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP …0.4%심각9.3
CVE-2026-111438在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，…0.4%보통6.5
CVE-2026-107671A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authenticatio…0.3%높음8.5
CVE-2026-110852n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dyn…0.4%보통6.3
CVE-2026-19622IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privil…0.4%높음8.8
CVE-2026-81906Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or e…0.3%보통6.3
CVE-2026-84360Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation rou…0.3%높음8.1
CVE-2026-107194Sungrow iSolarCloud before 2026 allows authentication bypass and account takeover via "login_type":"5" in a lo…0.3%심각9.2
CVE-2026-79680Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An a…0.3%보통4.5
CVE-2026-19620IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access d…0.3%높음8.8
CVE-2026-62650A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks …0.3%높음8.7
CVE-2026-115829In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by …0.3%높음8.7
CVE-2026-90481In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypas…0.3%심각9.2
CVE-2026-84923Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Veri…0.3%보통6.5
CVE-2026-57134PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai…0.3%높음8.2
CVE-2026-88861Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version availabl…0.3%높음8.7
CVE-2026-77103CommServe contained an authentication bypass issue affecting access authorization and information disclosure. …0.3%높음8.7
CVE-2026-71450Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and C…0.3%높음8.7
CVE-2026-89057A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user wi…0.3%높음7.0
CVE-2026-96385Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authenticatio…0.3%보통6.5
CVE-2026-85865Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature loca…0.3%보통5.5
CVE-2026-83787Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass …0.3%보통5.5
CVE-2026-91143goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unaut…0.3%보통6.9
CVE-2026-96387Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allo…0.3%낮음3.8
CVE-2026-86084n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC log…0.3%보통6.0
CVE-2026-63493Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an acc…0.3%높음8.6
CVE-2026-81787Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.0.2%보통6.5
CVE-2026-100518Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.0.3%보통5.3
CVE-2026-11731An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attac…0.3%보통6.3
CVE-2026-118681go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match wit…0.2%보통6.3
CVE-2026-84777Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.0.2%높음7.4
CVE-2026-93949Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store g…0.2%높음7.1
CVE-2026-81783Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.0.2%높음7.1
CVE-2026-107254Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA…0.2%보통4.8
CVE-2026-107361The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on a…0.2%보통4.2
CVE-2026-111712Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated…0.2%보통6.9
CVE-2026-114572Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows …0.2%보통5.4
CVE-2026-58269Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to vers…0.2%높음8.1
CVE-2026-88260Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of i…0.2%높음8.7
CVE-2026-114635Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is…0.2%높음7.0
CVE-2026-118554Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows …0.2%미평가
CVE-2026-114539Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authent…0.2%미평가
CVE-2026-107261Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA…0.2%보통4.2
CVE-2026-118582Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality …0.2%미평가
CVE-2026-118572Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO …0.2%미평가
CVE-2026-106602Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Pa…0.2%보통4.8
CVE-2026-106601Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Pa…0.2%보통5.4
CVE-2026-100261In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update per…0.2%보통5.4
CVE-2026-81868Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native…0.2%보통6.5
CVE-2026-94585An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions be…0.2%높음7.7
CVE-2026-88828The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking …0.2%보통5.4
CVE-2026-33272A malicious user with physical access to the device can boot the switch from factory settings without authenti…0.1%보통6.8
CVE-2026-55186Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password…보통4.2
CVE-2026-77799ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that a…높음7.4
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.