CVE-2009-4806: Improper Authentication

admin/saveuser.asp in Digital Interchange Document Library 1.0.1 does not require administrative authentication, which allows remote attackers to read or modify the administrator's credentials via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2009-4801: Improper Authentication

EZ-Blog Beta 1 does not require authentication, which allows remote attackers to create or delete arbitrary posts via requests to PHP scripts...

CVE-2010-0744: Improper Authentication

aMSN aka Alvaro's Messenger 0.98.3 and earlier, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name CN field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof an MSN server via ...

CVE-2010-1221: Improper Authentication

CA XOsoft r12.0 and r12.5 does not properly perform authentication, which allows remote attackers to enumerate usernames via a SOAP request...

CVE-2010-1222: Improper Authentication

CA XOsoft r12.5 does not properly perform authentication, which allows remote attackers to obtain potentially sensitive information via a SOAP request...

CVE-2009-2936: Improper Authentication

The Command Line Interface aka Server CLI or administration interface in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to 1 execute arbitrary code via a vcl.inline...

CVE-2010-1191: Improper Authentication

Sahana disaster management system 0.6.2.2, and possibly other versions, allows remote attackers to bypass intended access restrictions and disable administrator authentication via a direct request to stream.php in an aclenableacl action to the admin module...

CVE-2010-0498: Improper Authentication

Directory Services in Apple Mac OS X before 10.6.3 does not properly perform authorization during processing of record names, which allows local users to gain privileges via unspecified vectors...

CVE-2010-0521: Improper Authentication

Server Admin in Apple Mac OS X Server before 10.6.3 does not properly enforce authentication for directory binding, which allows remote attackers to obtain potentially sensitive information from Open Directory via unspecified LDAP requests...

CVE-2010-1097: Improper Authentication

include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.autostart is enabled, allows remote attackers to bypass authentication and gain administrative access via a value of 1 for the SESSIONdedeadminid parameter, as demonstrated by a request to uploads/include/dialog/selectsoftpost.php...

CVE-2010-1040: Improper Authentication

The "IP address range limitation" function in OpenPNE 1.6 through 1.8, 2.0 through 2.8, 2.10 through 2.14, and 3.0 through 3.4, when mobile device support is enabled, allows remote attackers to bypass the "simple login" functionality via unknown vectors related to spoofing...

ZKSoftware Biometric Attendence managnmnet Hardware [MIPS] Vuln

Exploit for hardware platform in category remote exploits ================================================================================= ZKSoftware Biometric Attendence managnmnet HardwareMIPS Improper Authentication...

ZKSoftware Biometric Attendence Managnmnet Hardware[MIPS] 2 - Improper Authentication

Exploit Title: ZKSoftware Biometric Attendence managnmnet HardwareMIPS Improper Authentication. Date: 20-3-2010 Author: FB1H2S Software Link: http://www.esslindia.com/install/eTimeTrack.zip Version: V2 Tested on: category: Remote Code : Advisory ZKSoftware Biometric Attendence management...

CVE-2010-1022: Improper Authentication

The TYPO3 Security - Salted user password hashes t3secsaltedpw extension before 0.2.13 for TYPO3 allows remote attackers to bypass authentication via unspecified vectors...

CVE-2009-4670: Improper Authentication

admin/delitem.php in RoomPHPlanning 1.6 does not require authentication, which allows remote attackers to 1 delete arbitrary users via the user parameter or 2 delete arbitrary rooms via the room parameter...

CVE-2009-4675: Improper Authentication

admin/admininfo/index.php in the Mole Group Gastro Portal Restaurant Directory Script does not require administrative authentication, which allows remote attackers to change the admin password via an unspecified form submission...

CVE-2009-4657: Improper Authentication

The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter application settings by connecting to the application on port 32123, as demonstrated by setting the action option to wizardStep1...

CVE-2010-0554: Improper Authentication

The HTTP Authentication implementation in Geo++ GNCASTER 1.4.0.7 and earlier uses the same nonce for all authentication, which allows remote attackers to hijack web sessions or bypass authentication via a replay attack...

CVE-2010-0550: Improper Authentication

admin.htm in Geo++ GNCASTER 1.4.0.7 and earlier does not properly enforce HTTP Digest Authentication, which allows remote authenticated users to use HTTP Basic Authentication, bypassing intended server policy...

CVE-2010-0014: Improper Authentication

System Security Services Daemon SSSD before 1.0.1, when the krb5 authprovider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting...