CVE-2007-4548: Improper Authentication

The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with...

CVE-2007-4419: Improper Authentication

Admin.php in Olate Download od 3.4.1 uses an MD5 hash of the admin username, user id, and group id, to compose the OD3AutoLogin authentication cookie, which makes it easier for remote attackers to guess the cookie and access the Admin area...

CVE-2007-4364: Improper Authentication

Fedora Commons before 2.2.1 does not properly handle certain authentication requests involving Java Naming and Directory Interface JNDI, related to 1 a nonexistent account name in combination with an empty password, which allows remote attackers to trigger a certain "unexpected / strange response...

CVE-2007-4043: Improper Authentication

file.cgi in Secure Computing SecurityReporter aka Network Security Analyzer before 4.6.3 allows remote attackers to bypass authentication via a name parameter ending with a "%00.gif" sequence. NOTE: a separate traversal vulnerability could be leveraged to download arbitrary files...

CVE-2007-3184: Improper Authentication

Cisco Trust Agent CTA before 2.1.104.0, when running on MacOS X, allows attackers with physical access to bypass authentication and modify System Preferences, including passwords, by invoking the Apple Menu when the Access Control Server ACS produces a user notification message after posture...

CVE-2007-2555: Improper Authentication

Unspecified vulnerability in Default.aspx in Podium CMS allows remote attackers to have an unknown impact, possibly session fixation, via a META HTTP-EQUIV Set-cookie expression in the id parameter, related to "cookie manipulation." NOTE: this issue might be cross-site scripting XSS...

CVE-2007-1859: Improper Authentication

XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver to crash and unlock the screen and allows local users to bypass authenticati...

CVE-2007-2243: Improper Authentication

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...

CVE-2007-1480: Improper Authentication

Creative Guestbook 1.0 allows remote attackers to add an administrative account via a direct request to createadmin.php with Name, Email, and PASSWORD parameters set...

CVE-2007-1228: Improper Authentication

IBM DB2 UDB 8.2 before Fixpak 7 aka fixpack 14, and DB2 9 before Fix Pack 2, on UNIX allows the "fenced" user to access certain unauthorized directories...

CVE-2007-1062: Improper Authentication

The Cisco Unified IP Conference Station 7935 3.215 and earlier, and Station 7936 3.312 and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface for a limited time...

CVE-2007-0435: Improper Authentication

T-Com Speedport 500V routers with firmware 1.31 allow remote attackers to bypass authentication and reconfigure the device via a LOGINKEY=TECOM cookie value...

CVE-2006-4244: Improper Authentication

SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-username cookie matches the value of the sessionid parameter, which allows remote attackers to gain access as any logged-in user by setting the cookie and the parameter to the same value...

CVE-2006-2113: Improper Authentication

The embedded HTTP server in Fuji Xerox Printing Systems FXPS print engine, as used in products including 1 Dell 3000cn through 5110cn and 2 Fuji Xerox DocuPrint firmware before 20060628 and Network Option Card firmware before 5.13, does not properly perform authentication for HTTP requests, which...

CVE-2006-2636: Improper Authentication

newsadmin.asp in Katy Whitton NewsCMSLite allows remote attackers to bypass authentication and gain administrative access by setting the loggedIn cookie to "xY1zZoPQ"...

CVE-2006-2224: Improper Authentication

RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly enforce RIPv2 authentication requirements, which allows remote attackers to modify routing state via RIPv1 RESPONSE packets...

CVE-2006-0633: Improper Authentication

The makepassword function in ipsclass.php in Invision Power Board IPB 2.1.4 uses random data generated from partially predictable seeds to create the authentication code that is sent by e-mail to a user with a lost password, which might make it easier for remote attackers to guess the code and...

CVE-2006-0374: Improper Authentication

Advantage Century Telecommunication ACT P202S IP Phone 1.01.21 running firmware 1.1.21 has multiple undocumented ports available, which 1 might allow remote attackers to obtain sensitive information, such as memory contents and internal operating-system data, by directly accessing the VxWorks WDB...

CVE-2005-4006: Improper Authentication

SAPID CMS before 1.2.3.03 allows remote attackers to bypass authentication via direct requests to the usr/system files 1 insertfile.php, 2 insertimage.php, 3 insertlink.php, 4 insertqcfile.php, and 5 edit.php...

CVE-2005-3979: Improper Authentication

relocateserver.php in Coppermine Photo Gallery CPG 1.4.2 and 1.4 beta is not removed after installation and does not use authentication, which allows remote attackers to obtain sensitive information, such as database configuration, via a direct request...