← Back
CWE-287

5,225 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

JSON object

Loading...

CVEs (5,225)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2009-3923
1Sun
2Virtual Desktop Infrastructure
Virtualbox
Apr 23, 2026
Nov 10, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure (VDI) 3.0 does not require authentication, which allows remote attackers to obtain unspecified access via vectors involving requests to an...Show more
The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure (VDI) 3.0 does not require authentication, which allows remote attackers to obtain unspecified access via vectors involving requests to an Apache HTTP Server.Show less
CVE-2009-3862
1Novell
1Edirectory
Apr 23, 2026
Nov 4, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The NDSD process in Novell eDirectory 8.7.3 before 8.7.3.10 ftf2 and eDirectory 8.8 before 8.8.5 ftf1 does not properly handle certain LDAP search requests, which allows remote attackers to cause a denial of service (app...Show more
The NDSD process in Novell eDirectory 8.7.3 before 8.7.3.10 ftf2 and eDirectory 8.8 before 8.8.5 ftf1 does not properly handle certain LDAP search requests, which allows remote attackers to cause a denial of service (application hang) via a search request with a NULL BaseDN value.Show less
CVE-2009-3635
1Typo3
1Typo3
Apr 23, 2026
Nov 2, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to gain access by using only the password's md5 hash as a credential.
CVE-2009-3623
1Linux
1Linux Kernel
Apr 23, 2026
Oct 30, 2009
N/A· v4
N/A· v3
7.8 HIGH· v2
The lookup_cb_cred function in fs/nfsd/nfs4callback.c in the nfsd4 subsystem in the Linux kernel before 2.6.31.2 attempts to access a credentials cache even when a client specifies the AUTH_NULL authentication flavor, wh...Show more
The lookup_cb_cred function in fs/nfsd/nfs4callback.c in the nfsd4 subsystem in the Linux kernel before 2.6.31.2 attempts to access a credentials cache even when a client specifies the AUTH_NULL authentication flavor, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an NFSv4 mount request.Show less
CVE-2009-3828
1Everfocus
1Edr1600
Apr 23, 2026
Oct 30, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The web interface for Everfocus EDR1600 DVR allows remote attackers to bypass authentication and access live cams via certain vectors.
CVE-2009-3657
1Tim Nelson
1Shared Sign On
Apr 23, 2026
Oct 9, 2009
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Session fixation vulnerability in Shared Sign-On 5.x and 6.x, a module for Drupal, allows remote attackers to hijack web sessions via unspecified vectors.
CVE-2009-3481
1Isygen
1Com Icrmbasic
Apr 23, 2026
Sep 30, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
A certain interface in the iCRM Basic (com_icrmbasic) component 1.4.2.31 for Joomla! does not require administrative authentication, which has unspecified impact and remote attack vectors. NOTE: the provenance of this i...Show more
A certain interface in the iCRM Basic (com_icrmbasic) component 1.4.2.31 for Joomla! does not require administrative authentication, which has unspecified impact and remote attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2009-3441
1Alienvault
1Ossim
Apr 23, 2026
Sep 28, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to bypass authentication, and read graphs or infrastructure information, via a direct request to (1) graphs/alarms_events.php or (2...Show more
Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to bypass authentication, and read graphs or infrastructure information, via a direct request to (1) graphs/alarms_events.php or (2) host/draw_tree.php.Show less
CVE-2009-2863
1Cisco
1Ios
Apr 23, 2026
Sep 28, 2009
N/A· v4
N/A· v3
7.1 HIGH· v2
Race condition in the Firewall Authentication Proxy feature in Cisco IOS 12.0 through 12.4 allows remote attackers to bypass authentication, or bypass the consent web page, via a crafted request, aka Bug ID CSCsy15227.
CVE-2009-3423
1Zenas
1Paolink
Apr 23, 2026
Sep 25, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
login.php in Zenas PaoLink 1.0, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the login_ok parameter to 1.
CVE-2009-3422
1Zenas
1Paoliber
Apr 23, 2026
Sep 25, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
login.php in Zenas PaoLiber 1.1, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the login_ok parameter to 1.
CVE-2009-3421
1Zenas
1Pao Bacheca Guestbook
Apr 23, 2026
Sep 25, 2009
N/A· v4
9.8 CRITICAL· v3
6.8 MEDIUM· v2
login.php in Zenas PaoBacheca Guestbook 2.1, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative access by setting the login_ok parameter to 1.
CVE-2009-3261
1Livestreet
1Livestreet
Apr 23, 2026
Sep 18, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
update/update_0.1.2_to_0.2.php in LiveStreet 0.2 does not require administrative authentication, which allows remote attackers to perform DROP TABLE operations via unspecified vectors.
CVE-2009-3232
1Canonical
1Ubuntu Linux
Apr 23, 2026
Sep 17, 2009
N/A· v4
N/A· v3
9.3 HIGH· v2
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to b...Show more
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.Show less
CVE-2009-3231
5Canonical
FedoraprojectOpensuse+2 more
6Fedora
Linux EnterpriseLinux Enterprise Server+3 more
Apr 23, 2026
Sep 17, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.
CVE-2009-3158
1Carsten Wulff
1Simplephpweb
Apr 23, 2026
Sep 10, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
admin/files.php in simplePHPWeb 0.2 does not require authentication, which allows remote attackers to perform unspecified administrative actions via unknown vectors. NOTE: some of these details are obtained from third p...Show more
admin/files.php in simplePHPWeb 0.2 does not require authentication, which allows remote attackers to perform unspecified administrative actions via unknown vectors. NOTE: some of these details are obtained from third party information.Show less
CVE-2009-3107
1Symantec
1Altiris Deployment Solution
Apr 23, 2026
Sep 8, 2009
N/A· v4
N/A· v3
4.8 MEDIUM· v2
Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 does not properly restrict access to the listening port for the DBManager service, which allows remote attackers to bypass authentication and modify tas...Show more
Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 does not properly restrict access to the listening port for the DBManager service, which allows remote attackers to bypass authentication and modify tasks or the Altiris Database via a connection to this service.Show less
CVE-2008-7179
1Otmanager
1Otmanager Cms
Apr 23, 2026
Sep 8, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMIN_Hora, ADMIN_Logado, and ADMIN_Nome cookies to certain values, as reachable in Admin/index.php.
CVE-2009-2697
1Gnome
1Gdm
Apr 23, 2026
Sep 4, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHEL) 5 omits TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions via...Show more
The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHEL) 5 omits TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions via XDMCP connections, a different vulnerability than CVE-2007-5079.Show less
CVE-2008-7156
1Ekinboard
1Ekinboard
Apr 23, 2026
Sep 2, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
EkinBoard 1.1.0 and earlier, when register_globals is enabled, allows remote attackers to bypass authorization and gain administrator privileges by setting the _groups[] parameter to 2, as demonstrated via backup.php.