Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CVEs (4,461)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2008-5576 1Scssboard 1Scssboard Apr 23, 2026 Dec 15, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 admin/forums.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to bypass authentication and gain administrative access via a large value of the current_user[users_level] parameter.
CVE-2008-5575 1Proclanmanager 1Pro Clan Manager Apr 23, 2026 Dec 15, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 Session fixation vulnerability in Pro Clan Manager 0.4.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
CVE-2008-5497 1Bandsitecms 1Bandsite Cms Apr 23, 2026 Dec 12, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the login_auth cookie to true.
CVE-2008-4032 1Microsoft 2Office Sharepoint Server Search Server Apr 23, 2026 Dec 10, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 Microsoft Office SharePoint Server 2007 Gold and SP1 and Microsoft Search Server 2008 do not properly perform authentication and authorization for administrative functions, which allows remote attackers to cause a denial...Show more Microsoft Office SharePoint Server 2007 Gold and SP1 and Microsoft Search Server 2008 do not properly perform authentication and authorization for administrative functions, which allows remote attackers to cause a denial of service (server load), obtain sensitive information, and "create scripts that would run in the context of the site" via requests to administrative URIs, aka "Access Control Vulnerability."Show less
CVE-2008-5407 1Symantec 1Backup Exec For Windows Server Apr 23, 2026 Dec 10, 2008 N/A· v4 N/A· v3 9.4 HIGH· v2 Multiple unspecified vulnerabilities in the Backup Exec remote-agent logon process in Symantec Backup Exec for Windows Servers 11.0 (aka 11d) builds 6235 and 7170, 12.0 build 1364, and 12.5 build 2213 allow remote attack...Show more Multiple unspecified vulnerabilities in the Backup Exec remote-agent logon process in Symantec Backup Exec for Windows Servers 11.0 (aka 11d) builds 6235 and 7170, 12.0 build 1364, and 12.5 build 2213 allow remote attackers to bypass authentication, and read or delete files, via unknown vectors.Show less
CVE-2008-5355 1Sun 3Jdk JreSdk Apr 23, 2026 Dec 5, 2008 N/A· v4 N/A· v3 10.0 HIGH· v2 The "Java Update" feature for Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not verify the signature of the J...Show more The "Java Update" feature for Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not verify the signature of the JRE that is downloaded, which allows remote attackers to execute arbitrary code via DNS man-in-the-middle attacks.Show less
CVE-2008-5296 1Gallery 1Gallery Apr 23, 2026 Dec 1, 2008 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Gallery 1.5.x before 1.5.10 and 1.6 before 1.6-RC3, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative via unspecified cookies. NOTE: some of these details are obt...Show more Gallery 1.5.x before 1.5.10 and 1.6 before 1.6-RC3, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative via unspecified cookies. NOTE: some of these details are obtained from third party information.Show less
CVE-2008-5221 1Wportfolio 1Wportfolio Apr 23, 2026 Nov 25, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows remote attackers to change the admin accou...Show more The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified password and password_retype parameters.Show less
CVE-2008-5219 1Videoscript 1Videoscript Apr 23, 2026 Nov 25, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 The password change feature (admin/cp.php) in VideoScript 4.0.1.50 and earlier does not check for administrative authentication and does not require knowledge of the original password, which allows remote attackers to ch...Show more The password change feature (admin/cp.php) in VideoScript 4.0.1.50 and earlier does not check for administrative authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified npass and npass1 parameters.Show less
CVE-2008-5158 1Clientsoftware 1Wincome Mpd Total Apr 23, 2026 Nov 18, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote attackers to bypass authentication and perform administrative actions via vectors involving "simply skipping the auth stage."
CVE-2008-5125 1Castillocentral 1Ccleague Apr 23, 2026 Nov 18, 2008 N/A· v4 N/A· v3 6.8 MEDIUM· v2 admin.php in CCleague Pro 1.2 allows remote attackers to bypass authentication by setting the type cookie value to admin.
CVE-2008-5124 1Jscape 1Secure Ftp Applet Apr 23, 2026 Nov 18, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 JSCAPE Secure FTP Applet 4.8.0 and earlier does not ask the user to verify a new or mismatched SSH host key, which makes it easier for remote attackers to perform man-in-the-middle attacks.
CVE-2006-5268 1Trend Micro 1Serverprotect Apr 23, 2026 Nov 17, 2008 N/A· v4 N/A· v3 10.0 HIGH· v2 Unspecified vulnerability in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via vectors related to obtaining "administrative access to the RPC interface."
CVE-2008-5065 1Easy Script 1Tlguesbook Apr 23, 2026 Nov 13, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 TlGuestBook 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlGuestBook_login cookie to admin.
CVE-2008-5022 3Canonical DebianMozilla 5Debian Linux FirefoxSeamonkey+2 more Apr 23, 2026 Nov 13, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-orig...Show more The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass the inner window check.Show less
CVE-2008-4037 1Microsoft 4Windows Windows 2000Windows Server 2008+1 more Apr 23, 2026 Nov 12, 2008 N/A· v4 N/A· v3 9.3 HIGH· v2 Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM cre...Show more Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as demonstrated by backrush, aka "SMB Credential Reflection Vulnerability." NOTE: some reliable sources report that this vulnerability exists because of an insufficient fix for CVE-2000-0834.Show less
CVE-2008-5042 1Zeeways 1Photovideotube Apr 23, 2026 Nov 12, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 Zeeways PhotoVideoTube 1.1 and earlier allows remote attackers to bypass authentication and perform administrative tasks via a direct request to admin/home.php.
CVE-2008-5040 1Graphiks 1Myforum Apr 23, 2026 Nov 12, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 Graphiks MyForum 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the (1) myforum_login and (2) myforum_pass cookies to 1.
CVE-2008-4784 1Aflog 1Aflog Apr 23, 2026 Oct 29, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 aflog 1.01 allows remote attackers to bypass authentication and gain administrative access by setting the aflog_auth_a cookie to "A" or "O" in (1) edit_delete.php, (2) edit_cat.php, (3) edit_lock.php, and (4) edit_form.p...Show more aflog 1.01 allows remote attackers to bypass authentication and gain administrative access by setting the aflog_auth_a cookie to "A" or "O" in (1) edit_delete.php, (2) edit_cat.php, (3) edit_lock.php, and (4) edit_form.php.Show less
CVE-2008-4783 1Easy Script 1Tlads Apr 23, 2026 Oct 29, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 tlAds 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the tlAds_login cookie to "admin."

Previous 1...211212213...224 Next