Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CVEs (5,225)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2008-6965 1Aj Square 1Aj Auction Apr 23, 2026 Aug 13, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 AJ Square AJ Auction OOPD, Pro Platinum Skin #1, Pro Platinum Skin #2, and Web 2.0 send a redirect but do not exit when certain scripts are called directly, which allows remote attackers to bypass authentication via a di...Show more AJ Square AJ Auction OOPD, Pro Platinum Skin #1, Pro Platinum Skin #2, and Web 2.0 send a redirect but do not exit when certain scripts are called directly, which allows remote attackers to bypass authentication via a direct request to (1) site.php, (2) auction.php, (3) mail.php, (4) fee_setting.php, (5) earnings.php, (6) insertion_fee_settings.php, (7) custom_category.php, (8) subcategory.php, (9) category.php, (10) report.php, (11) store_manager.php, and (12) choose_sell_format.php in admin/, and possibly other vectors.Show less
CVE-2008-6951 1Cms.maury91 1Maurycms Apr 23, 2026 Aug 12, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 MauryCMS 0.53.2 and earlier does not require administrative authentication for Editors/fckeditor/editor/filemanager/browser/default/browser.html, which allows remote attackers to upload arbitrary files via a direct reque...Show more MauryCMS 0.53.2 and earlier does not require administrative authentication for Editors/fckeditor/editor/filemanager/browser/default/browser.html, which allows remote attackers to upload arbitrary files via a direct request.Show less
CVE-2008-6947 1Collabtive 1Collabtive Apr 23, 2026 Aug 12, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Collabtive 0.4.8 allows remote attackers to bypass authentication and create new users, including administrators, via unspecified vectors associated with the added mode in a users action to admin.php.
CVE-2008-6939 1Turnkeyforms 1Web Hosting Directory Apr 23, 2026 Aug 12, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and (1) gain administrative privileges by setting the adm cookie to 1 or (2) gain privileges as another user by setting the logged cooki...Show more TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and (1) gain administrative privileges by setting the adm cookie to 1 or (2) gain privileges as another user by setting the logged cookie to the target username.Show less
CVE-2008-6919 1Taskdriver 1Taskdriver Apr 23, 2026 Aug 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 profileedit.php TaskDriver 1.3 and earlier allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to "fook!admin."
CVE-2009-0669 1Zope 1Zodb Apr 23, 2026 Aug 7, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.
CVE-2008-6916 2John Doe Siemens 2Netport Software Speedstream 5200 Apr 23, 2026 Aug 7, 2009 N/A· v4 N/A· v3 10.0 HIGH· v2 Siemens SpeedStream 5200 with NetPort Software 1.1 allows remote attackers to bypass authentication via an invalid Host header, possibly involving a trailing dot in the hostname.
CVE-2008-6912 1Zeeways 1Shaadiclone Apr 23, 2026 Aug 7, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Zeeways SHAADICLONE 2.0 allows remote attackers to bypass authentication and gain administrative privileges via a direct request to admin/home.php.
CVE-2009-2410 1Fedorahosted 1Sssd Apr 23, 2026 Jul 30, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 The local_handler_callback function in server/responder/pam/pam_LOCAL_domain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain ac...Show more The local_handler_callback function in server/responder/pam/pam_LOCAL_domain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account's username, in conjunction with an arbitrary password, over an ssh connection.Show less
CVE-2009-2642 1Desiscripts 1Desi Short Url Script Apr 23, 2026 Jul 28, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 index.php in Desi Short URL Script 1.0 allows remote attackers to bypass authentication by setting the logged cookie to 1 and the uid cookie to an integer value, as demonstrated by a value of 13.
CVE-2009-2481 2Six Apart Sixapart 2Movable Type Movable Type Apr 23, 2026 Jul 16, 2009 N/A· v4 N/A· v3 5.8 MEDIUM· v2 mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows remote attackers to bypass access restrictions and (1) send e-mail to arbitrary addresses or (2) obtain sensitive in...Show more mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows remote attackers to bypass access restrictions and (1) send e-mail to arbitrary addresses or (2) obtain sensitive information via unspecified vectors.Show less
CVE-2008-6864 1Xigla 1Absolute Live Support .net Apr 23, 2026 Jul 14, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVE-2008-6863 1Xigla 1Absolute Form Processor.net Apr 23, 2026 Jul 14, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Xigla Software Absolute Form Processor .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVE-2008-6862 1Xigla 1Absolute Content Rotator Apr 23, 2026 Jul 14, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Absolute Content Rotator 6.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVE-2008-6861 1Xigla 1Absolute Newsletter Apr 23, 2026 Jul 14, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Xigla Software Absolute Newsletter 6.0 and 6.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVE-2008-6860 1Xigla 1Absolute Poll Manager Xe Apr 23, 2026 Jul 14, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Xigla Software Absolute Poll Manager XE 4.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVE-2008-6859 1Xigla 1Absolute Control Panel Xe Apr 23, 2026 Jul 14, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Xigla Software Absolute Control Panel XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVE-2008-6858 1Xigla 1Absolute Banner Manager.net Apr 23, 2026 Jul 14, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Absolute Banner Manager .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVE-2008-6857 1Xigla 1Absolute Podcast.net Apr 23, 2026 Jul 14, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Absolute Podcast .NET 1.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVE-2008-6856 1Xigla 1Absolute News Manager.net Apr 23, 2026 Jul 14, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Xigla Software Absolute News Manager.NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.

Previous 1...241242243...262 Next