CVE-2009-3923: Improper Authentication

The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure VDI 3.0 does not require authentication, which allows remote attackers to obtain unspecified access via vectors involving requests to an Apache HTTP Server...

CVE-2009-3862: Improper Authentication

The NDSD process in Novell eDirectory 8.7.3 before 8.7.3.10 ftf2 and eDirectory 8.8 before 8.8.5 ftf1 does not properly handle certain LDAP search requests, which allows remote attackers to cause a denial of service application hang via a search request with a NULL BaseDN value...

CVE-2009-3635: Improper Authentication

The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to gain access by using only the password's md5 hash as a credential...

CVE-2009-3481: Improper Authentication

A certain interface in the iCRM Basic comicrmbasic component 1.4.2.31 for Joomla! does not require administrative authentication, which has unspecified impact and remote attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party informati...

CVE-2009-3423: Improper Authentication

login.php in Zenas PaoLink 1.0, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3421: Improper Authentication

login.php in Zenas PaoBacheca Guestbook 2.1, when registerglobals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the loginok parameter to 1...

CVE-2009-3261: Improper Authentication

update/update0.1.2to0.2.php in LiveStreet 0.2 does not require administrative authentication, which allows remote attackers to perform DROP TABLE operations via unspecified vectors...

CVE-2009-3232: Improper Authentication

pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication...

Improper Authentication Mechanism in 3Com Wireless8760 Dual Radio 11a/b/g Poe Access Point

Hi My name is Yossi Yakubov and i am a security researcher. Recently me and my collegues found the following vulnerability in the 3Com Wireless8760 web administration interface: If one user is authenticated to the web interface, other users can access to internal pages without further...

CVE-2009-3158: Improper Authentication

admin/files.php in simplePHPWeb 0.2 does not require authentication, which allows remote attackers to perform unspecified administrative actions via unknown vectors. NOTE: some of these details are obtained from third party information...

CVE-2009-3107: Improper Authentication

Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 does not properly restrict access to the listening port for the DBManager service, which allows remote attackers to bypass authentication and modify tasks or the Altiris Database via a connection to this service...

CVE-2009-2697: Improper Authentication

The Red Hat build script for the GNOME Display Manager GDM before 2.16.0-56 on Red Hat Enterprise Linux RHEL 5 omits TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions via XDMCP connections, a different vulnerability than CVE-2007-5079...

CVE-2008-7156: Improper Authentication

EkinBoard 1.1.0 and earlier, when registerglobals is enabled, allows remote attackers to bypass authorization and gain administrator privileges by setting the groups parameter to 2, as demonstrated via backup.php...

CVE-2008-7124: Improper Authentication

zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers to gain administrator privileges via a direct request, as demonstrated by adding a new administrator...

CVE-2008-7081: Improper Authentication

userHandler.cgi in RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1 allows remote attackers to bypass authentication and gain administrator privileges by setting the login parameter to admin. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-7028: Improper Authentication

RPG.Board 0.8 Beta2 and earlier allows remote attackers to bypass authentication and gain privileges by setting the keep4u cookie to a certain value...

CVE-2008-7027: Improper Authentication

Libra File Manager 1.18 and earlier allows remote attackers to bypass authentication and gain privileges by setting the user and pass cookies to 1...

CVE-2008-7007: Improper Authentication

Free PHP VX Guestbook 1.06 allows remote attackers to bypass authentication and gain administrative access by setting the 1 adminname and 2 adminpass cookie values to 1...

CVE-2008-6984: Improper Authentication

Plesk 8.6.0, when short mail login names SHORTNAMES are enabled, allows remote attackers to bypass authentication and send spam e-mail via a message with 1 a base64-encoded username that begins with a valid shortname, or 2 a username that matches a valid password, as demonstrated using a SMTP and...

CVE-2009-0906: Improper Authentication

The Service Component Architecture SCA feature pack for IBM WebSphere Application Server WAS SCA 1.0 before 1.0.0.3 allows remote authenticated users to bypass intended authentication.transport access restrictions and obtain unspecified access via unknown vectors...