← Back
CWE-287

5,226 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

JSON object

Loading...

CVEs (5,226)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2010-2940
1Fedoraproject
1Sssd
Apr 29, 2026
Aug 30, 2010
N/A· v4
N/A· v3
5.1 MEDIUM· v2
The auth_send function in providers/ldap/ldap_auth.c in System Security Services Daemon (SSSD) 1.3.0, when LDAP authentication and anonymous bind are enabled, allows remote attackers to bypass the authentication requirem...Show more
The auth_send function in providers/ldap/ldap_auth.c in System Security Services Daemon (SSSD) 1.3.0, when LDAP authentication and anonymous bind are enabled, allows remote attackers to bypass the authentication requirements of pam_authenticate via an empty password.Show less
CVE-2010-1802
1Apple
3Libsecurity
Mac Os XMac Os X Server
Apr 29, 2026
Aug 25, 2010
N/A· v4
N/A· v3
6.4 MEDIUM· v2
libsecurity in Apple Mac OS X 10.5.8 and 10.6.4 does not properly perform comparisons to domain-name strings in X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a certificate associat...Show more
libsecurity in Apple Mac OS X 10.5.8 and 10.6.4 does not properly perform comparisons to domain-name strings in X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a certificate associated with a similar domain name, as demonstrated by use of a www.example.con certificate to spoof www.example.com.Show less
CVE-2009-4987
1Scripteen
1Free Image Hosting Script
Apr 29, 2026
Aug 25, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
admin/header.php in Scripteen Free Image Hosting Script 2.3 allows remote attackers to bypass authentication and gain administrative access by setting the cookgid cookie value to 1, a different vector than CVE-2008-3211.
CVE-2010-2944
1Jens Vagelpohl
1Zope Ldapuserfolder
Apr 29, 2026
Aug 20, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
The authenticate function in LDAPUserFolder/LDAPUserFolder.py in zope-ldapuserfolder 2.9-1 does not verify the password for the emergency account, which allows remote attackers to gain privileges.
CVE-2010-0834
1Ubuntu
1Ubuntu Linux
Apr 29, 2026
Aug 10, 2010
N/A· v4
N/A· v3
9.3 HIGH· v2
The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which...Show more
The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package.Show less
CVE-2010-2526
1Heinz Mauelshagen
1Lvm2
Apr 29, 2026
Aug 5, 2010
N/A· v4
N/A· v3
4.6 MEDIUM· v2
The cluster logical volume manager daemon (clvmd) in lvm2-cluster in LVM2 before 2.02.72, as used in Red Hat Global File System (GFS) and other products, does not verify client credentials upon a socket connection, which...Show more
The cluster logical volume manager daemon (clvmd) in lvm2-cluster in LVM2 before 2.02.72, as used in Red Hat Global File System (GFS) and other products, does not verify client credentials upon a socket connection, which allows local users to cause a denial of service (daemon exit or logical-volume change) or possibly have unspecified other impact via crafted control commands.Show less
CVE-2010-2927
1Ibm
1Tivoli Directory Server
Apr 29, 2026
Aug 2, 2010
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The slapi_printmessage function in IBM Tivoli Directory Server (ITDS) before 6.0.0.8-TIV-ITDS-IF0006 allows remote attackers to cause a denial of service (daemon crash) via multiple incomplete DIGEST-MD5 connection attem...Show more
The slapi_printmessage function in IBM Tivoli Directory Server (ITDS) before 6.0.0.8-TIV-ITDS-IF0006 allows remote attackers to cause a denial of service (daemon crash) via multiple incomplete DIGEST-MD5 connection attempts.Show less
CVE-2010-0833
1Likewise
2Likewise Cifs
Likewise Open
Apr 29, 2026
Jul 28, 2010
N/A· v4
N/A· v3
9.3 HIGH· v2
The pam_lsass library in Likewise Open 5.4 and CIFS 5.4 before build 8046, and 6.0 before build 8234, as used in HP StorageWorks X9000 Network Storage Systems and possibly other products, uses "SetPassword logic" when ru...Show more
The pam_lsass library in Likewise Open 5.4 and CIFS 5.4 before build 8046, and 6.0 before build 8234, as used in HP StorageWorks X9000 Network Storage Systems and possibly other products, uses "SetPassword logic" when running as part of a root service, which allows remote attackers to bypass authentication for a Likewise Security Authority (lsassd) account whose password is marked as expired.Show less
CVE-2009-4929
1Sweetphp
1Totalcalender
Apr 29, 2026
Jul 12, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
admin/manage_users.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary passwords via the newPW1 and newPW2 parameters.
CVE-2009-4927
1Webmobo
1Wbnews
Apr 29, 2026
Jul 12, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
WB News 2.1.2 allows remote attackers to bypass authentication and gain administrative access via a modified WBNEWS cookie, as demonstrated by setting this cookie to 1.
CVE-2010-2668
1Adaptivedisplays
2Alpha Ethernet Adapter Ii
Alpha Ethernet Adapter Ii Web Manager
Apr 29, 2026
Jul 8, 2010
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Unspecified vulnerability in Adaptive Micro Systems ALPHA Ethernet Adapter II Web-Manager 3.40.2 allows remote attackers to bypass authentication and read or write configuration files via unknown vectors.
CVE-2010-1670
1Mahara
1Mahara
Apr 29, 2026
Jul 6, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 has improper configuration options for authentication plugins associated with logins that use the single sign-on (SSO) functionality, which allows remote a...Show more
Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 has improper configuration options for authentication plugins associated with logins that use the single sign-on (SSO) functionality, which allows remote attackers to bypass authentication via an empty password. NOTE: some of these details are obtained from third party information.Show less
CVE-2010-2620
1Open Ftpd
1Open Ftpd
Apr 29, 2026
Jul 2, 2010
N/A· v4
N/A· v3
9.3 HIGH· v2
Open&Compact FTP Server (Open-FTPD) 1.2 and earlier allows remote attackers to bypass authentication by sending (1) LIST, (2) RETR, (3) STOR, or other commands without performing the required login steps first.
CVE-2009-4909
1Dootzky
1Oblog
Apr 29, 2026
Jun 25, 2010
N/A· v4
N/A· v3
6.8 MEDIUM· v2
admin/index.php in oBlog allows remote attackers to conduct brute-force password guessing attacks via HTTP requests.
CVE-2010-1375
1Apple
2Mac Os X
Mac Os X Server
Apr 29, 2026
Jun 17, 2010
N/A· v4
N/A· v3
7.2 HIGH· v2
NetAuthSysAgent in Network Authorization in Apple Mac OS X 10.5.8 does not have the expected authorization requirements, which allows local users to gain privileges via unspecified vectors.
CVE-2008-4389
1Symantec
2Appstream
Workspace Streaming
Apr 29, 2026
Jun 17, 2010
N/A· v4
N/A· v3
9.3 HIGH· v2
Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not properly perform authentication, which allows remote Workspace Streaming servers and man-in-the-middle attackers to download arb...Show more
Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not properly perform authentication, which allows remote Workspace Streaming servers and man-in-the-middle attackers to download arbitrary executable files onto a client system, and execute these files, via unspecified vectors.Show less
CVE-2010-2149
1Fujitsu
1E Pares
Apr 29, 2026
Jun 3, 2010
N/A· v4
N/A· v3
4.0 MEDIUM· v2
Session fixation vulnerability in Fujitsu e-Pares V01 L01, L03, L10, L20, L30 allows remote attackers to hijack web sessions via unspecified vectors.
CVE-2010-2026
1Cisco
1Scientific Atlanta Webstar Dpc2100r2
Apr 29, 2026
May 26, 2010
N/A· v4
N/A· v3
6.4 MEDIUM· v2
The web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 allows remote attackers to bypass authentication, and reset the modem or replace the firmware, via a direct...Show more
The web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 allows remote attackers to bypass authentication, and reset the modem or replace the firmware, via a direct request to an unspecified page.Show less
CVE-2009-4879
1Novell
1Access Manager
Apr 29, 2026
May 26, 2010
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The Identity Server in Novell Access Manager before 3.1 SP1 allows attackers with disabled Active Directory accounts to authenticate using X.509 authentication, which bypasses intended access restrictions.
CVE-2010-1454
1Vmware
1Tc Server
Apr 29, 2026
May 19, 2010
N/A· v4
N/A· v3
6.8 MEDIUM· v2
com.springsource.tcserver.serviceability.rmi.JmxSocketListener in VMware SpringSource tc Server Runtime 6.0.19 and 6.0.20 before 6.0.20.D, and 6.0.25.A before 6.0.25.A-SR01, does not properly enforce the requirement for...Show more
com.springsource.tcserver.serviceability.rmi.JmxSocketListener in VMware SpringSource tc Server Runtime 6.0.19 and 6.0.20 before 6.0.20.D, and 6.0.25.A before 6.0.25.A-SR01, does not properly enforce the requirement for an encrypted (aka s2enc) password, which allows remote attackers to obtain JMX interface access via a blank password.Show less