Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CVEs (5,225)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2009-2066 1Apple 1Safari Apr 23, 2026 Jun 15, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Apple Safari detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http pa...Show more Apple Safari detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."Show less
CVE-2009-2065 1Mozilla 1Firefox Apr 23, 2026 Jun 15, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Mozilla Firefox 3.0.10, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https...Show more Mozilla Firefox 3.0.10, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."Show less
CVE-2009-2064 1Microsoft 2Internet Explorer Pocket Ie Apr 23, 2026 Jun 15, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Microsoft Internet Explorer 8, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in a...Show more Microsoft Internet Explorer 8, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."Show less
CVE-2009-2063 1Opera 1Opera Browser Apr 23, 2026 Jun 15, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Opera, possibly before 9.25, processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying thi...Show more Opera, possibly before 9.25, processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.Show less
CVE-2009-2062 1Apple 1Safari Apr 23, 2026 Jun 15, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Apple Safari before 3.2.2 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this C...Show more Apple Safari before 3.2.2 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.Show less
CVE-2009-2060 1Google 1Chrome Apr 23, 2026 Jun 15, 2009 N/A· v4 N/A· v3 5.8 MEDIUM· v2 src/net/http/http_transaction_winhttp.cc in Google Chrome before 1.0.154.53 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which al...Show more src/net/http/http_transaction_winhttp.cc in Google Chrome before 1.0.154.53 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.Show less
CVE-2009-2059 1Opera 1Opera Browser Apr 23, 2026 Jun 15, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arb...Show more Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.Show less
CVE-2009-2058 1Apple 1Safari Apr 23, 2026 Jun 15, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitr...Show more Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.Show less
CVE-2009-2057 1Microsoft 2Ie Internet Explorer Apr 23, 2026 Jun 15, 2009 N/A· v4 N/A· v3 5.8 MEDIUM· v2 Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to exe...Show more Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.Show less
CVE-2009-1836 1Mozilla 3Firefox SeamonkeyThunderbird Apr 23, 2026 Jun 12, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server, which al...Show more Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.Show less
CVE-2009-2040 1Grestul 1Grestul Apr 23, 2026 Jun 12, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 admin/options.php in Grestul 1.2 does not properly restrict access, which allows remote attackers to bypass authentication and create administrative accounts via a manage_admin action in a direct request.
CVE-2009-1122 1Microsoft 1Internet Information Services Apr 23, 2026 Jun 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via...Show more The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.Show less
CVE-2009-1535 1Microsoft 1Internet Information Services Apr 23, 2026 Jun 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicod...Show more The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122.Show less
CVE-2009-2003 1Ascadnetworks 1Password Protector Sd Apr 23, 2026 Jun 8, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Ascad Networks Password Protector SD 1.3.1 allows remote attackers to bypass authentication and gain administrative access by setting the (1) c7portal and (2) cookname cookies to "admin."
CVE-2009-1905 1Ibm 1Db2 Apr 23, 2026 Jun 3, 2009 N/A· v4 N/A· v3 2.6 LOW· v2 The Common Code Infrastructure component in IBM DB2 8 before FP17, 9.1 before FP7, and 9.5 before FP4, when LDAP security (aka IBMLDAPauthserver) and anonymous bind are enabled, allows remote attackers to bypass password...Show more The Common Code Infrastructure component in IBM DB2 8 before FP17, 9.1 before FP7, and 9.5 before FP4, when LDAP security (aka IBMLDAPauthserver) and anonymous bind are enabled, allows remote attackers to bypass password authentication and establish a database connection via unspecified vectors.Show less
CVE-2009-1854 1Cmsnx 1Million Dollar Text Links Apr 23, 2026 Jun 1, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Million Dollar Text Links 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the userid cookie to 1.
CVE-2009-1826 1Collector 1Mygesuad Apr 23, 2026 May 29, 2009 N/A· v4 N/A· v3 6.5 MEDIUM· v2 modules/admuser.php in myGesuad 0.9.14 (aka 0.9) does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action.
CVE-2009-1825 1Collector 1Mycolex Apr 23, 2026 May 29, 2009 N/A· v4 N/A· v3 4.0 MEDIUM· v2 modules/admuser.php in myColex 1.4.2 does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action.
CVE-2009-1384 1Eyrie 1Pam Krb5 Apr 23, 2026 May 28, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
CVE-2008-6816 1Eaton 1Network Shutdown Module Apr 23, 2026 May 28, 2009 N/A· v4 N/A· v3 10.0 HIGH· v2 Eaton MGEOPS Network Shutdown Module before 3.10 Build 13 allows remote attackers to execute arbitrary code by adding a custom action to the MGE frontend via pane_actionbutton.php, and then executing this action via exec...Show more Eaton MGEOPS Network Shutdown Module before 3.10 Build 13 allows remote attackers to execute arbitrary code by adding a custom action to the MGE frontend via pane_actionbutton.php, and then executing this action via exec_action.php.Show less

Previous 1...243244245...262 Next