Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CVEs (5,226)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2011-2701 1Freeradius 1Freeradius Apr 29, 2026 Aug 4, 2011 N/A· v4 N/A· v3 5.8 MEDIUM· v2 The ocsp_check function in rlm_eap_tls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS proto...Show more The ocsp_check function in rlm_eap_tls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate.Show less
CVE-2011-2361 1Google 1Chrome Apr 29, 2026 Aug 3, 2011 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The Basic Authentication dialog implementation in Google Chrome before 13.0.782.107 does not properly handle strings, which might make it easier for remote attackers to capture credentials via a crafted web site.
CVE-2011-2963 1Progea 1Movicon Apr 29, 2026 Jul 29, 2011 N/A· v4 N/A· v3 10.0 HIGH· v2 TCPUploadServer.exe in Progea Movicon 11.2 before Build 1084 does not require authentication for critical functions, which allows remote attackers to obtain sensitive information, delete files, execute arbitrary programs...Show more TCPUploadServer.exe in Progea Movicon 11.2 before Build 1084 does not require authentication for critical functions, which allows remote attackers to obtain sensitive information, delete files, execute arbitrary programs, or cause a denial of service (crash) via a crafted packet to TCP port 10651.Show less
CVE-2011-2956 1Azeotech 1Daqfactory Apr 29, 2026 Jul 28, 2011 N/A· v4 N/A· v3 7.8 HIGH· v2 AzeoTech DAQFactory before 5.85 (Build 1842) does not perform authentication for certain signals, which allows remote attackers to cause a denial of service (system reboot or shutdown) via a signal.
CVE-2011-2758 1Ibm 1Tivoli Directory Server Apr 29, 2026 Jul 17, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 IDSWebApp in the Web Administration Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.3-TIV-ITDS-IF0004 does not require authentication for access to LDAP Server log files, which allows remote attackers to obtai...Show more IDSWebApp in the Web Administration Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.3-TIV-ITDS-IF0004 does not require authentication for access to LDAP Server log files, which allows remote attackers to obtain sensitive information via a crafted URL.Show less
CVE-2011-2756 1Manageengine 1Servicedesk Plus Apr 29, 2026 Jul 17, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 does not require authentication, which allows remote attackers to read files from a specific directory via unspecified vectors.
CVE-2011-1409 1Ulli Horlacher 1Fex Apr 29, 2026 Jun 24, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Frams's Fast File EXchange (F*EX, aka fex) 20100208, and possibly other versions before 20110610, allows remote attackers to bypass authentication and upload arbitrary files via a request that lacks an authentication ID.
CVE-2009-5077 1Creloaded 1Cre Loaded Apr 29, 2026 Jun 8, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHP_SELF variable, which is not properly handled by (1) includes/application_t...Show more CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHP_SELF variable, which is not properly handled by (1) includes/application_top.php and (2) admin/includes/application_top.php.Show less
CVE-2009-5076 1Creloaded 1Cre Loaded Apr 29, 2026 Jun 8, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with (1) login.php or (2) password_forgotten.php append...Show more CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with (1) login.php or (2) password_forgotten.php appended as the PATH_INFO, which bypasses a check that uses PHP_SELF, which is not properly handled by (a) includes/application_top.php and (b) admin/includes/application_top.php, as exploited in the wild in 2009.Show less
CVE-2011-1758 1Fedoraproject 1Sssd Apr 29, 2026 May 26, 2011 N/A· v4 N/A· v3 3.7 LOW· v2 The krb5_save_ccname_done function in providers/krb5/krb5_auth.c in System Security Services Daemon (SSSD) 1.5.x before 1.5.7, when automatic ticket renewal and offline authentication are configured, uses a pathname stri...Show more The krb5_save_ccname_done function in providers/krb5/krb5_auth.c in System Security Services Daemon (SSSD) 1.5.x before 1.5.7, when automatic ticket renewal and offline authentication are configured, uses a pathname string as a password, which allows local users to bypass Kerberos authentication by listing the /tmp directory to obtain the pathname.Show less
CVE-2011-1766 1Mediawiki 1Mediawiki Apr 29, 2026 May 23, 2011 N/A· v4 N/A· v3 5.8 MEDIUM· v2 includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by...Show more includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation.Show less
CVE-2011-2155 1Smartertools 1Smarterstats Apr 29, 2026 May 20, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentica...Show more Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation.Show less
CVE-2011-1901 1Proofpoint 2Messaging Security Gateway Protection Server Apr 29, 2026 May 5, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 The mail-filter web interface in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allows remote attackers to bypass authen...Show more The mail-filter web interface in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allows remote attackers to bypass authentication via unspecified vectors.Show less
CVE-2011-1674 1Netgear 2Prosafe Wnap210 Prosafe Wnap210 Firmware Apr 29, 2026 Apr 10, 2011 N/A· v4 N/A· v3 6.8 MEDIUM· v2 The NetGear ProSafe WNAP210 with firmware 2.0.12 allows remote attackers to bypass authentication and obtain access to the configuration page by visiting recreate.php and then visiting index.php.
CVE-2011-1561 1Ibm 1Aix Apr 29, 2026 Apr 5, 2011 N/A· v4 N/A· v3 6.8 MEDIUM· v2 The LDAP login feature in bos.rte.security 6.1.6.4 in IBM AIX 6.1, when ldap_auth is enabled in ldap.cfg, allows remote attackers to bypass authentication via a login attempt with an arbitrary password.
CVE-2011-1472 1Nokia 2E75 E75 Firmware Apr 29, 2026 Mar 29, 2011 N/A· v4 N/A· v3 7.2 HIGH· v2 The Nokia E75 phone with firmware before 211.12.01 allows physically proximate attackers to bypass the Device Lock code by entering an unspecified button sequence at boot time.
CVE-2011-1520 1Ibm 1Lotus Domino Apr 29, 2026 Mar 25, 2011 N/A· v4 N/A· v3 7.2 HIGH· v2 The default configuration of the server console in IBM Lotus Domino does not require a password (aka Server_Console_Password), which allows physically proximate attackers to perform administrative changes or obtain sensi...Show more The default configuration of the server console in IBM Lotus Domino does not require a password (aka Server_Console_Password), which allows physically proximate attackers to perform administrative changes or obtain sensitive information via a (1) Load, (2) Tell, or (3) Set Configuration command.Show less
CVE-2011-1519 1Ibm 1Lotus Domino Apr 29, 2026 Mar 25, 2011 N/A· v4 N/A· v3 10.0 HIGH· v2 The remote console in the Server Controller in IBM Lotus Domino 7.x and 8.x verifies credentials against a file located at a UNC share pathname specified by the client, which allows remote attackers to bypass authenticat...Show more The remote console in the Server Controller in IBM Lotus Domino 7.x and 8.x verifies credentials against a file located at a UNC share pathname specified by the client, which allows remote attackers to bypass authentication, and consequently execute arbitrary code, by placing this pathname in the COOKIEFILE field. NOTE: this might overlap CVE-2011-0920.Show less
CVE-2011-1025 1Openldap 1Openldap Apr 29, 2026 Mar 20, 2011 N/A· v4 N/A· v3 6.8 MEDIUM· v2 bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.
CVE-2011-0438 1Arthurdejong 1Nss Pam Ldapd Apr 29, 2026 Mar 15, 2011 N/A· v4 N/A· v3 6.8 MEDIUM· v2 nslcd/pam.c in the nss-pam-ldapd 0.8.0 PAM module returns a success code when a user is not found in LDAP, which allows remote attackers to bypass authentication.

Previous 1...233234235...262 Next