Directory traversal

Directory traversal vulnerability in error.php in GuppY 4.6.3, 4.5.16, and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the id parameter. NOTE: this can be leveraged to bypass authentication and upload arbitrary files by including...

CVE-2007-5845

Directory traversal vulnerability in error.php in GuppY 4.6.3, 4.5.16, and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the id parameter. NOTE: this can be leveraged to bypass authentication and upload arbitrary files by including...

CVE-2003-1341

The default installation of Trend Micro OfficeScan 3.0 through 3.54 and 5.x allows remote attackers to bypass authentication from cgiChkMasterPasswd.exe and gain access to the web management console via a direct request to cgiMasterPwd.exe...

CVE-2007-4632

Cisco IOS 12.2E, 12.2F, and 12.2S places a "no login" line into the VTY configuration when an administrator makes certain changes to a 1 VTY/AUX or 2 CONSOLE setting on a device without AAA enabled, which allows remote attackers to bypass authentication and obtain a terminal session, a different...

CVE-2007-4548

The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with...

Lanius CMS 1.2.14 - Multiple SQL Injections

Lanius CMS 1.2.14 - Multiple SQL Injections newhackdotorg la-nai cmsv1.2.14 - Remote SQL Injection Vendor : http://www.redlinesoft.net/module.php?modname=content&cid=9 Download : http://sourceforge.net/project/showfiles.php?groupid=191629 Found By : k1tk4t - k1tk4t4tnewhack.org http://newhack.org...

CVE-2007-3986

CVE-2007-3986 affects Secure Computing SecurityReporter (aka Network Security Analyzer) 4.6.3. The issue is in the file.cgi component where the name parameter can specify an eventcache directory and a non-GIF file, bypassing authentication by setting the $dontvalidate variable. A separate travers...

CVE-2007-2783

Technical details are not publicly available in the provided documents. Monitor for updates.

Authentication flaw

The Login Window in Apple Mac OS X 10.4 through 10.4.9 does not display the screen saver authentication dialog in certain circumstances when waking from sleep, even though the "require a password to wake the computer from sleep" option is enabled, which allows local users to bypass authentication...

CVE-2007-0738

The Login Window in Apple Mac OS X 10.4 through 10.4.9 does not display the screen saver authentication dialog in certain circumstances when waking from sleep, even though the "require a password to wake the computer from sleep" option is enabled, which allows local users to bypass authentication...

CVE-2007-2165

The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as...

Authentication flaw

USB20.dll in Secustick USB flash drive decouples the authorization and file access routines, which allows local users to bypass authentication requirements by altering the return value of the VerifyPassWord function...

CVE-2007-2007

admin.php in pL-PHP beta 0.9 allows remote attackers to bypass authentication by setting the isadmin parameter to 1...

Directory traversal

Directory traversal vulnerability in am.pl in SQL-Ledger 2.6.27 only checks for the presence of a NULL %00 character to protect against directory traversal attacks, which allows remote attackers to run arbitrary executables and bypass authentication via a .. dot dot sequence in the login paramete...

CVE-2007-1437

Unspecified vulnerability in LedgerSMB before 1.1.5 and SQL-Ledger before 2.6.25 allows remote attackers to overwrite files and possibly bypass authentication, and remote authenticated users to execute unauthorized code, by calling a custom error function that returns from execution...

Authentication flaw

Unspecified vulnerability in LedgerSMB before 1.1.5 and SQL-Ledger before 2.6.25 allows remote attackers to overwrite files and possibly bypass authentication, and remote authenticated users to execute unauthorized code, by calling a custom error function that returns from execution...

CVE-2006-7161

The CVE-2006-7161 entry describes an SQL injection flaw in Hazir Site 2.0, specifically in giris_yap.asp, that enables remote attackers to bypass authentication via the k_a class or sifre parameter. The vulnerability is evidenced in multiple sources (NVD/NVD CVE record) and aligns with a high-sev...

CVE-2007-1156

CVE-2007-1156 affects JBrowser, where a direct request to the admin path (_admin/) allows remote attackers to bypass authentication and access administrative capabilities. The primary impact is unauthorized access to administrative functions, with the NVD entry listing a CVSS v2 base score of 7.5...

CVE-2007-0874

Allonsvoter 1.0 allows remote attackers to bypass authentication and access certain administrative functionality via a direct request for 1 adminajouter.php or 2 adminsupprimer.php. NOTE: this could be leveraged to conduct cross-site scripting XSS attacks...

CVE-2007-0844

The authviakey function in pamssh.c in pamssh before 1.92, when the allowblankpassphrase option is disabled, allows remote attackers to bypass authentication restrictions and use private encryption keys requiring a blank passphrase by entering a non-blank passphrase...