1155 matches found
CVE-2006-0607
check.php in Hinton Design phphd 1.0 does not check passwords when certain cookies are provided, which allows remote attackers to bypass authentication...
Sql injection
SQL injection vulnerability in the Authentication Servlet in Symantec Sygate Management Server SMS version 4.1 build 1417 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via unknown attack vectors related to a URL...
Sql injection
SQL injection vulnerability in login.php in miniBloggie 1.0 and earlier, when gpcmagicquotes is disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 username and 2 password parameters...
CVE-2006-0412
SQL injection vulnerability in CyberShop allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action...
Sql injection
SQL injection vulnerability in WebspotBlogging 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter to login.php...
Sql injection
SQL injection vulnerability in admin/processlogin.php in Bit 5 Blog 8.01 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 username and 2 password parameter...
CVE-2006-0312
CVE-2006-0312 affects aoblogger 2.3. A flaw in create.php allows remote attackers to bypass authentication and create new blog entries by setting the uza parameter to 1. The root cause is an authentication bypass in the creation flow, enabling unauthorized post creation. Affected component: creat...
CVE-2006-0135
SQL injection vulnerability in login.php in TheWebForum twf 1.2.1 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the username parameter aka the u variable...
CVE-2005-3968
SQL injection vulnerability in auth.inc.php in PHPX 3.5.9 and earlier allows remote attackers to execute arbitrary SQL commands, bypass authentication, and upload arbitrary PHP code via the username parameter...
CVE-2005-3819
Multiple SQL injection vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbitrary SQL commands and bypass authentication via the 1 username and 2 date parameter in the HelpDesk module...
CVE-2005-3697
Unspecified vulnerability in the administration interface in Uresk Links 2.0 Lite allows remote attackers to bypass authentication via unspecified vectors in index.php...
CVE-2005-3697
CVE-2005-3697 affects Uresk Links 2.0 Lite. A vulnerability in the administration interface allows remote attackers to bypass authentication via unspecified vectors in index.php. The NVD entry lists CVSS v2 base score 7.5 (network, low complexity, no auth required; partial impact on confidentiali...
CVE-2005-3697
Unspecified vulnerability in the administration interface in Uresk Links 2.0 Lite allows remote attackers to bypass authentication via unspecified vectors in index.php...
CVE-2005-3641
Oracle Databases running on Windows XP with Simple File Sharing enabled, allows remote attackers to bypass authentication by supplying a valid username...
CVE-2005-3596
SQL injection vulnerability in ASPKnowledgebase allows remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 username and 2 password fields in adminlogin.asp...
MailWatch authenticate() Function SQL Injection
The remote host appears to be running MailWatch, a web-based frontend to MailScanner written in PHP. The version of MailWatch installed on the remote host fails to sanitize the username and password before using them in database queries in the 'authenticate' function of 'functions.php'. This issu...
CVE-2005-3386
SQL injection vulnerability in Techno Dreams Web Directory script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...
CVE-2005-3383
CVE-2005-3383 is a SQL injection vulnerability in Techno Dreams Announcement script, exploitable via the userid parameter in admin/login.asp. Affected component is the login/authentication flow; root cause is unsafely constructed SQL queries allowing remote attackers to execute arbitrary SQL and ...
CVE-2005-0357
EMC Legato NetWorker, Sun Solstice Backup 6.0 and 6.1, and StorEdge Enterprise Backup 7.0 through 7.2 rely on AUTHUNIX authentication, which relies on user ID for authentication and allows remote attackers to bypass authentication and gain privileges by spoofing a username or UID...