GoAhead WebServer information disclosure and authentication bypass vulnerabilities

Overview GoAhead WebServer contains vulnerabilities that may allow an attacker to view source files containing sensitive information or bypass authentication. The information disclosure vulnerability was previously published as VU975041. Description GoAhead WebServer contains vulnerabilities...

CVE-2008-5873

CVE-2008-5873 affects Yerba SACphp 6.3 and earlier. A remote attacker can bypass authentication and gain administrative access through a cookie named galleta[sesion] whose value begins with 1:1: followed by a username. The vulnerability enables partial impact on confidentiality, integrity, and av...

CVE-2008-3466

Microsoft Host Integration Server HIS 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function, aka "HIS...

CVE-2008-4540

Windows Mobile 6 on the HTC Hermes device makes WLAN passwords available to an auto-completion mechanism for the password input field, which allows physically proximate attackers to bypass password authentication and obtain WLAN access...

CVE-2008-4540

Windows Mobile 6 on the HTC Hermes device makes WLAN passwords available to an auto-completion mechanism for the password input field, which allows physically proximate attackers to bypass password authentication and obtain WLAN access...

CVE-2008-4081

admin/login.php in Stash 1.0.3 allows remote attackers to bypass authentication and gain administrative access by setting a bsm cookie...

CVE-2008-3602

admin/wradmin.php in PHP-Ring Webring System aka uPHPringwebsite 0.9.1 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1...

CVE-2008-3407

phpLinkat 0.1 allows remote attackers to bypass authentication and access unspecified pages under admin/ by sending a login=right cookie...

CVE-2008-3320

admin/index.php in Maian Guestbook 3.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary gbookcookie cookie...

CVE-2008-3211

Scripteen Free Image Hosting Script 1.2 and 1.2.1 allows remote attackers to bypass authentication and gain administrative access by setting the cookid cookie value to 1...

Maian Scripts Cookie Manipulation Authentication Bypass

The remote host is running at least one PHP application from Maian Script World that allows a remote attacker to bypass authentication and access the admin control panel by simply setting a special cookie. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

CVE-2008-2062

The Real-Time Information Server RIS Data Collector service in Cisco Unified Communications Manager CUCM before 4.23SR4, and 4.3 before 4.32SR1, allows remote attackers to bypass authentication, and obtain cluster configuration information and statistics, via a direct TCP connection to the servic...

CVE-2008-2730

The Real-Time Information Server RIS Data Collector service in Cisco Unified Communications Manager CUCM 5.x before 5.13 and 6.x before 6.11 allows remote attackers to bypass authentication, and obtain cluster configuration information and statistics, via a direct TCP connection to the service...

Authentication flaw

SNMPv3 HMAC verification in 1 Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; 2 UCD-SNMP; 3 eCos; 4 Juniper Session and Resource Control SRC C-series 1.0.0 through 2.0.0; 5 NetApp aka Network Appliance Data ONTAP 7.3RC1 and 7.3RC2; 6 SNMP Research before 16.2; 7...

CVE-2008-0960

SNMPv3 HMAC verification in 1 Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; 2 UCD-SNMP; 3 eCos; 4 Juniper Session and Resource Control SRC C-series 1.0.0 through 2.0.0; 5 NetApp aka Network Appliance Data ONTAP 7.3RC1 and 7.3RC2; 6 SNMP Research before 16.2; 7...

CVE-2008-2347

MyPicGallery 1.0 allows remote attackers to bypass application authentication and gain administrative access by setting the userID parameter to "admin" in a direct request to admin/addUser.php...

Authentication flaw

The admin.php file in Rantx allows remote attackers to bypass authentication and gain privileges by setting the logininfo cookie to "", which is present in the password file and probably passes an insufficient comparison...

CVE-2008-2297

The admin.php file in Rantx allows remote attackers to bypass authentication and gain privileges by setting the logininfo cookie to "", which is present in the password file and probably passes an insufficient comparison...

Authentication flaw

AustinSmoke GasTracker AS-GasTracker 1.0.0 allows remote attackers to bypass authentication and gain privileges by setting the gastrackeradmin cookie to TRUE...

CVE-2008-1880

The default configuration of Firebird before 2.0.3.12981.0-r6 on Gentoo Linux sets the ISCPASSWORD environment variable before starting Firebird, which allows remote attackers to bypass SYSDBA authentication and obtain sensitive database information via an empty password...