Authentication flaw

The web interface on the SMC SMC8024L2 switch allows remote attackers to bypass authentication and obtain administrative access via a direct request to a .html file under 1 status/, 2 system/, 3 ports/, 4 trunks/, 5 vlans/, 6 qos/, 7 rstp/, 8 dot1x/, 9 security/, 10 igmps/, or 11 snmp/...

Authentication flaw

The Yahoo! Japan Yahoo! Browser application 1.2.0 and earlier for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application...

Authentication flaw

The Token Authentication tokenauth module 6.x-1.x before 6.x-1.7 for Drupal does not properly revert user sessions, which might allow remote attackers to perform requests with extra privileges...

Authentication flaw

hagent.exe in Wyse Device Manager WDM 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action...

CVE-2012-3292

The GridFTP in Globus Toolkit GT before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnamr function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the la...

RedHat Update for openldap RHSA-2011:0347-01

Check for the Version of openldap OpenVAS Vulnerability Test RedHat Update for openldap RHSA-2011:0347-01 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Authentication flaw

GR Board aka grboard 1.8.6.5 Community Edition does not require authentication for certain database actions, which allows remote attackers to modify or delete data via a request to 1 modrewrite.php, 2 commentwriteok.php, 3 poll/index.php, 4 update/index.php, 5 trackback.php, or 6 an arbitrary...

Authentication flaw

The TwitRocker2 application before 1.0.23 for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application...

Authentication flaw

The web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 does not require authentication, which allows remote attackers to perform unspecified functions via unknown vectors...

Authentication flaw

GbScriptAddUp.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to execute arbitrary code via unspecified vectors...

Authentication flaw

The web administration interface in the server in Sybase M-Business Anywhere 6.7 before ESD 3 and 7.0 before ESD 7 does not require admin authentication for unspecified scripts, which allows remote authenticated users to list or delete user accounts, modify passwords, or read log files via HTTP...

Authentication flaw

The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 allows remote authenticated users to obtain access to arbitrary user accounts via a crafted username, aka "ASP.Net Forms Authentication Bypass Vulnerability."...

Authentication flaw

The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0, when sliding expiry is enabled, does not properly handle cached content, which allows remote attackers to obtain access to arbitrary user accounts via a crafted URL, ak...

Authentication flaw

The billing system for Parallels Plesk Panel 10.3.1build1013110726.09 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms on certain pages...

Authentication flaw

The Web User Interface on the IBM TS3100 and TS3200 tape libraries with firmware before A.60 allows remote attackers to bypass authentication and obtain administrative access via unspecified vectors...

Authentication flaw

The D-Link DIR-685 router, when certain WPA and WPA2 configurations are used, does not maintain an encrypted wireless network during transfer of a large amount of network traffic, which allows remote attackers to obtain sensitive information or bypass authentication via a Wi-Fi device...

Authentication flaw

Opengear console servers with firmware before 2.2.1 allow remote attackers to bypass authentication, and modify settings or access connected equipment, via unspecified vectors...

Authentication flaw

The LDAP over SSL aka LDAPS implementation in Active Directory, Active Directory Application Mode ADAM, and Active Directory Lightweight Directory Service AD LDS in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7...

Authentication flaw

The cat6000-dot1x component in Cisco IOS 12.2 before 12.233SXI7 does not properly handle 1 a loop between a dot1x enabled port and an open-authentication dot1x enabled port and 2 a loop between a dot1x enabled port and a non-dot1x port, which allows remote attackers to cause a denial of service...

Authentication flaw

Cisco Firewall Services Module aka FWSM 3.1 before 3.121, 3.2 before 3.222, 4.0 before 4.016, and 4.1 before 4.17, when certain authentication configurations are used, allows remote attackers to cause a denial of service module crash by making many authentication requests for network access, aka...