CVE-2008-3611: Improper Authentication

Login Window in Apple Mac OS X 10.4.11 does not clear the current password when a user makes a password-change attempt that is denied by policy, which allows opportunistic, physically proximate attackers to bypass authentication and change this user's password by later entering an acceptable new...

CVE-2008-4081: Improper Authentication

admin/login.php in Stash 1.0.3 allows remote attackers to bypass authentication and gain administrative access by setting a bsm cookie...

CVE-2008-3905: Improper Authentication

resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than...

CVE-2008-3891: Improper Authentication

The SAML Single Sign-On SSO Service for Google Apps allows remote service providers to impersonate users at arbitrary service providers via vectors related to authentication responses that lack a request identifier and recipient field...

CVE-2008-3579: Improper Authentication

Calacode @Mail 5.41 on Linux does not require administrative authentication for build-plesk-upgrade.php, which allows remote attackers to obtain sensitive information by creating and downloading a backup archive of the entire @Mail directory tree. NOTE: this can be leveraged for remote exploitati...

CVE-2008-3503: Improper Authentication

RSSFromParent in Plain Black WebGUI before 7.5.13 does not restrict view access to Collaboration System CS RSS feeds, which allows remote attackers to obtain sensitive information CS data...

CVE-2008-3504: Improper Authentication

Unspecified vulnerability in mask PHP File Manager mPFM before 2.3 has unknown impact and remote attack vectors related to "manipulation of cookies."...

CVE-2008-3411: Improper Authentication

The Axesstel AXW-D800 modem with D2ETH10901VEBR Jun-14-2006 software does not require authentication for 1 etc/config/System.html, 2 etc/config/Network.html, 3 etc/config/Security.html, 4 cgi-bin/sysconf.cgi, and 5 cgi-bin/route.cgi, which allows remote attackers to change the modem's configurati...

CVE-2008-3425: Improper Authentication

Unspecified vulnerability in the Sun Java System Web Server 7.0 plugin in Sun N1 Service Provisioning System SPS 5.2 and 6.0 allows remote authenticated SPS users to gain administrative access to the web server via unknown attack vectors...

CVE-2008-3375: Improper Authentication

The jrCookie function in includes/jamroom-misc.inc.php in JamRoom before 3.4.0 allows remote attackers to bypass authentication and gain administrative access via a boolean value within serialized data in a JMUCookie cookie...

CVE-2008-3319: Improper Authentication

admin/index.php in Maian Links 3.1 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary linkscookie cookie...

CVE-2008-3322: Improper Authentication

admin/index.php in Maian Recipe 1.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary recipecookie cookie...

CVE-2008-3320: Improper Authentication

admin/index.php in Maian Guestbook 3.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary gbookcookie cookie...

CVE-2008-3264: Improper Authentication

The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers t...

CVE-2008-3203: Improper Authentication

js/pages/pagesdata.php in AuraCMS 2.2 through 2.2.2 does not perform authentication, which allows remote attackers to add, edit, and delete web content via a modified id parameter...

CVE-2008-2801: Improper Authentication

Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly implement JAR signing, which allows remote attackers to execute arbitrary code via 1 injection of JavaScript into documents within a JAR archive or 2 a JAR archive that uses relative URLs to JavaScript files...

CVE-2008-3033: Improper Authentication

RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by 1 an IdFlux request to supprimerflux.php and 2 a TpsRafraich request to...

CVE-2008-2920: Improper Authentication

admin/filemanager/ aka the File Manager in EZTechhelp EZCMS 1.2 and earlier does not require authentication, which allows remote attackers to create, modify, read, and delete files...

CVE-2008-2879: Improper Authentication

Benja CMS 0.1 does not require authentication for access to admin/, which allows remote attackers to add or delete a menu...

CVE-2008-0960: Improper Authentication

SNMPv3 HMAC verification in 1 Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; 2 UCD-SNMP; 3 eCos; 4 Juniper Session and Resource Control SRC C-series 1.0.0 through 2.0.0; 5 NetApp aka Network Appliance Data ONTAP 7.3RC1 and 7.3RC2; 6 SNMP Research before 16.2; 7...