Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CVEs (5,228)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2014-0132 1Fedoraproject 1389 Directory Server May 6, 2026 Mar 18, 2014 N/A· v4 N/A· v3 6.5 MEDIUM· v2 The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.
CVE-2014-2047 1Owncloud 2Owncloud Owncloud Server May 6, 2026 Mar 14, 2014 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors.
CVE-2012-5158 2Puppet Puppetlabs 2Puppet Puppet Enterprise May 6, 2026 Mar 14, 2014 N/A· v4 N/A· v3 4.0 MEDIUM· v2 Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors.
CVE-2013-6031 1Huawei 2E355 E355 Firmware May 6, 2026 Mar 11, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The Huawei E355 adapter with firmware 21.157.37.01.910 does not require authentication for API pages, which allows remote attackers to change passwords and settings, or obtain sensitive information, via a direct request...Show more The Huawei E355 adapter with firmware 21.157.37.01.910 does not require authentication for API pages, which allows remote attackers to change passwords and settings, or obtain sensitive information, via a direct request to (1) api/wlan/security-settings, (2) api/device/information, (3) api/wlan/basic-settings, (4) api/wlan/mac-filter, (5) api/monitoring/status, or (6) api/dhcp/settings.Show less
CVE-2013-7322 1Nongnu 1Oath Toolkit May 6, 2026 Mar 9, 2014 N/A· v4 N/A· v3 4.9 MEDIUM· v2 usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when inv...Show more usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.Show less
CVE-2013-4966 1Puppet 1Puppet Enterprise May 6, 2026 Mar 9, 2014 N/A· v4 N/A· v3 6.4 MEDIUM· v2 The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remote attackers to create arbitrary classifications on the master by spoofing a con...Show more The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remote attackers to create arbitrary classifications on the master by spoofing a console.Show less
CVE-2014-1911 1Foscam 2Fi8919w Fi8919w Firmware May 6, 2026 Mar 6, 2014 N/A· v4 N/A· v3 7.8 HIGH· v2 The Foscam FI8910W camera with firmware before 11.37.2.55 allows remote attackers to obtain sensitive video and image data via a blank username and password.
CVE-2014-2075 1Tibco 2Enterprise Administrator Enterprise Administrator Sdk Apr 29, 2026 Feb 27, 2014 N/A· v4 N/A· v3 10.0 HIGH· v2 TIBCO Enterprise Administrator 1.0.0 and Enterprise Administrator SDK 1.0.0 do not properly enforce administrative authentication requirements, which allows remote attackers to execute arbitrary commands via unspecified...Show more TIBCO Enterprise Administrator 1.0.0 and Enterprise Administrator SDK 1.0.0 do not properly enforce administrative authentication requirements, which allows remote attackers to execute arbitrary commands via unspecified vectors.Show less
CVE-2014-0743 1Cisco 1Unified Communications Manager Apr 29, 2026 Feb 27, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The Certificate Authority Proxy Function (CAPF) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and modify registered-device information...Show more The Certificate Authority Proxy Function (CAPF) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and modify registered-device information via crafted data, aka Bug ID CSCum95468.Show less
CVE-2014-0739 1Cisco 1Adaptive Security Appliance Software Apr 29, 2026 Feb 22, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Race condition in the Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass sec_db authentication and provide certain pass-through services to unt...Show more Race condition in the Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass sec_db authentication and provide certain pass-through services to untrusted devices via a crafted configuration-file TFTP request, aka Bug ID CSCuj66766.Show less
CVE-2014-0738 1Cisco 1Adaptive Security Appliance Software Apr 29, 2026 Feb 22, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL...Show more The Phone Proxy component in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL) file, aka Bug ID CSCuj66770.Show less
CVE-2014-0737 1Cisco 1Unified Ip Phone 7960g Apr 29, 2026 Feb 22, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The Cisco Unified IP Phone 7960G 9.2(1) and earlier allows remote attackers to bypass authentication and change trust relationships by injecting a Certificate Trust List (CTL) file, aka Bug ID CSCuj66795.
CVE-2014-0733 1Cisco 1Unified Communications Manager Apr 29, 2026 Feb 20, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The Enterprise License Manager (ELM) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read ELM fil...Show more The Enterprise License Manager (ELM) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read ELM files via a direct request to a URL, aka Bug ID CSCum46494.Show less
CVE-2014-0732 1Cisco 1Unified Communications Manager Apr 29, 2026 Feb 20, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The Real Time Monitoring Tool (RTMT) web application in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read a...Show more The Real Time Monitoring Tool (RTMT) web application in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier does not properly enforce authentication requirements, which allows remote attackers to read application files via a direct request to a URL, aka Bug ID CSCum46495.Show less
CVE-2012-1100 1Redhat 1Jboss Operations Network Apr 29, 2026 Feb 14, 2014 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Red Hat JBoss Operations Network (JON) 3.0.x before 3.0.1, 2.4.2, and earlier, when LDAP authentication is enabled and the LDAP bind account credentials are invalid, allows remote attackers to login to LDAP-based account...Show more Red Hat JBoss Operations Network (JON) 3.0.x before 3.0.1, 2.4.2, and earlier, when LDAP authentication is enabled and the LDAP bind account credentials are invalid, allows remote attackers to login to LDAP-based accounts via an arbitrary password in a login request.Show less
CVE-2012-0062 1Redhat 1Jboss Operations Network Apr 29, 2026 Feb 14, 2014 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Red Hat JBoss Operations Network (JON) before 2.4.2 and 3.0.x before 3.0.1 allows remote attackers to hijack agent sessions via an agent registration request without a security token.
CVE-2014-0725 1Cisco 1Unified Communications Manager Apr 29, 2026 Feb 13, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Cisco Unified Communications Manager (UCM) does not require authentication for reading WAR files, which allows remote attackers to obtain sensitive information via unspecified access to a "file storage location," aka Bug...Show more Cisco Unified Communications Manager (UCM) does not require authentication for reading WAR files, which allows remote attackers to obtain sensitive information via unspecified access to a "file storage location," aka Bug ID CSCum05337.Show less
CVE-2014-0722 1Cisco 1Unified Communications Manager Apr 29, 2026 Feb 13, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The log4jinit web application in Cisco Unified Communications Manager (UCM) does not properly validate authentication, which allows remote attackers to cause a denial of service (performance degradation) via unspecified...Show more The log4jinit web application in Cisco Unified Communications Manager (UCM) does not properly validate authentication, which allows remote attackers to cause a denial of service (performance degradation) via unspecified use of this application, aka Bug ID CSCum05347.Show less
CVE-2011-4091 3Armin Burgmeier OpensuseOracle 3Net6 OpensuseSolaris Apr 29, 2026 Feb 10, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The libobby server in inc/server.hpp in libnet6 (aka net6) before 1.3.14 does not perform authentication before checking the user name, which allows remote attackers to obtain sensitive information such as server-usage p...Show more The libobby server in inc/server.hpp in libnet6 (aka net6) before 1.3.14 does not perform authentication before checking the user name, which allows remote attackers to obtain sensitive information such as server-usage patterns by a particular user and color preferences.Show less
CVE-2013-7183 1Seowonintech 1Swc 9100 Apr 29, 2026 Feb 4, 2014 N/A· v4 N/A· v3 7.8 HIGH· v2 cgi-bin/reboot.cgi on Seowon Intech SWC-9100 routers allows remote attackers to (1) cause a denial of service (reboot) via a default_reboot action or (2) reset all configuration values via a factory_default action.

Previous 1...220221222...262 Next