CVE-2008-5219: Improper Authentication

The password change feature admin/cp.php in VideoScript 4.0.1.50 and earlier does not check for administrative authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified npass and npass1 parameters...

CVE-2008-5221: Improper Authentication

The accountsave action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified password and passwordretype parameters...

CVE-2008-5124: Improper Authentication

JSCAPE Secure FTP Applet 4.8.0 and earlier does not ask the user to verify a new or mismatched SSH host key, which makes it easier for remote attackers to perform man-in-the-middle attacks...

CVE-2006-5268: Improper Authentication

Unspecified vulnerability in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via vectors related to obtaining "administrative access to the RPC interface."...

CVE-2008-5065: Improper Authentication

TlGuestBook 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlGuestBooklogin cookie to admin...

CVE-2008-4784: Improper Authentication

aflog 1.01 allows remote attackers to bypass authentication and gain administrative access by setting the aflogautha cookie to "A" or "O" in 1 editdelete.php, 2 editcat.php, 3 editlock.php, and 4 editform.php...

CVE-2008-4708: Improper Authentication

BbZL.PhP 0.92 allows remote attackers to bypass authentication and gain administrative access by setting the phorumadminsession cookie to 1...

CVE-2008-3815: Improper Authentication

Unspecified vulnerability in Cisco Adaptive Security Appliances ASA 5500 Series and PIX Security Appliances 7.0 before 7.083, 7.1 before 7.1278, 7.2 before 7.2416, 8.0 before 8.046, and 8.1 before 8.1113, when configured as a VPN using Microsoft Windows NT Domain authentication, allows remote...

CVE-2008-4722: Improper Authentication

Unspecified vulnerability in Sun Integrated Lights-Out Manager ILOM 2.0.1.5 through 2.0.4.26 allows remote authenticated users to 1 access the service processor SP and cause a denial of service shutdown or reboot, or 2 access the host operating system and have an unspecified impact, via unknown...

CVE-2008-4689: Improper Authentication

Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions...

CVE-2008-4679: Improper Authentication

The Web Services Security component in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when Certificate Store Collections is configured to use Certificate Revocation Lists CRL, does not call the setRevocationEnabled method on the PKIXBuilderParameters object,...

CVE-2008-4622: Improper Authentication

The isLoggedIn function in fastnews-code.php in phpFastNews 1.0.0 allows remote attackers to bypass authentication and gain administrative access by setting the fn-loggedin cookie to 1...

CVE-2008-4614: Improper Authentication

PortalApp 4.0 does not require authentication for 1 forums.asp and 2 content.asp, which allows remote attackers to create and delete forums, topics, and replies...

CVE-2008-3466: Improper Authentication

Microsoft Host Integration Server HIS 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function, aka "HIS...

CVE-2008-4515: Improper Authentication

Blue Coat K9 Web Protection 4.0.230 Beta relies on client-side JavaScript as a protection mechanism, which allows remote attackers to bypass authentication and access the 1 summary, 2 detail, 3 overrides, and 4 pwemail pages by disabling JavaScript...

CVE-2008-4427: Improper Authentication

changepassword.php in Phlatline's Personal Information Manager pPIM 1.0 and earlier does not require administrative authentication, which allows remote attackers to change arbitrary passwords...

CVE-2008-4244: Improper Authentication

Rianxosencabos CMS 0.9 allows remote attackers to bypass authentication and gain administrative access by setting the usuario and pass cookies to 1...

CVE-2008-4167: Improper Authentication

useradmin.php in Easy Photo Gallery aka Ezphotogallery 2.1 does not require administrative authentication, which allows remote attackers to 1 add or 2 remove an Administrator account...

CVE-2008-4146: Improper Authentication

Addalink 1.0 beta 4 and earlier allows remote attackers to 1 approve web-site additions via a modified approved field and 2 change the visit-counter value via a modified counter field...

CVE-2008-3610: Improper Authentication

Race condition in Login Window in Apple Mac OS X 10.5 through 10.5.4, when a blank-password account is enabled, allows attackers to bypass password authentication and login to any account via multiple attempts to login to the blank-password account, followed by selection of an arbitrary account...