CVE-2009-3423

CVE-2009-3423 affects Zenas PaoLink 1.0. When login_globals is enabled, an attacker can bypass authentication by setting the login_ok parameter to 1 in login.php, gaining administrative access. The NVD entry records a CVSSv2 base score of 6.8 (MEDIUM) with network attack vector and no authenticat...

CVE-2009-3423

login.php in Zenas PaoLink 1.0, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3232

pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication...

CVE-2009-3231

CVE-2009-3231 affects PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14. When LDAP authentication is used with anonymous binds, an remote attacker could authenticate with an empty password, bypassing authentication. The issue is documented in multiple sources (e.g., PostgreSQL release notes for 8...

CVE-2009-3107: Improper Authentication

Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 does not properly restrict access to the listening port for the DBManager service, which allows remote attackers to bypass authentication and modify tasks or the Altiris Database via a connection to this service...

CVE-2008-7115

The web interface to the Belkin Wireless G router and ADSL2 modem F5D7632-4V6 with firmware 6.01.08 allows remote attackers to bypass authentication and gain administrator privileges via a direct request to 1 statusprocess.exe, 2 systemall.exe, or 3 restore.exe in cgi-bin/. NOTE: the setupdns.exe...

CVE-2008-7100

Unspecified vulnerability in DotNetNuke 4.4.1 through 4.8.4 allows remote authenticated users to bypass authentication and gain privileges via unknown vectors related to a "unique id" for user actions and improper validation of a "user identity."...

CVE-2008-6966

AJ Square AJ Auction Pro Platinum Skin 1 sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass authentication via a direct request to admin/user.php...

Authentication flaw

TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and 1 gain administrative privileges by setting the adm cookie to 1 or 2 gain privileges as another user by setting the logged cookie to the target username...

CVE-2008-6919

profileedit.php TaskDriver 1.3 and earlier allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to "fook!admin."...

CVE-2009-1977

CVE-2009-1977 affects Oracle Secure Backup (Administration Server) with an authentication bypass vulnerability that can lead to remote code execution via login.php and a vulnerable property_box.php. The NVD entry relates this to Oracle Secure Backup 10.2.0.3 and notes claims of bypassing authenti...

CVE-2008-6864

Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value...

Microsoft ISA Server Radius OTP Authentication Bypass Vulnerability

Description Microsoft ISA Server is prone to an authentication-bypass vulnerability. An attacker with knowledge of a valid account name can exploit this issue to bypass authentication and gain access to arbitrary resources within the context of the selected account. Technologies Affected Microsof...

CVE-2009-2257

The administrative web interface on the Netgear DG632 with firmware 3.4.0ap allows remote attackers to bypass authentication via a direct request to 1 gateway/commands/saveconfig.html, and 2 stattbl.htm, 3 modemmenu.htm, 4 onload.htm, 5 form.css, 6 utility.js, and possibly 7 indextop.htm in html/...

CVE-2009-2257

The administrative web interface on the Netgear DG632 with firmware 3.4.0ap allows remote attackers to bypass authentication via a direct request to 1 gateway/commands/saveconfig.html, and 2 stattbl.htm, 3 modemmenu.htm, 4 onload.htm, 5 form.css, 6 utility.js, and possibly 7 indextop.htm in html/...

CVE-2008-6714

CVE-2008-6714 affects xeCMS 1.0.0 RC2 and earlier. The admin.php module allows remote attackers to bypass authentication and access the admin panel by setting the xecms_username cookie, effectively elevating access without valid credentials. Root cause: authentication bypass via manipulated cooki...

Mandriva Update for proftpd MDKSA-2007:130 (proftpd)

Check for the Version of proftpd OpenVAS Vulnerability Test Mandriva Update for proftpd MDKSA-2007:130 proftpd Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

CVE-2008-6581

login.php in PhpAddEdit 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the addedit cookie parameter...

Authentication flaw

admin/Index.php in Acc Real Estate 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the usernamecookie to "admin."...

CVE-2008-6300

Galatolo WebManager 1.3a allows remote attackers to bypass authentication and gain administrative access by setting the 1 gwmuser and 2 gwmpass cookies to admin. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...