195 matches found
JON: LDAP authentication allows any user access if bind credentials are bad
Red Hat JBoss Operations Network JON 3.0.x before 3.0.1, 2.4.2, and earlier, when LDAP authentication is enabled and the LDAP bind account credentials are invalid, allows remote attackers to login to LDAP-based accounts via an arbitrary password in a login request...
CVE-2011-1025
bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name DN, which allows remote attackers to bypass intended access restrictions via an arbitrary password...
CVE-2009-4674
admin/admin.php in Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script allows remote attackers to change an arbitrary password via a modified userid field...
CVE-2010-0014
System Security Services Daemon SSSD before 1.0.1, when the krb5 authprovider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting...
Default configuration
The default configuration of SQL-Ledger 2.8.24 allows remote attackers to perform unspecified administrative operations by providing an arbitrary password to the admin interface...
CVE-2009-4402
The default configuration of SQL-Ledger 2.8.24 allows remote attackers to perform unspecified administrative operations by providing an arbitrary password to the admin interface...
DEBIAN-CVE-2009-4402
The default configuration of SQL-Ledger 2.8.24 allows remote attackers to perform unspecified administrative operations by providing an arbitrary password to the admin interface...
CVE-2009-4402
The default configuration of SQL-Ledger 2.8.24 allows remote attackers to perform unspecified administrative operations by providing an arbitrary password to the admin interface...
CVE-2009-4402
The default configuration of SQL-Ledger 2.8.24 allows remote attackers to perform unspecified administrative operations by providing an arbitrary password to the admin interface...
CVE-2008-7050
The passwordcheck function in auth/authphpbb3.php in WoW Raid Manager 3.5.1 before Patch 1, when using PHPBB3 authentication, 1 does not invoke the CheckPassword function with the required arguments, which always triggers an authentication failure, and 2 returns true instead of false when an...
CVE-2003-1574
TikiWiki 1.6.1 allows remote attackers to bypass authentication by entering a valid username with an arbitrary password, possibly related to the Internet Explorer "Remember Me" feature. NOTE: some of these details are obtained from third party information...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in WebCollab before 2.50 aka Billy Goat allow remote attackers to hijack the authentication of administrators for requests that change an arbitrary password or have other unspecified impact...
Simple Machines Forum Validation Code Prediction Arbitrary Password Reset
The remote host is running Simple Machines Forum SMF, an open source web forum application written in PHP. The version of Simple Machines Forum installed on the remote host generates validation codes for its password reset functionality with 'rand', which on Windows platforms has a maximum value ...
CVE-2008-1268
The FTP server on the Linksys WRT54G 7 router with 7.00.1 firmware does not verify authentication credentials, which allows remote attackers to establish an FTP session by sending an arbitrary username and password...