CVE-2015-5998: Improper Authentication

Impero Education Pro before 5105 relies on the -1|AUTHENTICATE\x02PASSWORD string for authentication, which allows remote attackers to execute arbitrary programs via an encrypted command...

Impero Education Pro classroom management software vulnerable to remote code execution

Overview Impero Software Education Pro classroom management software is vulnerable to remote code execution via improper encryption and authentication mechanisms. Description CWE-321: Use of Hard-coded Cryptographic KeyCWE-329: Not Using a Random IV with CBC Mode - CVE-2015-5997 According to the...

CVE-2015-6266: Improper Authentication

The guest portal in Cisco Identity Services Engine ISE 3300 1.20.899 does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive information from customized documents via a direct request, aka Bug ID CSCuo78045...

CVE-2015-3775: Improper Authentication

Apple OS X before 10.10.5 does not properly implement authentication, which allows local users to obtain admin privileges via unspecified vectors...

SolarWinds Storage Manager AuthenticationFilter Policy Bypass

A policy bypass vulnerability has been reported in SolarWinds Storage Manager. The vulnerability is due to an issue where the AuthenticationFilter class fails to properly authenticate users prior to processing requests.A remote unauthenticated user can exploit this vulnerability by sending a...

Cisco Firepower 9000 Series Unauthenticated Web Page Vulnerability

A vulnerability in the web interface of the Cisco Firepower 9000 device could allow an unauthenticated, remote attacker to access a web page that should be restricted. The vulnerability is due to improper authentication validation. An attacker could exploit this vulnerability by accessing a certa...

CVE-2015-4453: Improper Authentication

interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by 1 interface/fax/faxdispatchnewpid.php and 2 interface/billing/sleobsearch.php...

CVE-2015-1330: Improper Authentication

unattended-upgrades before 0.86.1 does not properly authenticate packages when the 1 force-confold or 2 force-confnew dpkg options are enabled in the DPkg::Options:: apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors...

CVE-2014-4882: Improper Authentication

Aptexx Resident Anywhere does not require authentication, which allows remote attackers to obtain sensitive information or modify data via a direct request...

ManageEngine SupportCenter Plus 7.90 - Multiple Vulnerabilities

Document Title: =============== ManageEngine SupportCenter Plus 7.90 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1501 Release Date: ============= 2015-06-19 Vulnerability Laboratory ID VL-ID:...

CVE-2015-2117: Improper Authentication

HP TippingPoint Security Management System SMS and TippingPoint Virtual Security Management System vSMS before 4.1 patch 3 and 4.2 before patch 1 do not require authentication for JBoss RMI requests, which allows remote attackers to execute arbitrary code by 1 uploading this code within an archiv...

CVE-2015-2823: Improper Authentication

Siemens SIMATIC HMI Basic Panels 2nd Generation before WinCC TIA Portal 13 SP1 Upd2, SIMATIC HMI Comfort Panels before WinCC TIA Portal 13 SP1 Upd2, SIMATIC WinCC Runtime Advanced before WinCC TIA Portal 13 SP1 Upd2, SIMATIC WinCC Runtime Professional before WinCC TIA Portal 13 SP1 Upd2, SIMATIC...

CVE-2015-0198: Improper Authentication

IBM General Parallel File System GPFS 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 in certain cipherList configurations allows remote attackers to bypass authentication and execute arbitrary programs as root via unspecified vectors...

CVE-2015-0670: Improper Authentication

The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482...

CVE-2015-0607: Improper Authentication

The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a...

CVE-2015-2033: Improper Authentication

Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request...

CVE-2014-9043: Improper Authentication

The userldap aka LDAP user and group backend application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind...

CVE-2014-9045: Improper Authentication

The FTP backend in userexternal in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted password...

CVE-2014-8033: Improper Authentication

The play/modules component in Cisco WebEx Meetings Server allows remote attackers to obtain administrator access via crafted API requests, aka Bug ID CSCuj40421...

CVE-2014-9578: Improper Authentication

VDG Security SENSE formerly DIVA 2.3.13 performs authentication with a password hash instead of a password, which allows remote attackers to gain login access by leveraging knowledge of a password hash...