Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CVEs (5,219)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2009-0125 1Finkproject 1Libnasl Apr 23, 2026 Jan 15, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 NOTE: this issue has been disputed by the upstream vendor. nasl/nasl_crypto2.c in the Nessus Attack Scripting Language library (aka libnasl) 2.2.11 does not properly check the return value from the OpenSSL DSA_do_verify...Show more NOTE: this issue has been disputed by the upstream vendor. nasl/nasl_crypto2.c in the Nessus Attack Scripting Language library (aka libnasl) 2.2.11 does not properly check the return value from the OpenSSL DSA_do_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: the upstream vendor has disputed this issue, stating "while we do misuse this function (this is a bug), it has absolutely no security ramification.Show less
CVE-2009-0124 1Arrl 1Tqsllib Apr 23, 2026 Jan 15, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The tqsl_verifyDataBlock function in openssl_cert.cpp in American Radio Relay League (ARRL) tqsllib 2.0 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to...Show more The tqsl_verifyDataBlock function in openssl_cert.cpp in American Radio Relay League (ARRL) tqsllib 2.0 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.Show less
CVE-2008-5880 1Gobbl 1Gobbl Cms Apr 23, 2026 Jan 8, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 admin/auth.php in Gobbl CMS 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to "ok".
CVE-2009-0051 1Zxid 1Zxid Apr 23, 2026 Jan 7, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 ZXID 0.29 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a simila...Show more ZXID 0.29 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.Show less
CVE-2009-0049 1Eid 1Eidlib Apr 23, 2026 Jan 7, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Belgian eID middleware (eidlib) 2.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malf...Show more Belgian eID middleware (eidlib) 2.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.Show less
CVE-2009-0048 1Openevidence 1Openevidence Apr 23, 2026 Jan 7, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 OpenEvidence 1.0.6 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signa...Show more OpenEvidence 1.0.6 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.Show less
CVE-2009-0047 1Gale 1Gale Apr 23, 2026 Jan 7, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Gale 0.99 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for...Show more Gale 0.99 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.Show less
CVE-2009-0046 1Sun 1Grid Engine Apr 23, 2026 Jan 7, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Sun GridEngine 5.3 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signa...Show more Sun GridEngine 5.3 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.Show less
CVE-2009-0025 1Isc 1Bind Apr 23, 2026 Jan 7, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/...Show more BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.Show less
CVE-2009-0021 1Ntp 1Ntp Apr 23, 2026 Jan 7, 2009 N/A· v4 N/A· v3 5.0 MEDIUM· v2 NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a ma...Show more NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.Show less
CVE-2008-5809 1Futomi 1Access Analyzer Cgi Apr 23, 2026 Jan 2, 2009 N/A· v4 N/A· v3 5.8 MEDIUM· v2 futomi CGI Cafe Access Analyzer CGI Standard 4.0.1 and earlier and Access Analyzer CGI Professional 4.11.3 and earlier use a predictable session id, which makes it easier for remote attackers to hijack sessions, and obta...Show more futomi CGI Cafe Access Analyzer CGI Standard 4.0.1 and earlier and Access Analyzer CGI Professional 4.11.3 and earlier use a predictable session id, which makes it easier for remote attackers to hijack sessions, and obtain sensitive information about analysis results, via a modified id.Show less
CVE-2008-5783 1V3chat 1V3 Chat Live Support Apr 23, 2026 Dec 31, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 admin/index.php in V3 Chat Live Support 3.0.4 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1.
CVE-2008-5721 1Sapporoworks 1Blackjumbodog Apr 23, 2026 Dec 26, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 SapporoWorks BlackJumboDog (BJD) before 4.2.3 allows remote attackers to bypass authentication and obtain sensitive information via unspecified vectors.
CVE-2008-5708 1Slimcms 1Slimcms Apr 23, 2026 Dec 24, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 redirect.php in SlimCMS 1.0.0 does not require authentication, which allows remote attackers to create administrative users by using the newusername and newpassword parameters and setting the newisadmin parameter to 1.
CVE-2008-5692 1Ipswitch 1Ws Ftp Apr 23, 2026 Dec 19, 2008 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Ipswitch WS_FTP Server Manager before 6.1.1, and possibly other Ipswitch products, allows remote attackers to bypass authentication and read logs via a logLogout action to FTPLogServer/login.asp followed by a request to...Show more Ipswitch WS_FTP Server Manager before 6.1.1, and possibly other Ipswitch products, allows remote attackers to bypass authentication and read logs via a logLogout action to FTPLogServer/login.asp followed by a request to FTPLogServer/LogViewer.asp with the localhostnull account name.Show less
CVE-2008-5686 1Ibm 1Tivoli Provisioning Manager Apr 23, 2026 Dec 19, 2008 N/A· v4 N/A· v3 8.5 HIGH· v2 IBM Tivoli Provisioning Manager (TPM) before 5.1.1.1 IF0006, when its LDAP service is shared with other applications, does not require that an LDAP user be listed in the TPM user records, which allows remote authenticate...Show more IBM Tivoli Provisioning Manager (TPM) before 5.1.1.1 IF0006, when its LDAP service is shared with other applications, does not require that an LDAP user be listed in the TPM user records, which allows remote authenticated users to execute SOAP commands that access arbitrary TPM functionality, as demonstrated by running provisioning workflows.Show less
CVE-2008-5558 1Asterisk 2Asterisk Business Edition Open Source Apr 23, 2026 Dec 17, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service (crash) via authentication attempts in...Show more Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service (crash) via authentication attempts involving (1) an unknown user or (2) a user using hostname matching.Show less
CVE-2008-4223 1Apple 1Mac Os X Server Apr 23, 2026 Dec 17, 2008 N/A· v4 N/A· v3 10.0 HIGH· v2 Podcast Producer in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to bypass authentication and gain administrative access via unspecified vectors.
CVE-2008-5576 1Scssboard 1Scssboard Apr 23, 2026 Dec 15, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 admin/forums.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to bypass authentication and gain administrative access via a large value of the current_user[users_level] parameter.
CVE-2008-5575 1Proclanmanager 1Pro Clan Manager Apr 23, 2026 Dec 15, 2008 N/A· v4 N/A· v3 7.5 HIGH· v2 Session fixation vulnerability in Pro Clan Manager 0.4.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.

Previous 1...248249250...261 Next