CVE-2009-1504: Improper Authentication

Absolute Form Processor XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting the xlaAFPadmin cookie to "lvl=1&userid=1."...

CVE-2009-0662: Improper Authentication

The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors...

CVE-2008-6743: Improper Authentication

RSMScript 1.21 allows remote attackers to bypass authentication and gain administrative privileges by setting the verified cookie to an arbitrary value and performing a direct request to 1 delete.php, 2 edit-submit.php, 3 edit.php, 4 submit.php, and 5 update.php, which bypasses the security check...

CVE-2008-6739: Improper Authentication

Todd Woolums ASP Download management script 1.03 does not require authentication for setupdownload.asp, which allows remote attackers to gain administrator privileges via a direct request...

CVE-2008-6718: Improper Authentication

U&M Software JustBookIt 1.0 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to 1 usermanual.php, 2 userconfig.php, 3 userkundnamn.php, 4 userkundlista.php, 5...

CVE-2008-6716: Improper Authentication

homeadmin/adminhome.php in Pre ADS Portal 2.0 and earlier does not require administrative authentication, which allows remote attackers to have an unspecified impact via a direct request...

CVE-2008-6719: Improper Authentication

U&M Software Event Lister aka JustListIt 1.0 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to 1 start.php, 2 aktivitet.php, 3 propaktivitet.php, 4 kategorier.php, 5 konfig.ph...

CVE-2008-6717: Improper Authentication

U&M Software Signup 1.0 and 1.1 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to 1 adminstart.php, 2 admineventtype.php, 3 admineventdetails.php, 4 admineventlist.php, 5...

CVE-2008-6707: Improper Authentication

The Web management interface in Avaya SIP Enablement Services SES 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, does not perform authentication for certain functionality, which allows remote attackers to obtain sensitive information and access restricted functionality via 1 the...

CVE-2009-1155: Improper Authentication

Cisco Adaptive Security Appliances ASA 5500 Series and PIX Security Appliances 7.11 through 7.1282, 7.2 before 7.2427, 8.0 before 8.0425, and 8.1 before 8.1215, when AAA override-account-disable is entered in a general-attributes field, allow remote attackers to bypass authentication and establis...

CVE-2008-6581: Improper Authentication

login.php in PhpAddEdit 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the addedit cookie parameter...

CVE-2003-1570: Improper Authentication

The server in IBM Tivoli Storage Manager TSM 5.1.x, 5.2.x before 5.2.1.2, and 6.x before 6.1 does not require credentials to observe the server console in some circumstances, which allows remote authenticated administrators to monitor server operations by establishing a console mode session,...

CVE-2009-0892: Improper Authentication

The administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3 allows attackers to hijack user sessions in "specific scenarios" related to a forced logout...

CVE-2008-6553: Improper Authentication

microcms-admin-home.php in Implied by Design Micro CMS Micro-CMS 3.5 aka 0.3.5 does not require authentication as an administrator, which allows remote attackers to 1 create administrative accounts via an addadmin action, 2 remove administrative accounts via a deleteadmin action, and 3 modify...

CVE-2009-0591: Improper Authentication

The CMSverify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid...

CVE-2008-6523: Improper Authentication

auth.php in openInvoice 0.90 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the oiauth cookie. NOTE: this can be leveraged with a separate vulnerability in resetpass.php to modify passwords for arbitrary users...

CVE-2009-0891: Improper Authentication

The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 7.0.0.1, 6.1 before Fix Pack 23 6.1.0.23,and 6.0.2 before Fix Pack 33 6.0.2.33 does not properly enforce 1 nonce and 2 timestamp expiration values in WS-Security bindings as stored in the...

CVE-2009-0085: Improper Authentication

The Secure Channel aka SChannel authentication component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, when certificate authentication is used, does not properly validate the client's key exchange data in Transport Layer Security TLS...

CVE-2009-0864: Improper Authentication

S-Cms 1.1 Stable allows remote attackers to bypass authentication and obtain administrative access via an OK value for the login cookie...

Authentication flaw

Unspecified vulnerability in YourPlace before 1.0.1 has unknown impact and attack vectors, possibly related to improper authentication and the ability to upload arbitrary PHP code. NOTE: some of these details are obtained from third party information...