Authentication flaw

Bugzilla 3.2 before 3.2 RC2, 3.0 before 3.0.6, 2.22 before 2.22.6, 2.20 before 2.20.7, and other versions after 2.17.4 allows remote authenticated users to bypass moderation to approve and disapprove quips via a direct request to quips.cgi with the action parameter set to "approve."...

Authentication flaw

phpscripts Ranking Script allows remote attackers to bypass authentication and gain administrative access by sending an admin=ja cookie...

Authentication flaw

The ProcessLogin function in class.auth.php in Interspire Shopping Cart ISC 4.0.1 Ultimate edition allows remote attackers to bypass authentication and obtain administrative access by reusing the RememberToken cookie after a failed admin login attempt...

Authentication flaw

admin/auth.php in Gobbl CMS 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to "ok"...

Authentication flaw

admin/index.php in V3 Chat Live Support 3.0.4 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1...

Authentication flaw

F-Prot 4.6.8 for GNU/Linux allows remote attackers to bypass anti-virus protection via a crafted ELF program with a "corrupted" header that still allows the program to be executed. NOTE: due to an error in the initial disclosure, F-secure was incorrectly stated as the vendor...

Authentication flaw

Nodstrum MySQL Calendar 1.1 and 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the nodstrumCalendarV2 cookie to 1. NOTE: some of these details are obtained from third party information...

Authentication flaw

Ipswitch WSFTP Server Manager before 6.1.1, and possibly other Ipswitch products, allows remote attackers to bypass authentication and read logs via a logLogout action to FTPLogServer/login.asp followed by a request to FTPLogServer/LogViewer.asp with the localhostnull account name...

Authentication flaw

admin/forums.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to bypass authentication and gain administrative access via a large value of the currentuseruserslevel parameter...

Authentication flaw

BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the loginauth cookie to true...

Authentication flaw

The accountsave action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified password and passwordretype parameters...

Authentication flaw

admin.php in CCleague Pro 1.2 allows remote attackers to bypass authentication by setting the type cookie value to admin...

Authentication flaw

tlAds 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the tlAdslogin cookie to "admin."...

Authentication flaw

aflog 1.01 allows remote attackers to bypass authentication and gain administrative access by setting the aflogautha cookie to "A" or "O" in 1 editdelete.php, 2 editcat.php, 3 editlock.php, and 4 editform.php...

Authentication flaw

BbZL.PhP 0.92 allows remote attackers to bypass authentication and gain administrative access by setting the phorumadminsession cookie to 1...

Authentication flaw

Husdawg, LLC Systems Requirements Lab 3, as used by Instant Expert Analysis, allows remote attackers to force the download and execution of arbitrary programs via by specifiying a malicious website argument to the Init method in 1 a certain ActiveX control sysreqlab2.cab, sysreqlab.dll,...

Authentication flaw

Unspecified vulnerability in Cisco Unity 4.x before 4.21ES161, 5.x before 5.01ES53, and 7.x before 7.02ES8, when using anonymous authentication aka native Unity authentication, allows remote attackers to bypass authentication and read or modify system configuration parameters by going to a specif...

adnforums-insecure.txt

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- adnforum eNYe-Sec - www.enye-sec.org Cookie is base64 based and the ascii format used is: user:23ed4e45887ad4311ff654bd4aab6540:user:0 user:md5 pass:user:0 Programmer forgot to check the pass and only use the nick to autenticate the user...

Authentication flaw

useradmin.php in Easy Photo Gallery aka Ezphotogallery 2.1 does not require administrative authentication, which allows remote attackers to 1 add or 2 remove an Administrator account...

Authentication flaw

The web proxy service on the D-Link DIR-100 with firmware 1.12 and earlier does not properly filter web requests with large URLs, which allows remote attackers to bypass web restriction filters...