← Back
CWE-287

4,461 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

JSON object

Loading...

CVEs (4,461)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2007-3177
1Ingate
2Ingate Firewall
Ingate Siparator
Apr 23, 2026
Jun 11, 2007
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Ingate Firewall and SIParator before 4.5.2 allow remote attackers to bypass SIP authentication via a certain maddr parameter.
CVE-2007-3050
1Chameleon Cms
1Chameleon Cms
Apr 23, 2026
Jun 6, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Session fixation vulnerability in chameleon cms 3.0 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
CVE-2007-2719
1Hp
1Systems Insight Manager
Apr 23, 2026
May 16, 2007
N/A· v4
N/A· v3
10.0 HIGH· v2
Session fixation vulnerability in HP Systems Insight Manager (SIM) 4.2 and 5.0 SP4 and SP5 allows remote attackers to hijack web sessions by setting the JSESSIONID cookie.
CVE-2007-2555
1Podium Cms
1Podium Cms
Apr 23, 2026
May 9, 2007
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Unspecified vulnerability in Default.aspx in Podium CMS allows remote attackers to have an unknown impact, possibly session fixation, via a META HTTP-EQUIV Set-cookie expression in the id parameter, related to "cookie ma...Show more
Unspecified vulnerability in Default.aspx in Podium CMS allows remote attackers to have an unknown impact, possibly session fixation, via a META HTTP-EQUIV Set-cookie expression in the id parameter, related to "cookie manipulation." NOTE: this issue might be cross-site scripting (XSS).Show less
CVE-2007-2546
1Simple Machines
1Simple Machines Forum
Apr 23, 2026
May 9, 2007
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Session fixation vulnerability in Simple Machines Forum (SMF) 1.1.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
CVE-2007-1859
1Xscreensaver
1Xscreensaver
Apr 23, 2026
May 2, 2007
N/A· v4
N/A· v3
4.6 MEDIUM· v2
XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver...Show more
XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver to crash and unlock the screen and allows local users to bypass authentication.Show less
CVE-2007-2277
1Plogger
1Plogger
Apr 23, 2026
Apr 25, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Session fixation vulnerability in Plogger allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
CVE-2007-2243
1Openbsd
1Openssh
Apr 23, 2026
Apr 25, 2007
N/A· v4
N/A· v3
5.0 MEDIUM· v2
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response i...Show more
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.Show less
CVE-2007-1966
1Exv2
1Content Management System
Apr 23, 2026
Apr 11, 2007
N/A· v4
9.1 CRITICAL· v3
5.0 MEDIUM· v2
Session fixation vulnerability in eXV2 CMS 2.0.4.3 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID cookie.
CVE-2007-1953
1Onelook
1Courts Online
Apr 23, 2026
Apr 11, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Session fixation vulnerability in onelook courts on-line allows remote attackers to hijack web sessions by setting a PHPSESSID cookie.
CVE-2007-1952
1Onelook
1Onebyone Cms
Apr 23, 2026
Apr 11, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Session fixation vulnerability in onelook onebyone CMS allows remote attackers to hijack web sessions by setting a PHPSESSID cookie.
CVE-2007-1951
1Onelook
1Oboshop
Apr 23, 2026
Apr 11, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Session fixation vulnerability in onelook obo Shop allows remote attackers to hijack web sessions by setting a PHPSESSID cookie.
CVE-2007-1949
1Webblizzard
1Content Management System
Apr 23, 2026
Apr 11, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Session fixation vulnerability in WebBlizzard CMS allows remote attackers to hijack web sessions by setting a PHPSESSID cookie.
CVE-2007-1480
1Creative Guestbook
1Creative Guestbook
Apr 23, 2026
Mar 16, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Creative Guestbook 1.0 allows remote attackers to add an administrative account via a direct request to createadmin.php with Name, Email, and PASSWORD parameters set.
CVE-2007-1228
1Ibm
1Db2
Apr 23, 2026
Mar 2, 2007
N/A· v4
N/A· v3
4.4 MEDIUM· v2
IBM DB2 UDB 8.2 before Fixpak 7 (aka fixpack 14), and DB2 9 before Fix Pack 2, on UNIX allows the "fenced" user to access certain unauthorized directories.
CVE-2007-1160
1Webspell
1Webspell
Apr 23, 2026
Mar 2, 2007
N/A· v4
N/A· v3
10.0 HIGH· v2
webSPELL 4.0, and possibly later versions, allows remote attackers to bypass authentication via a ws_auth cookie, a different vulnerability than CVE-2006-4782.
CVE-2007-1062
1Cisco
2Unified Ip Conference Station 7935 Firmware
Unified Ip Conference Station Firmware 7936
Apr 23, 2026
Feb 22, 2007
N/A· v4
N/A· v3
10.0 HIGH· v2
The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls...Show more
The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface for a limited timeShow less
CVE-2006-6997
1Mailenable
2Mailenable Enterprise
Mailenable Standard
Apr 23, 2026
Feb 12, 2007
N/A· v4
N/A· v3
10.0 HIGH· v2
Unspecified vulnerability in a cryptographic feature in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21 leads to "weakened authentication security" with unkno...Show more
Unspecified vulnerability in a cryptographic feature in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21 leads to "weakened authentication security" with unknown impact and attack vectors. NOTE: due to lack of details, it is not clear whether this is the same as CVE-2006-1792.Show less
CVE-2007-0435
1T Com
2Speedport 500v
Speedport 500v Firmware
Apr 23, 2026
Jan 23, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
T-Com Speedport 500V routers with firmware 1.31 allow remote attackers to bypass authentication and reconfigure the device via a LOGINKEY=TECOM cookie value.
CVE-2006-6783
1Logahead
1Logahead Unu
Apr 23, 2026
Dec 28, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
logahead UNU 1.0 before 20061226 allows remote attackers to upload arbitrary files via unspecified vectors related to plugins/widged/_widged.php (aka the WidgEd plugin), possibly because of an authentication bypass. NOTE...Show more
logahead UNU 1.0 before 20061226 allows remote attackers to upload arbitrary files via unspecified vectors related to plugins/widged/_widged.php (aka the WidgEd plugin), possibly because of an authentication bypass. NOTE: some of these details are obtained from third party information.Show less