Authentication flaw

Absolute Form Processor XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting the xlaAFPadmin cookie to "lvl=1&userid=1."...

Authentication flaw

The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via 1 an invali...

CentOS 3 / 4 : openssh (CESA-2006:0738)

Updated openssh packages that fix an authentication flaw are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having low security impact by the Red Hat Security Response Team. OpenSSH is OpenBSD's SSH Secure SHell protocol implementation. This package includes the...

Authentication flaw

MyShoutPro 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the adminaccess cookie to 1...

Authentication flaw

TurnkeyForms Entertainment Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the adminLogged cookie to Administrator...

Authentication flaw

The Web management interface in Avaya SIP Enablement Services SES 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, does not perform authentication for certain functionality, which allows remote attackers to obtain sensitive information and access restricted functionality via 1 the...

Authentication flaw

admin.php in xeCMS 1.0.0 RC2 and earlier allows remote attackers to bypass authentication and access the admin panel by setting the xecmsusername cookie...

Authentication flaw

A+ PHP Scripts News Management System NMS allows remote attackers to bypass authentication and gain administrator privileges by setting the mobsuser and mobspass cookies to 1...

Authentication flaw

resetpass.php in openInvoice 0.90 beta and earlier allows remote authenticated users to change the passwords of arbitrary users via a modified uid parameter. NOTE: this can be leveraged with a separate vulnerability in auth.php to modify passwords without authentication...

Authentication flaw

Acc Autos 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the 1 usernamecookie to "admin," 2 rightcookie to "1," and 3 idcookie to "1."...

Authentication flaw

Pre Shopping Mall allows remote attackers to bypass authentication and gain administrative access by setting the 1 adminname and the 2 adminid cookies to "admin"...

Authentication flaw

Bux.to Clone script allows remote attackers to bypass authentication and gain administrative access by setting the loggedin cookie to 1 and the usNick cookie to admin...

Authentication flaw

Bugzilla 3.2 before 3.2 RC2, 3.0 before 3.0.6, 2.22 before 2.22.6, 2.20 before 2.20.7, and other versions after 2.17.4 allows remote authenticated users to bypass moderation to approve and disapprove quips via a direct request to quips.cgi with the action parameter set to "approve."...

Authentication flaw

phpscripts Ranking Script allows remote attackers to bypass authentication and gain administrative access by sending an admin=ja cookie...

Authentication flaw

The ProcessLogin function in class.auth.php in Interspire Shopping Cart ISC 4.0.1 Ultimate edition allows remote attackers to bypass authentication and obtain administrative access by reusing the RememberToken cookie after a failed admin login attempt...

Authentication flaw

admin/auth.php in Gobbl CMS 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to "ok"...

Authentication flaw

admin/index.php in V3 Chat Live Support 3.0.4 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1...

Authentication flaw

F-Prot 4.6.8 for GNU/Linux allows remote attackers to bypass anti-virus protection via a crafted ELF program with a "corrupted" header that still allows the program to be executed. NOTE: due to an error in the initial disclosure, F-secure was incorrectly stated as the vendor...

Authentication flaw

Nodstrum MySQL Calendar 1.1 and 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the nodstrumCalendarV2 cookie to 1. NOTE: some of these details are obtained from third party information...

Authentication flaw

Ipswitch WSFTP Server Manager before 6.1.1, and possibly other Ipswitch products, allows remote attackers to bypass authentication and read logs via a logLogout action to FTPLogServer/login.asp followed by a request to FTPLogServer/LogViewer.asp with the localhostnull account name...