Authentication flaw

geoBlog aka BitDamaged 1 does not require authentication for 1 deletecomment.php, 2 deleteblog.php, and 3 listcomment.php in admin/, which allows remote attackers to delete arbitrary comments, delete arbitrary blogs, and have other unspecified impact via a request with a valid id parameter...

Authentication flaw

The SMTP ALG in Clavister CorePlus before 8.80.04, and 8.81.00, does not properly parse SMTP commands in certain circumstances, which allows remote attackers to bypass address blacklists...

Authentication flaw

Unspecified vulnerability in DomainPOP in Alt-N Technologies MDaemon before 9.61 allows remote attackers to cause a denial of service crash via malformed messages...

Authentication flaw

admin.php in VRNews 1.1.1, and possibly other 1.x versions, does not require authentication, which allows remote attackers to perform certain administrative actions via a direct request with a 1 edit, 2 add, 3 config, or 4 del value in the act parameter...

Authentication flaw

TutorialCMS 1.01 and earlier, when registerglobals is enabled, allows remote attackers to bypass authentication via the 1 loggedIn and 2 activated parameters to a login.php, b headerLinks.php, c submit1.php, d myFav.php, and e userCP.php...

Authentication flaw

Deutsche Telekom T-com Speedport W 700v uses JavaScript delays for invalid authentication attempts to the CGI script, which allows remote attackers to bypass the delays and conduct brute-force attacks via direct calls to the authentication CGI script...

Authentication flaw

PatrolAgent.exe in BMC Performance Manager does not require authentication for requests to modify configuration files, which allows remote attackers to execute arbitrary code via a request on TCP port 3181 for modification of the masterAgentName and masterAgentStartLine SNMP parameters. NOTE: the...

Authentication flaw

MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication requirements via the admin cookie parameter to certain admin files, as demonstrated by admin/settings.php...

Authentication flaw

The telnet daemon telnetd in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882...

Authentication flaw

PulseAudio 0.9.5 allows remote attackers to cause a denial of service daemon crash via 1 a PAPSTREAMDESCRIPTORLENGTH value of FRAMESIZEMAXALLOW sent on TCP port 9875, which triggers a p-export assertion failure in doread; 2 a PAPSTREAMDESCRIPTORLENGTH value of 0 sent on TCP port 9875, which...

Authentication flaw

Cisco Secure ACS does not require authentication when Cisco Trust Agent CTA transmits posture information, which might allow remote attackers to gain network access via a spoofed Network Endpoint Assessment posture, aka "NACATTACK." NOTE: this attack might be limited to authenticated users and...

Authentication flaw

Unspecified vulnerability in HP OpenView Network Node Manager OV NNM 6.20, 6.4x, 7.01, 7.50, and 7.51 allows remote authenticated users to access certain privileged "facilities" via unspecified vectors...

Authentication flaw

JBrowser allows remote attackers to bypass authentication and access certain administrative capabilities via a direct request for admin/...

Authentication flaw

The 1 TTLS CHAP, 2 TTLS MSCHAP, 3 TTLS MSCHAPv2, 4 TTLS PAP, 5 MD5, 6 GTC, 7 LEAP, 8 PEAP MSCHAPv2, 9 PEAP GTC, and 10 FAST authentication methods in Cisco Secure Services Client CSSC 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent CSA 5.0 and 5.1 when a vulnerable Trust Agent has been deploye...

Authentication flaw

MOHA Chat 0.1b7 and earlier does not require authentication for use of the plug in API, which has unknown impact and attack vectors...

Authentication flaw

FON La Fonera routers do not properly limit DNS service access by unauthenticated clients, which allows remote attackers to tunnel traffic via DNS requests for hosts that should not be accessible before authentication...

Authentication flaw

Cisco Clean Access CCA 3.6.x through 3.6.4.2 and 4.0.x through 4.0.3.2 does not properly configure or allow modification of a shared secret authentication key, which causes all devices to have the same shared sercet and allows remote attackers to gain unauthorized access...

RHEL 3 / 4 : openssh (RHSA-2006:0738)

Updated openssh packages that fix an authentication flaw are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having low security impact by the Red Hat Security Response Team. OpenSSH is OpenBSD's SSH Secure SHell protocol implementation. This package includes the...

Low: Red Hat Security Advisory: openssh security update

Updated openssh packages that fix an authentication flaw are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having low security impact by the Red Hat Security Response Team. OpenSSH is OpenBSD's SSH Secure SHell protocol implementation. This package includes the...

Authentication flaw

The embedded HTTP server in Fuji Xerox Printing Systems FXPS print engine, as used in products including 1 Dell 3000cn through 5110cn and 2 Fuji Xerox DocuPrint firmware before 20060628 and Network Option Card firmware before 5.13, does not properly perform authentication for HTTP requests, which...