← Back
CWE-287

5,227 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

JSON object

Loading...

CVEs (5,227)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2012-2974
1Smc
1Smc8024l2 Switch
Apr 29, 2026
Jul 19, 2012
N/A· v4
N/A· v3
10.0 HIGH· v2
The web interface on the SMC SMC8024L2 switch allows remote attackers to bypass authentication and obtain administrative access via a direct request to a .html file under (1) status/, (2) system/, (3) ports/, (4) trunks/...Show more
The web interface on the SMC SMC8024L2 switch allows remote attackers to bypass authentication and obtain administrative access via a direct request to a .html file under (1) status/, (2) system/, (3) ports/, (4) trunks/, (5) vlans/, (6) qos/, (7) rstp/, (8) dot1x/, (9) security/, (10) igmps/, or (11) snmp/.Show less
CVE-2012-2351
2Debian
Mahara
2Debian Linux
Mahara
Apr 29, 2026
Jul 12, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP serve...Show more
The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username.Show less
CVE-2012-0301
1Symantec
1Message Filter
Apr 29, 2026
Jul 5, 2012
N/A· v4
N/A· v3
5.4 MEDIUM· v2
Session fixation vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to hijack web sessions via unspecified vectors.
CVE-2012-2281
1Rsa
2Access Manager Agent
Access Manager Server
Apr 29, 2026
Jul 5, 2012
N/A· v4
N/A· v3
6.8 MEDIUM· v2
EMC RSA Access Manager Server 6.x before 6.1 SP4 and RSA Access Manager Agent do not properly validate session tokens after a logout, which might allow remote attackers to conduct replay attacks via unspecified vectors.
CVE-2012-1123
1Mantisbt
1Mantisbt
Apr 29, 2026
Jun 29, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
The mci_check_login function in api/soap/mc_api.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password.
CVE-2012-2388
1Strongswan
1Strongswan
Apr 29, 2026
Jun 27, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."
CVE-2012-2122
2Mariadb
Oracle
2Mariadb
Mysql
Apr 29, 2026
Jun 26, 2012
N/A· v4
N/A· v3
5.1 MEDIUM· v2
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain...Show more
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.Show less
CVE-2011-0011
1Qemu
1Qemu
Apr 29, 2026
Jun 21, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
qemu-kvm before 0.11.0 disables VNC authentication when the password is cleared, which allows remote attackers to bypass authentication and establish VNC sessions.
CVE-2012-0717
1Ibm
1Websphere Application Server
Apr 29, 2026
Jun 20, 2012
N/A· v4
N/A· v3
2.6 LOW· v2
IBM WebSphere Application Server 7.0 before 7.0.0.23, when a certain SSLv2 configuration with client authentication is used, allows remote attackers to bypass X.509 client-certificate authentication via unspecified vecto...Show more
IBM WebSphere Application Server 7.0 before 7.0.0.23, when a certain SSLv2 configuration with client authentication is used, allows remote attackers to bypass X.509 client-certificate authentication via unspecified vectors.Show less
CVE-2009-0695
1Dell
1Wyse Device Manager
Apr 29, 2026
Jun 19, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a po...Show more
hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action.Show less
CVE-2012-1145
1Redhat
1Satellite
Apr 29, 2026
Jun 16, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when mod_wsgi is used, which allows remote attackers to cause...Show more
spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when mod_wsgi is used, which allows remote attackers to cause a denial of service (/var partition disk consumption and failed updates) via a large number of package uploads.Show less
CVE-2012-2606
1Bradfordnetworks
2Network Sentry Appliance
Network Sentry Appliance Software
Apr 29, 2026
Jun 13, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The agent in Bradford Network Sentry before 5.3.3 does not require authentication for messages, which allows remote attackers to trigger the display of arbitrary text on a workstation via a crafted packet to UDP port 456...Show more
The agent in Bradford Network Sentry before 5.3.3 does not require authentication for messages, which allows remote attackers to trigger the display of arbitrary text on a workstation via a crafted packet to UDP port 4567, as demonstrated by a replay attack.Show less
CVE-2012-0944
2Canonical
Sebastian Heinlein
2Aptdaemon
Ubuntu Linux
Apr 29, 2026
Jun 4, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Aptdaemon 0.43 and earlier in Ubuntu 11.04, 11.10, and 12.04 LTS does not authenticate packages when the transaction is not simulated, which allows remote attackers to install arbitrary packages via a man-in-the-middle a...Show more
Aptdaemon 0.43 and earlier in Ubuntu 11.04, 11.10, and 12.04 LTS does not authenticate packages when the transaction is not simulated, which allows remote attackers to install arbitrary packages via a man-in-the-middle attack.Show less
CVE-2011-5090
1Grboard
1Grboard
Apr 29, 2026
May 24, 2012
N/A· v4
N/A· v3
6.4 MEDIUM· v2
GR Board (aka grboard) 1.8.6.5 Community Edition does not require authentication for certain database actions, which allows remote attackers to modify or delete data via a request to (1) mod_rewrite.php, (2) comment_writ...Show more
GR Board (aka grboard) 1.8.6.5 Community Edition does not require authentication for certain database actions, which allows remote attackers to modify or delete data via a request to (1) mod_rewrite.php, (2) comment_write_ok.php, (3) poll/index.php, (4) update/index.php, (5) trackback.php, or (6) an arbitrary poll.php script under theme/.Show less
CVE-2012-2562
1Xelex
1Mobiletrack
Apr 29, 2026
May 22, 2012
N/A· v4
N/A· v3
7.6 HIGH· v2
The Xelex MobileTrack application 2.3.7 and earlier for Android does not verify the origin of SMS commands, which allows remote attackers to execute a (1) LOCATE, (2) TRACK, (3) UPDATECFG, (4) UPDATEACCT, (5) STAT, (6) T...Show more
The Xelex MobileTrack application 2.3.7 and earlier for Android does not verify the origin of SMS commands, which allows remote attackers to execute a (1) LOCATE, (2) TRACK, (3) UPDATECFG, (4) UPDATEACCT, (5) STAT, (6) TERM, or (7) WIPE command via an SMS message.Show less
CVE-2012-0675
1Apple
2Mac Os X
Mac Os X Server
Apr 29, 2026
May 11, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Time Machine in Apple Mac OS X before 10.7.4 does not require continued use of SRP-based authentication after this authentication method is first used, which allows remote attackers to read Time Capsule credentials by sp...Show more
Time Machine in Apple Mac OS X before 10.7.4 does not require continued use of SRP-based authentication after this authentication method is first used, which allows remote attackers to read Time Capsule credentials by spoofing the backup volume.Show less
CVE-2011-3620
1Apache
1Qpid
Apr 29, 2026
May 3, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowle...Show more
Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.Show less
CVE-2011-4022
1Cisco
1Intrusion Prevention System
Apr 29, 2026
May 3, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The sensor in Cisco Intrusion Prevention System (IPS) 7.0 and 7.1 allows remote attackers to cause a denial of service (file-handle exhaustion and mainApp hang) by making authentication attempts that exceed the configure...Show more
The sensor in Cisco Intrusion Prevention System (IPS) 7.0 and 7.1 allows remote attackers to cause a denial of service (file-handle exhaustion and mainApp hang) by making authentication attempts that exceed the configured limit, aka Bug ID CSCto51204.Show less
CVE-2012-0335
1Cisco
25500 Series Adaptive Security Appliance
Adaptive Security Appliance Software
Apr 29, 2026
May 2, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.2 through 8.4 do not properly perform proxy authentication during attempts to cut through a firewall, which allows remote attackers to obtain s...Show more
Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.2 through 8.4 do not properly perform proxy authentication during attempts to cut through a firewall, which allows remote attackers to obtain sensitive information via a connection attempt, aka Bug ID CSCtx42746.Show less
CVE-2012-0333
1Cisco
2Small Business Ip Phone
Small Business Ip Phone Firmware
Apr 29, 2026
May 2, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSC...Show more
Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768.Show less