CVE-2014-2955: Improper Authentication

Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...

CVE-2013-6117: Improper Authentication

Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777...

CVE-2014-3312: Improper Authentication

The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435...

CVE-2014-4668: Improper Authentication

The cherokeevalidatorldapcheck function in validatorldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password...

ZKSoftware Biometric Attendence Managnmnet Hardware[MIPS] 2 - Improper Authentication

No description provided by source. Exploit Title: ZKSoftware Biometric Attendence managnmnet HardwareMIPS Improper Authentication. Date: 20-3-2010 Author: FB1H2S Software Link: http://www.esslindia.com/install/eTimeTrack.zip Version: V2 Tested on: category: Remote Code : Advisory ZKSoftware...

C.P.Sub 4.5 - Authentication Bypass

No description provided by source. !/usr/bin/python Exploit Title: C.P.Sub = v4.5 Misconfiguration and Improper Authentication Date: 2013/6/27 Exploit Author: Chako Vendor Homepage: http://www.cooltey.org/ping/php.php Software Download Link: http://cooltey.myweb.hinet.net/cpsubv4.5.zip Version: =...

CVE-2014-2005: Improper Authentication

Sophos Disk Encryption SDE 5.x in Sophos Enterprise Console SEC 5.x before 5.2.2 does not enforce intended authentication requirements for a resume action from sleep mode, which allows physically proximate attackers to obtain desktop access by leveraging the absence of a login screen...

CVE-2014-2609: Improper Authentication

The Java Glassfish Admin Console in HP Executive Scorecard 9.40 and 9.41 does not require authentication, which allows remote attackers to execute arbitrary code via a session on TCP port 10001, aka ZDI-CAN-2116...

CVE-2014-3295: Improper Authentication

The HSRP implementation in Cisco NX-OS 6.22a and earlier allows remote attackers to bypass authentication and cause a denial of service group-member state modification and traffic blackholing via malformed HSRP packets, aka Bug ID CSCup11309...

CVE-2013-0191: Improper Authentication

libpam-pgsql aka pampgsql 0.7 does not properly handle a NULL value returned by the password search query, which allows remote attackers to bypass authentication via a crafted password...

CVE-2013-6470: Improper Authentication

The default configuration in the standalone controller quickstack manifest in openstack-foreman-installer, as used in Red Hat Enterprise Linux OpenStack Platform 4.0, disables authentication for Qpid, which allows remote attackers to gain access by connecting to Qpid...

CVE-2014-3277: Improper Authentication

The Administration GUI in the web framework in VOSS in Cisco Unified Communications Domain Manager CDM 9.0.1 and earlier does not properly implement access control, which allows remote authenticated users to obtain sensitive user and group information by leveraging Location Administrator privileg...

CVE-2013-2193: Improper Authentication

Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via unspecified vectors...

CVE-2013-4178: Improper Authentication

The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to obtain access by replaying the username, password, and one-time password OTP...

CVE-2014-0214: Improper Authentication

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

CVE-2012-6452: Improper Authentication

Axway Secure Messenger before 6.5 Updated Release 7, as used in Axway Email Firewall, provides different responses to authentication requests depending on whether the user exists, which allows remote attackers to enumerate users via a series of requests...

CVE-2013-3977: Improper Authentication

The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to determine which meeting rooms are owned by a user by leveraging knowledge of valid user names...

CVE-2013-3046: Improper Authentication

The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not send the HSTS Strict-Transport-Security header, which makes it easier for man-in-the-middle attackers to hijack sessions or obtain sensitive information by leveraging the presence of HTTP requests...

CVE-2013-2756: Improper Authentication

Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform formerly Citrix CloudStack 3.0.x before 3.0.6 Patch C allows remote attackers to bypass the console proxy authentication by leveraging knowledge of the source code...

CVE-2014-2938: Improper Authentication

Hanvon FaceID before 1.007.110 does not require authentication, which allows remote attackers to modify access-control and attendance-tracking data via API commands...