← Back
CWE-287

5,225 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

JSON object

Loading...

CVEs (5,225)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2008-6739
1Toddwoolums
1Asp Download
Apr 23, 2026
Apr 21, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
Todd Woolums ASP Download management script 1.03 does not require authentication for setupdownload.asp, which allows remote attackers to gain administrator privileges via a direct request.
CVE-2008-6738
1Mark Girling
1Myshoutpro
Apr 23, 2026
Apr 21, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
MyShoutPro 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin_access cookie to 1.
CVE-2008-6723
1Turnkeyforms
1Entertainment Portal
Apr 23, 2026
Apr 14, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
TurnkeyForms Entertainment Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the adminLogged cookie to Administrator.
CVE-2008-6719
1Uochm
1Justlistit
Apr 23, 2026
Apr 13, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
U&M Software Event Lister (aka JustListIt) 1.0 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to (...Show more
U&M Software Event Lister (aka JustListIt) 1.0 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to (1) start.php, (2) aktivitet.php, (3) prop_aktivitet.php, (4) kategorier.php, (5) konfig.php, (6) security.php, (7) manual.php, and possibly (8) index.php.Show less
CVE-2008-6718
1Uochm
1Justbookit
Apr 23, 2026
Apr 13, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
U&M Software JustBookIt 1.0 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to (1) user_manual.php,...Show more
U&M Software JustBookIt 1.0 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to (1) user_manual.php, (2) user_config.php, (3) user_kundnamn.php, (4) user_kundlista.php, (5) user_aktiva_kunder.php, (6) database.php, and possibly (7) index.php.Show less
CVE-2008-6717
1Uochm
1Signup
Apr 23, 2026
Apr 13, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
U&M Software Signup 1.0 and 1.1 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to (1) adminstart.p...Show more
U&M Software Signup 1.0 and 1.1 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to (1) adminstart.php, (2) admineventtype.php, (3) admineventdetails.php, (4) admineventlist.php, (5) adminuserslist.php, (6) adminleaderslist.php, (7) admindatabase.php, and possibly (8) index.php.Show less
CVE-2008-6716
1Preprojects
1Pre Ads Portal
Apr 23, 2026
Apr 13, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
homeadmin/adminhome.php in Pre ADS Portal 2.0 and earlier does not require administrative authentication, which allows remote attackers to have an unspecified impact via a direct request.
CVE-2008-6714
1Xecms Project
1Xecms
Apr 23, 2026
Apr 10, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
admin.php in xeCMS 1.0.0 RC2 and earlier allows remote attackers to bypass authentication and access the admin panel by setting the xecms_username cookie.
CVE-2008-6707
1Avaya
2Communication Manager
Sip Enablement Services
Apr 23, 2026
Apr 10, 2009
N/A· v4
N/A· v3
6.4 MEDIUM· v2
The Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, does not perform authentication for certain functionality, which allows remote attackers to...Show more
The Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, does not perform authentication for certain functionality, which allows remote attackers to obtain sensitive information and access restricted functionality via (1) the certificate installation utility, (2) unspecified scripts in the objects folder, (3) an "unnecessary default application," (4) unspecified scripts in the states folder, (5) an unspecified "default application" that lists server configuration, and (6) "full system help."Show less
CVE-2009-1155
1Cisco
2Adaptive Security Appliance 5500
Pix
Apr 23, 2026
Apr 9, 2009
N/A· v4
N/A· v3
7.8 HIGH· v2
Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.1(1) through 7.1(2)82, 7.2 before 7.2(4)27, 8.0 before 8.0(4)25, and 8.1 before 8.1(2)15, when AAA override-account-disable is entered in...Show more
Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.1(1) through 7.1(2)82, 7.2 before 7.2(4)27, 8.0 before 8.0(4)25, and 8.1 before 8.1(2)15, when AAA override-account-disable is entered in a general-attributes field, allow remote attackers to bypass authentication and establish a VPN session to an ASA device via unspecified vectors.Show less
CVE-2008-6667
1Marc Melvin
1A+ Php Scripts News Management System
Apr 23, 2026
Apr 8, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
A+ PHP Scripts News Management System (NMS) allows remote attackers to bypass authentication and gain administrator privileges by setting the mobsuser and mobspass cookies to 1.
CVE-2008-6664
1Yarck
1Sh News
Apr 23, 2026
Apr 8, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
action.php in SH-News 3.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the shuser and shpass cookies to non-zero values.
CVE-2008-6581
1Phpaddedit
1Phpaddedit
Apr 23, 2026
Apr 2, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
login.php in PhpAddEdit 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the addedit cookie parameter.
CVE-2003-1570
1Ibm
1Tivoli Storage Manager
Apr 23, 2026
Mar 31, 2009
N/A· v4
N/A· v3
3.5 LOW· v2
The server in IBM Tivoli Storage Manager (TSM) 5.1.x, 5.2.x before 5.2.1.2, and 6.x before 6.1 does not require credentials to observe the server console in some circumstances, which allows remote authenticated administr...Show more
The server in IBM Tivoli Storage Manager (TSM) 5.1.x, 5.2.x before 5.2.1.2, and 6.x before 6.1 does not require credentials to observe the server console in some circumstances, which allows remote authenticated administrators to monitor server operations by establishing a console mode session, related to "session exposure."Show less
CVE-2008-6569
1Cybozu
1Garoon
Apr 23, 2026
Mar 31, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Session fixation vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack web sessions via the session ID in the login page.
CVE-2009-0892
1Ibm
1Websphere Application Server
Apr 23, 2026
Mar 31, 2009
N/A· v4
N/A· v3
5.5 MEDIUM· v2
The administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3 allows attackers to hijack user sessions in "specific scenarios" related to a forced logout.
CVE-2008-6553
1Impliedbydesign
1Micro Cms
Apr 23, 2026
Mar 30, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an administrator, which allows remote attackers to (1) create administrative accounts via an add_admin...Show more
microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an administrator, which allows remote attackers to (1) create administrative accounts via an add_admin action, (2) remove administrative accounts via a delete_admin action, and (3) modify administrative passwords via a change_password action.Show less
CVE-2009-0591
1Openssl
1Openssl
Apr 23, 2026
Mar 27, 2009
N/A· v4
N/A· v3
2.6 LOW· v2
The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that orig...Show more
The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid.Show less
CVE-2008-6523
1Cale Dunlap
1Openinvoice
Apr 23, 2026
Mar 25, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
auth.php in openInvoice 0.90 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the oiauth cookie. NOTE: this can be leveraged with a separate vulnerability in resetpass.php...Show more
auth.php in openInvoice 0.90 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the oiauth cookie. NOTE: this can be leveraged with a separate vulnerability in resetpass.php to modify passwords for arbitrary users.Show less
CVE-2009-0891
1Ibm
1Websphere Application Server
Apr 23, 2026
Mar 25, 2009
N/A· v4
N/A· v3
5.5 MEDIUM· v2
The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 (7.0.0.1), 6.1 before Fix Pack 23 (6.1.0.23),and 6.0.2 before Fix Pack 33 (6.0.2.33) does not properly enforce (1) nonce and (...Show more
The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 (7.0.0.1), 6.1 before Fix Pack 23 (6.1.0.23),and 6.0.2 before Fix Pack 33 (6.0.2.33) does not properly enforce (1) nonce and (2) timestamp expiration values in WS-Security bindings as stored in the com.ibm.wsspi.wssecurity.core custom property, which allows remote authenticated users to conduct session hijacking attacks.Show less