CVE-2012-5887: Improper Authentication

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended...

CVE-2012-4613: Improper Authentication

EMC RSA Data Protection Manager Appliance 2.7.x and 3.x before 3.2.1 does not properly restrict the number of authentication attempts by a user account, which makes it easier for local users to bypass intended access restrictions via a brute-force attack...

ESA-2012-055: RSA® Data Protection Manager Multiple Vulnerabilities

ESA-2012-055.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2012-055: RSA® Data Protection Manager Multiple Vulnerabilities EMC Identifier: ESA-2012-055 CVE Identifier: CVE-2012-4612, CVE-2012-4613 Severity Rating: See below for individual scores and refer vendor advisories for component...

CVE-2012-4021: Improper Authentication

MosP kintai kanri before 4.1.0 does not properly perform authentication, which allows remote authenticated users to impersonate arbitrary user accounts, and consequently obtain sensitive information or modify settings, via unspecified vectors...

CVE-2012-3315: Improper Authentication

The Java servlets in the management console in IBM Tivoli Federated Identity Manager TFIM through 6.2.2 and Tivoli Federated Identity Manager Business Gateway TFIMBG before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE securi...

CVE-2012-4659: Improper Authentication

The AAA functionality in the IPv4 SSL VPN implementations on Cisco Adaptive Security Appliances ASA 5500 series devices, and the ASA Services Module ASASM in Cisco Catalyst 6500 series devices, with software 8.2 before 8.25.30 and 8.3 before 8.32.34 allows remote attackers to cause a denial of...

ATutor 1.2 - Multiple Vulnerabilities

ATutor 1.2 - Multiple Vulnerabilities Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authenticatio...

ATutor 1.2 - Multiple Vulnerabilities

Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79...

ATutor 1.2 Multiple Vulnerabilities

SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79 CVE References: CVE-2012-5167, CVE-2012-5168, CVE-2012-5169 CVSSv2 Base Scores: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P, 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P, 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Product: AContent Vendor: ATutor...

ATutor AContent 1.2 XSS / Authentication / SQL Injection

Advisory ID: HTB23117 Product: AContent Vendor: ATutor Vulnerable Versions: 1.2 and probably prior Tested Version: 1.2 Vendor Notification: September 26, 2012 Public Disclosure: October 17, 2012 Vulnerability Type: SQL Injection CWE-89, Improper Authentication CWE-287, Cross-Site Scripting CWE-79...

CVE-2012-4457: Improper Authentication

OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant...

CVE-2012-5351: Improper Authentication

Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418...

CVE-2012-4456: Improper Authentication

The 1 OS-KSADM/services and 2 tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services...

CVE-2012-5309: Improper Authentication

servlet/traveler in IBM Lotus Notes Traveler through 8.5.3.3 Interim Fix 1 does not properly restrict invalid authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2012-3520: Improper Authentication

The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCMCREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to 1 Avahi or 2 NetworkManager...

CVE-2012-3492: Improper Authentication

The filesystem authentication condorio/condorauthfs.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 uses authentication directories even when they have weak permissions, which allows remote attackers to impersonate users by renaming a user's authentication directory...

CVE-2012-3137: Improper Authentication

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force...

CVE-2012-3741: Improper Authentication

The Restrictions aka Parental Controls implementation in Apple iOS before 6 does not properly handle purchase attempts after a Disable Restrictions action, which allows local users to bypass an intended Apple ID authentication step via an app that performs purchase transactions...

CVE-2012-3721: Improper Authentication

Profile Manager in Apple Mac OS X before 10.7.5 does not properly perform authentication for the Device Management private interface, which allows attackers to enumerate managed devices via unspecified vectors...

CVE-2012-4926: Improper Authentication

approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activation of administrators via the u parameter in an 1 app0 disable or 2 app1 enable action...