Java Open Single Sign-On Project Home (JOSSO) allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element aka a \Signature exclusion attack.\


Eduserv OpenAthens SP 2.0 for Java allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element aka a \Signature exclusion attack.\


The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36 6.x before 6.0.36 and 7.x before 7.0.30 caches information about the authenticated user within the session state which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.


The

Portable

phpMyAdmin

plugin

before

for

WordPress

allows

remote

attackers

to

bypass

authentication

and

obtain

phpMyAdmin

console

access

via

a

direct

request

to

wp-content/plugins/portable-phpmyadmin/wp-pma-mod.


The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20 6.1.0 through 6.1.12 6.2.0 through 6.2.5 and 6.3.0 through 6.3.2 on UNIX and Linux when old-style password authentication is enabled allows remote attackers to bypass authentication via a crafted session involving entry of blank passwords as demonstrated by a root login session from a modified OpenSSH client with an added input_userauth_passwd_changereq call in sshconnect2.c.


Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element aka a \Signature exclusion attack \ a different vulnerability than CVE-2012-4418.


Cisco Secure Access Control System (ACS) 5.x before 5.2 Patch 11 and 5.3 before 5.3 Patch 7 when a certain configuration involving TACACS+ and LDAP is used does not properly validate passwords which allows remote attackers to bypass authentication by sending a valid username and a crafted password string aka Bug ID CSCuc65634.


The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10 5.2.0 and 6.0.1 and Enterprise Web Platform (EWP) 5.2.0 allow remote attackers to bypass authentication via an empty password.


The ldap_fluff gem for Ruby as used in Red Hat CloudForms 1.1 when using Active Directory for authentication allows remote attackers to bypass authentication via unspecified vectors.


The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SYSTEM account leading to privilege escalation. To exploit this vulnerability an attacker must have local access the the host running Serv-U and a Serv-U administrator have an active management console session.


In very rare cases a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place.


The Embedthis HTTP library and Appweb versions before 7.0.3 have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request it is possible to bypass authentication for the form and digest login types.


Discuz! DiscuzX 3.4 when WeChat login is enabled allows remote attackers to bypass authentication by leveraging a non-empty #wechat#common_member_wechatmp to gain login access to an account via a plugin.php ac=wxregister request (the attacker does not have control over which account will be accessed).


TBK DVR4104 and DVR4216 devices as well as Novo CeNova QSee Pulnix XVR 5 in 1 Securus Night OWL DVR Login HVR Login and MDVR Login which run re-branded versions of the original TBK DVR4104 and DVR4216 series allow remote attackers to bypass authentication via a \Cookie: uid=admin\ header as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.


Western Digital WD My Cloud v04.05.00-320 devices embed the session token (aka PHPSESSID) in filenames which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a product that uses My Cloud.


Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster.


Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF Open Redirect Bypass Authentication Protocol.


A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations.


A password hash usage authentication bypass vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to bypass authentication on vulnerable installations.


SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B devices improperly identifies users only by the authentication level sent in the cookies which allow remote attackers to bypass authentication and gain administrator access by setting the authLevel cookie to 255.


A vulnerability in the API gateway of the Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated remote attacker to bypass authentication and access critical services. The vulnerability is due to a failure to normalize URLs prior to servicing requests. An attacker could exploit this vulnerability by submitting a crafted URL designed to exploit the issue. A successful exploit could allow the attacker to gain unauthenticated access to critical services resulting in elevated privileges in DNA Center. This vulnerability affects Cisco DNA Center Software Releases prior to 1.1.2. Cisco Bug IDs: CSCvi09394.


Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass authentication to obtain the schedules without access privilege via unspecified vectors.


INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant traffic. This is a different vulnerability than CVE-2018-0669.


Cybozu Office 10.0.0 to 10.7.0 allows authenticated attackers to bypass authentication to view the schedules that are not permitted to access via unspecified vectors.


A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The vulnerability is due to improper security restrictions that are imposed by the web-based service portal of the affected software. An attacker could exploit this vulnerability by submitting an empty password value to an affected portal when prompted to enter an administrative password for the portal. A successful exploit could allow the attacker to bypass authentication and gain administrator privileges for the web-based service portal of the affected software. This vulnerability affects Cisco Elastic Services Controller Software Release 3.0.0. Cisco Bug IDs: CSCvg29809.


INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant traffic. This is a different vulnerability than CVE-2018-0670.


A vulnerability in the identity management service of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated remote attacker to bypass authentication and take complete control of identity management functions. The vulnerability is due to insufficient security restrictions for critical management functions. An attacker could exploit this vulnerability by sending a valid identity management request to the affected system. An exploit could allow the attacker to view and make unauthorized modifications to existing system users as well as create new users.


A vulnerability in the container management subsystem of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated remote attacker to bypass authentication and gain elevated privileges. This vulnerability is due to an insecure default configuration of the Kubernetes container management subsystem within DNA Center. An attacker who has the ability to access the Kubernetes service port could execute commands with elevated privileges within provisioned containers. A successful exploit could result in a complete compromise of affected containers. This vulnerability affects Cisco DNA Center Software Releases 1.1.3 and prior. Cisco Bug IDs: CSCvi47253.


A vulnerability in Web Authentication (WebAuth) clients for the Cisco Wireless LAN Controller (WLC) and Aironet Access Points running Cisco IOS Software could allow an unauthenticated adjacent attacker to bypass authentication and pass traffic. The vulnerability is due to incorrect implementation of authentication for WebAuth clients in a specific configuration. An attacker could exploit this vulnerability by sending traffic to local network resources without having gone through authentication. A successful exploit could allow the attacker to bypass authentication and pass traffic. This affects Cisco Aironet Access Points running Cisco IOS Software and Cisco Wireless LAN Controller (WLC) releases prior to 8.5.110.0 for the following specific WLC configuration only: (1) The Access Point (AP) is configured in FlexConnect Mode with NAT. (2) The WLAN is configured for central switching meaning the client is being assigned a unique IP address. (3) The AP is configured with a Split Tunnel access control list (ACL) for access to local network resources meaning the AP is doing the NAT on the connection. (4) The client is using WebAuth. This vulnerability does not apply to .1x clients in the same configuration. Cisco Bug IDs: CSCvc79502 CSCvf71789.


IIJ SmartKey App for Android version 2.1.0 and earlier allows remote attackers to bypass authentication effect_of_bypassing_authentication via unspecified vectors.


BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to bypass authentication to access to the management screen and execute an arbitrary command via unspecified vectors.


A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker can brute force parameters required to bypass authentication and access the web interface to use all its functions except for password change.


An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37 3.3.x before 3.3.17 3.4.x before 3.4.7 and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a \null\ password and valid username which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.


Use

of

a

Hard-coded

Cryptographic

Key

used

to

protect

cookie

session

data

in

in

the

administrative

console

in

Dialogic

PowerMedia

XMS

through

allows

remote

attackers

to

bypass

authentication.


An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending \?images\ to any URL of the device that requires authentication as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.


The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use any sort of session ID an attacker might bypass authentication.


IBM

LoopBack

(IBM

API

Connect

and

could

allow

an

attacker

to

bypass

authentication

if

the

AccessToken

Model

is

exposed

over

a

REST

API

it

is

then

possible

for

anyone

to

create

an

AccessToken

for

any

User

provided

they

know

the

userId

and

can

hence

get

access

to

the

other

userÃ¢Â€Â™s

data

access

to

their

privileges

(if

the

user

happens

to

be

an

Admin

for

example).

IBM

X-Force

ID:


IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication via a direct request or forced browsing to a page other than URL intended. IBM X-Force ID: 142561.


IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2 and 7.3) could allow a remote attacker to bypass authentication and obtain sensitive information. IBM X-Force ID: 144164.


An issue was discovered on D-Link DIR-809 A1 through 1.09 A2 through 1.11 and Guest Zone through 1.09 devices. One can bypass authentication mechanisms to download the configuration file.


Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature allowing the attack to potentially bypass authentication to SAML service providers.


Cobham Sea Tel 121 build 222701 devices allow remote attackers to bypass authentication via a direct request to MenuDealerGx.html MenuDealer.html MenuEuNCGx.html MenuEuNC.html MenuSysGx.html or MenuSys.html.


A vulnerability in the shell access request mechanism of Cisco IOS XE Software could allow an authenticated local attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insufficient authentication mechanisms for certain commands. An attacker could exploit this vulnerability by requesting access to the root shell of an affected device after the shell access feature has been enabled. A successful exploit could allow the attacker to bypass authentication and gain unrestricted access to the root shell of the affected device.


A vulnerability in the Stealthwatch Management Console (SMC) of Cisco Stealthwatch Enterprise could allow an unauthenticated remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected system. The vulnerability is due to an insecure system configuration. An attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted application. An exploit could allow the attacker to gain unauthenticated access resulting in elevated privileges in the SMC.


A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated remote attacker to bypass authentication and have direct unauthorized access to critical management functions. The vulnerability is due to an insecure default configuration of the affected system. An attacker could exploit this vulnerability by directly connecting to the exposed services. An exploit could allow the attacker to retrieve and modify critical system files.


A vulnerability in the MACsec Key Agreement (MKA) using Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) functionality of Cisco IOS XE Software could allow an unauthenticated adjacent attacker to bypass authentication and pass traffic through a Layer 3 interface of an affected device. The vulnerability is due to a logic error in the affected software. An attacker could exploit this vulnerability by connecting to and passing traffic through a Layer 3 interface of an affected device if the interface is configured for MACsec MKA using EAP-TLS and is running in access-session closed mode. A successful exploit could allow the attacker to bypass 802.1x network access controls and gain access to the network.


** DISPUTED ** An issue was discovered in the Ola Money (aka com.olacabs.olamoney) application 1.9.0 for Android. If an attacker controls an application with accessibility permissions and the ability to read SMS messages then the Forgot Password screen can be used to bypass authentication. NOTE: the vendor does not agree that this is a security issue requiring a fix.


SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.


OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file for a specific screen as demonstrated by monitor.html.


Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature allowing the attack to potentially bypass authentication to SAML service providers.


A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated remote attacker to bypass authentication and gain administrator privileges because the use of hardcoded credentials.


The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android) which results in an attacker being able to reuse cookies to bypass authentication and disable the camera.


SQL injection in admin.php in Online Book Store 1.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication.


Z-BlogPHP

Valyria

is

affected

by

incorrect

access

control.

PHP

loose

comparison

and

a

magic

hash

can

be

used

to

bypass

authentication.

zb_user/plugin/passwordvisit/include.php:passwordvisit_input_password()

uses

loose

comparison

to

authenticate

which

can

be

bypassed

via

magic

hash

values.


TimeTools

and

devices

allow

remote

attackers

to

bypass

authentication

by

placing

in

a

request

aka

a

\hardcoded

cookie.\


This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867 DIR-878 and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-9470.


Incorrect

Access

Control

in

Beckhoff

Automation

GmbH

Co.

KG

with

firmware

version

CX9020_CB3011_WEC7_HPS_v602_TC31_B4016.6

allows

remote

attackers

to

bypass

authentication

via

the

\CE

Remote

Display

Tool\

as

it

does

not

close

the

incoming

connection

on

the

Windows

CE

side

if

the

credentials

are

incorrect.


The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore if the network communication or endpoints for these applications are not protected unauthorized actors can bypass authentication and make unauthorized connections to the server application.


An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality.


An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input validation on the username and password parameters. An attacker can send malicious input in the post request to /admin/ajax.php?action=login and bypass authentication extract sensitive information etc.


The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions which may be vulnerable to brute force attacks to bypass authentication.


In SaltStack Salt through 3002 salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.


This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020 R6080 R6120 R6220 R6260 R6700v2 R6800 R6900v2 R7450 JNR3210 WNR2020 Nighthawk AC2100 and Nighthawk AC2400 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11355.


This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service which listens on TCP port 80 by default. The issue results from improper state tracking in the password recovery process. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11365.


An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authenticate. An attacker who changes the result parameter (to true) in this JavaScript code can bypass authentication and achieve limited privileges (ability to see every option but not modify them).


Parameter manipulation can bypass authentication to cause file upload and execution. This will execute the remote code. This issue affects: Raonwiz DEXT5Editor versions prior to 3.5.1405747.1100.03.


VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow an unauthenticated attacker to discover the cryptographic key from the web server and gain information about the login and the encryption/decryption mechanism which may be exploited to bypass authentication of the HTML5 HMI web interface.


An issue was discovered in MK-AUTH 19.01. The web login functionality allows an attacker to bypass authentication and gain client privileges via SQL injection in central/executar_login.php.


Authentication Bypass Vulnerability RSA MFA Agent 2.0 for Microsoft Windows contains an Authentication Bypass vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability by using an alternate path to bypass authentication in order to gain full access to the system.


CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50 CENTUM VP (includes CENTUM VP Small Basic) R4.01.00 to R6.07.00 B/M9000CS R5.04.01 to R5.05.01 and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to bypass authentication and send altered communication packets via unspecified vectors.


OpenBlocks IoT VX2 prior to Ver.4.0.0 (Ver.3 Series) allows an attacker on the same network segment to bypass authentication and to initialize the device via unspecified vectors.


ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker on the same network segment to bypass authentication and to view the images which were recorded by the other ilbo user's device via unspecified vectors.


MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_connections (default 151) is lower than Apache (or another web server) setting MaxRequestWorkers (formerly MaxClients) (default 256). This can be done by sending at least 151 simultaneous requests to the Magento website to trigger a \Too many connections\ error then use default magmi:magmi basic authentication to remotely bypass authentication.


Multiple NEC products (Express5800/T110j Express5800/T110j-S Express5800/T110j (2nd-Gen) Express5800/T110j-S (2nd-Gen) iStorage NS100Ti and Express5800/GT110j) where Baseboard Management Controller (BMC) firmware Rev1.09 and earlier is applied allows remote attackers to bypass authentication and then obtain/modify BMC setting information obtain monitoring information or reboot/shut down the vulnerable product via unspecified vectors.


and

free

edition

free

edition

free

edition

and

earlier

free

edition

and

earlier

free

edition

free

edition

and

earlier

free

edition

and

earlier

and

free

edition

allows

remote

attackers

to

bypass

authentication

and

log

in

to

the

product

with

administrative

privileges

via

unspecified

vectors.


The Eat Spray Love mobile app for both iOS and Android contains logic that allows users to bypass authentication and retrieve or modify information that they would not normally have access to.


IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows) 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 through 8.1.9.1 (Linux) 8.1.9.0 through 8.1.9.1 (AIX) web user interfaces could allow an attacker to bypass authentication due to improper session validation which can result in access to unauthorized resources. IBM X-Force ID: 182019.


IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server an attacker could exploit this vulnerability to bypass authentication and gain access to a limited number of debug functions such as logging levels. IBM X-Force ID: 192153.


IBM InfoSphere Data Replication 11.4 and IBM InfoSphere Change Data Capture for z/OS 10.2.1 under certain configurations could allow a user to bypass authentication mechanisms using an empty password string. IBM X-Force ID: 189834


OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication which can be used to potentially trigger further information leaks.


An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier 10.4.0.0 10.4.0.1 10.4.0.2 10.4.0.3 10.5.1.0 10.5.2.0 and 10.6.0.0 that allows remote attackers to bypass authentication mechanisms via unspecified vectors.


DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.


TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.


The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel.


Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.


This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9703.


This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867 DIR-878 and DIR-882 routers with firmware 1.20B10_BETA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP requests. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-10835.


TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive information via vectors involving a Wi-Fi session with GPS enabled aka CNVD-2020-04855.


Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user.


An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave. An attacker in a privileged network position may be able to bypass authentication policy.


An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (China / India) software. The S Secure application allows attackers to bypass authentication for a locked Gallery application via the Reminder application. The Samsung ID is SVE-2020-18689 (November 2020).


An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its preview.


This vulnerability allows remote attackers to bypass authentication on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SSH port forwarding requests during initial setup. The issue results from the lack of proper authentication prior to establishing SSH port forwarding rules. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the WAN interface. Was ZDI-CAN-9664.


The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation in order to maintain backwards compatibility GCS and autopilot negotiate the version via the AUTOPILOT_VERSION message. Since this negotiation depends on the answer an attacker may craft packages in a way that hints the autopilot to adopt version 1.0 of MAVLink for the communication. Given the lack of authentication capabilities in such version of MAVLink (refer to CVE-2020-10282) attackers may use this method to bypass authentication capabilities and interact with the autopilot directly.


This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Although authentication is required to exploit this vulnerability the existing authentication mechanism can be bypassed. The specific flaw exists within the UPnP service which listens on TCP port 5000 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9643.


The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5 2020.2 with no hotfix installed and 2020.2 HF 1 are affected.


This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authentication mechanism. The issue is due to insufficient authentication on post-authentication requests. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from unauthenticated users. Was ZDI-CAN-10182.


A vulnerability in an access control mechanism of Cisco Cyber Vision Center Software could allow an unauthenticated remote attacker to bypass authentication and access internal services that are running on an affected device. The vulnerability is due to insufficient enforcement of access control in the software. An attacker could exploit this vulnerability by directly accessing the internal services of an affected device. A successful exploit could allow an attacker to impact monitoring of sensors that are managed by the software.


A vulnerability in the Kerberos authentication feature of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated remote attacker to impersonate the Kerberos key distribution center (KDC) and bypass authentication on an affected device that is configured to perform Kerberos authentication for VPN or local device access. The vulnerability is due to insufficient identity verification of the KDC when a successful authentication response is received. An attacker could exploit this vulnerability by spoofing the KDC server response to the ASA device. This malicious response would not have been authenticated by the KDC. A successful attack could allow an attacker to bypass Kerberos authentication.


A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated physical attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insufficient authentication mechanisms for certain commands. An attacker could exploit this vulnerability by stopping the boot initialization of an affected device. A successful exploit could allow the attacker to bypass authentication and gain unrestricted access to the root shell of the affected device.


A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated remote attacker to bypass authentication and execute arbitrary actions on an affected device. The vulnerability is due to a failure in the software to perform proper authentication. An attacker could exploit this vulnerability by browsing to one of the hosted URLs in Cisco DCNM. A successful exploit could allow the attacker to interact with and use certain functions within the Cisco DCNM.


A vulnerability in the REST API of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability exists because different installations share a static encryption key. An attacker could exploit this vulnerability by using the static key to craft a valid session token. A successful exploit could allow the attacker to perform arbitrary actions through the REST API with administrative privileges.


A vulnerability in the Common Access Card (CAC) authentication feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated remote attacker to bypass authentication and access the FMC system. The attacker must have a valid CAC to initiate the access attempt. The vulnerability is due to incorrect session invalidation during CAC authentication. An attacker could exploit this vulnerability by performing a CAC-based authentication attempt to an affected system. A successful exploit could allow the attacker to access an affected system with the privileges of a CAC-authenticated user who is currently logged in.


FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element aka a \Signature exclusion attack\.


Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces which can be queried using the GIOP protocol on TCP port 30024. An attacker can bypass authentication and OmniVista invokes methods (AddJobSet AddJob and ExecuteNow) that can be used to run arbitrary commands on the server with the privilege of NT AUTHORITY\\SYSTEM on the server. NOTE: The discoverer states \The vendor position is to refer to the technical guidelines of the product security deployment to mitigate this issue which means applying proper firewall rules to prevent unauthorised clients to connect to the OmniVista server.\


An issue was discovered in Moxa NPort 5110 versions prior to 2.6 NPort 5130/5150 Series versions prior to 3.6 NPort 5200 Series versions prior to 2.8 NPort 5400 Series versions prior to 3.11 NPort 5600 Series versions prior to 3.7 NPort 5100A Series & NPort P5150A versions prior to 1.3 NPort 5200A Series versions prior to 1.3 NPort 5150AI-M12 Series versions prior to 1.2 NPort 5250AI-M12 Series versions prior to 1.2 NPort 5450AI-M12 Series versions prior to 1.2 NPort 5600-8-DT Series versions prior to 2.4 NPort 5600-8-DTL Series versions prior to 2.4 NPort 6x50 Series versions prior to 1.13.11 NPort IA5450A versions prior to v1.4. An attacker can freely use brute force to determine parameters needed to bypass authentication.


Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigating directly to /admin.php?mod=admin&func=panel


The get_sessions servlet in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) before 8.5 and CA Unified Infrastructure Management Snap (formerly CA Nimsoft Monitor Snap) allows remote attackers to obtain active session ids and consequently bypass authentication or gain privileges via unspecified vectors.


Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values which allows remote attackers to bypass authentication by guessing the value.


It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authentication requirements by using a specially crafted X.509 certificate.


Sony PCS-XG100 PCS-XG100S PCS-XG100C PCS-XG77 PCS-XG77S PCS-XG77C devices with firmware versions prior to Ver.1.51 and PCS-XC1 devices with firmware version prior to Ver.1.22 allow an attacker on the same network segment to bypass authentication to perform administrative operations via unspecified vectors.


The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting which allows remote attackers to bypass authentication via a crafted token.


In the GUI of Ceragon FibeAir IP-10 (before 7.2.0) devices a remote attacker can bypass authentication by adding an ALBATROSS cookie with the value 0-4-11 to their browser.


When attempting to allow authentication mode `try` in hapi hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication.


Media Origination System Suite Software 2.6 and earlier in Cisco Virtual Media Packager (VMP) allows remote attackers to bypass authentication and make arbitrary Platform and Applications Manager (PAM) API calls via unspecified vectors aka Bug ID CSCuz52110.


A

vulnerability

in

the

implementation

of

Version

for

SSH

authentication

functionality

in

Cisco

IOS

and

IOS

XE

Software

could

allow

an

unauthenticated

remote

attacker

to

bypass

authentication

on

an

affected

system.

More

Information:

Known

Affected

Releases:

Known

Fixed

Releases:


ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.


A vulnerability in the web-based graphical user interface (GUI) of Cisco Prime Home could allow an unauthenticated remote attacker to bypass authentication. The attacker could be granted full administrator privileges. Cisco Prime Home versions 5.1.1.6 and earlier and 5.2.2.2 and earlier have been confirmed to be vulnerable. Cisco Prime Home versions 6.0 and later are not vulnerable. More Information: CSCvb71732. Known Affected Releases: 5.0 5.0(1) 5.0(1.1) 5.0(1.2) 5.0(2) 5.15.1(0) 5.1(1) 5.1(1.3) 5.1(1.4) 5.1(1.5) 5.1(1.6) 5.1(2) 5.1(2.1) 5.1(2.3) 5.25.2(0.1) 5.2(1.0) 5.2(1.2) 5.2(2.0) 5.2(2.1) 5.2(2.2).


The management interface of Huawei WS331a routers with software before WS331a-10 V100R001C01B112 allows remote attackers to bypass authentication and obtain administrative access by sending \special packages\ to the LAN interface.


The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as \False \ which makes it easier for remote attackers to bypass authentication via a brute force attack aka SAP Security Note 2216869.


Moxa Device Server Web Console 5232-N allows remote attackers to bypass authentication and consequently modify settings and data via vectors related to reading a cookie parameter containing a UserId value.


BMC BladeLogic Server Automation (BSA) before 8.7 Patch 3 allows remote attackers to bypass authentication and consequently read arbitrary files or possibly have unspecified other impact by leveraging a \logic flaw\ in the authentication process.


The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and read arbitrary files via unspecified vectors.


Apache Pony Mail 0.6c through 0.8b allows remote attackers to bypass authentication.


The AMQP 0-8 0-9 0-91 and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.


Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier mishandles sessions which allows remote attackers to bypass authentication and make arbitrary configuration changes via unspecified vectors.


The pam_sm_authenticate function in pam_sshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account.


Fortinet

FortiSwitch

and

models

when

in

FortiLink

managed

mode

and

upgraded

to

might

allow

remote

attackers

to

bypass

authentication

and

gain

administrative

access

via

an

empty

password

for

the

account.


Johnson & Johnson Animas OneTouch Ping devices allow remote attackers to bypass authentication via replay attacks.


firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough (2) removePassthrough (3) addEntry (4) removeEntry or (5) setEntries D-Bus API method.


Tollgrade LightHouse SMS before 5.1 patch 3 allows remote attackers to bypass authentication and restart the software via unspecified vectors.


Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html.


Johnson & Johnson Animas OneTouch Ping devices mishandle acknowledgements which makes it easier for remote attackers to bypass authentication via a custom communication protocol.


libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.


Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call.


Moxa MGate MB3180 before 1.8 MGate MB3280 before 2.7 MGate MB3480 before 2.6 MGate MB3170 before 2.5 and MGate MB3270 before 2.7 use weak encryption which allows remote attackers to bypass authentication via a brute-force series of guesses for a parameter value.


The Mobile and Remote Access (MRA) component in Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7 and Expressway X8.1 through X8.6 mishandles certificates which allows remote attackers to bypass authentication via an arbitrary trusted certificate aka Bug ID CSCuz64601.


The telnetd service in FreeBSD 9.3 10.1 10.2 10.3 and 11.0 allows remote attackers to inject arguments to login and bypass authentication via vectors involving a \sequence of memory allocation failures.\


NetApp OnCommand Workflow Automation before 3.1P2 allows remote attackers to bypass authentication via unspecified vectors.


NetApp SnapCenter Server 1.0 and 1.0P1 allows remote attackers to partially bypass authentication and then list and delete backups via unspecified vectors.


The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.


IBM UrbanCode Deploy 6.0.x before 6.0.1.13 6.1.x before 6.1.3.3 and 6.2.x before 6.2.1.1 when agent-relay Codestation artifact caching is enabled allows remote attackers to bypass authentication and obtain sensitive artifact information via unspecified vectors.


Kerberos in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 and Windows 10 Gold and 1511 does not properly validate password changes which allows remote attackers to bypass authentication by deploying a crafted Key Distribution Center (KDC) and then performing a sign-in action aka \Windows Kerberos Security Feature Bypass.\


IBM Security QRadar Incident Forensics 7.2.x before 7.2.7 allows remote attackers to bypass authentication and obtain sensitive information or modify data via unspecified vectors.


Ecava IntegraXor before 5.0 build 4522 allows remote attackers to bypass authentication and access unspecified web pages via unknown vectors.


Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username which triggers an unauthenticated bind.


HPE Network Node Manager i (NNMi) 9.20 9.23 9.24 9.25 10.00 and 10.01 allows remote attackers to bypass authentication via unspecified vectors.


HP Support Assistant before 8.1.52.1 allows remote attackers to bypass authentication via unspecified vectors.


Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultaneously making a request for the unprotected vb.htm resource.


Apache CloudStack 4.5.x before 4.5.2.1 4.6.x before 4.6.2.1 4.7.x before 4.7.1.1 and 4.8.x before 4.8.0.1 when SAML-based authentication is enabled and used allow remote attackers to bypass authentication and access the user interface via vectors related to the SAML plugin.


comersus_backoffice_install10.asp in BackOffice Lite 6.0 and 6.01 allows remote attackers to bypass authentication and gain privileges via a direct request to the program.


EMC Legato NetWorker Sun Solstice Backup 6.0 and 6.1 and StorEdge Enterprise Backup 7.0 through 7.2 rely on AUTH_UNIX authentication which relies on user ID for authentication and allows remote attackers to bypass authentication and gain privileges by spoofing a username or UID.


ELOG before 2.5.7 allows remote attackers to bypass authentication and download a configuration file that contains a sensitive write password via a modified URL.


betaparticle blog (bp blog) posisbly before version 4 allows remote attackers to bypass authentication and (1) upload files via a direct request to upload.asp or (2) delete files via a direct request to myFiles.asp.


The web-based administrative interface for 3Com OfficeConnect Wireless 11g Access Point (AP) 1.00.08 and possibly earlier versions before 1.03.07A allows remote attackers to bypass authentication and obtain sensitive information by directly accessing the (1) config.bin (2) profile.wlp?PN=ggg or (3) event.logs URLs.


Webmasters-Debutants WD Guestbook 2.8 allows remote attackers to bypass authentication and perform certain administrator actions via a direct HTTP POST request to (1) ajout_admin2.php or (2) suppr.php.


CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the \boogaadeeboo\ string which is hard-coded in the $hidden_hash variable.


Bay Technical Associates RPC-3 Telnet Host 3.05 allows remote attackers to bypass authentication by pressing the escape and enter keys at the username prompt.


Sawmill before 7.1.6 allows remote attackers to bypass authentication and (1) gain administrative privileges or (2) add a license.


DList (dlist.exe) in DMail 3.1a allows remote attackers to bypass authentication read log files and shutdown the system via a sendlog command with an incorrect password hash which is not properly handled by the _cmd_sendlog function.


D-Link DSL-504T allows remote attackers to bypass authentication and gain privileges such as upgrade firmware restart the router or restore a saved configuration via a direct request to firmwarecfg.


ProfitCode PayProCart 3.0 allows remote attackers to bypass authentication and gain administrative privileges to the admin control panel as demonstrated via a direct request to adminshop/index.php with hex-encoded .. sequences in the ftoedit parameter.


message.htm for Woppoware PostMaster 4.2.2 (build 3.2.5) allows remote attackers to bypass authentication by modifying the email parameter.


The web module in Neteyes Nexusway allows remote attackers to bypass authentication and gain administrator privileges by setting the cyclone500_auth cookie.


Cisco IOS 12.2T 12.3 and 12.3T when using Easy VPN Server XAUTH version 6 authentication allows remote attackers to bypass authentication via a \malformed packet.\


D-Link DSL-502T DSL-504T DSL-562T and DSL-G604T when /cgi-bin/firmwarecfg is executed allows remote attackers to bypass authentication (1) if their IP address already exists in /var/tmp/fw_ip or (2) if their request is the first which causes /var/tmp/fw_ip to be created and contain their IP address.


setup.php in phpStat 1.5 allows remote attackers to bypass authentication and gain administrator privileges by setting the $check variable.


Acrowave AAP-3100AR wireless router allows remote attackers to bypass authentication by pressing CTRL-C at the username or password prompt in a telnet session which causes the shell to crash and restart then leave the user in the new shell.


episodex guestbook allows remote attackers to bypass authentication and edit scripts via a direct request to admin.asp.


IBM Informix Dynamic Database server running on Windows XP with Simple File Sharing enabled allows remote attackers to bypass authentication and log on to the guest account by supplying an invalid username.


Wireless Access Points (AP) for (1) Avaya AP-3 through AP-6 2.5 to 2.5.4 and AP-7/AP-8 2.5 and other versions before 3.1 and (2) Proxim AP-600 and AP-2000 before 2.5.5 and Proxim AP-700 and AP-4000 after 2.4.11 and before 3.1 use a static WEP key of \12345\ which allows remote attackers to bypass authentication.


IBM DB2 Database server running on Windows XP with Simple File Sharing enabled allows remote attackers to bypass authentication and log on to the guest account without supplying a password.


miniserv.pl in Webmin before 1.230 and Usermin before 1.160 when \full PAM conversations\ is enabled allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters (line feed or carriage return).


admin_news.php in Archilles Newsworld up to 1.3.0 allows attackers to bypass authentication by obtaining the password hash for another user for example through another Newsworld vulnerability and specifying the hash in the pwd argument.


Splatt Forum 3.0 to 3.2 allows remote attackers to bypass authentication via unknown vectors.


Helpdesk Software Hesk allows remote attackers to bypass authentication for (1) admin.php and (2) admin_main.php by modifying the PHPSESSID session ID parameter or cookie.


Compuware DriverStudio Remote Control service (DSRsvc.exe) 2.7 and 3.0 beta 2 allows remote attackers to bypass authentication via a null session.


Oracle Databases running on Windows XP with Simple File Sharing enabled allows remote attackers to bypass authentication by supplying a valid username.


Ar-blog 5.2 and earlier allows remote attackers to bypass authentication by modifying cookies.


Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) user parameter in the Login action and remote authenticated users via the (2) TicketID and (3) ArticleID parameters of the AgentTicketPlain action.


Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to bypass authentication and execute arbitrary SQL commands via the (1) username or (2) password to admin/admin_validate_login or the (3) login (4) password and (5) flag parameters to login_validate.php.


Multiple SQL injection vulnerabilities in versatileBulletinBoard (vBB) 1.0.0 RC2 allow remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) login field (2) \search this thread\ feature (3) \search for posts\ feature (4) \forgot password\ feature (5) list parameter in userlistpre.php and the (6) select (7) categ and (8) to parameters in index.php.


PHP Easy Download allows remote attackers to bypass authentication via edit.php.


slapd daemon in IBM Tivoli Directory Server (ITDS) 5.2.0 and 6.0.0 binds using SASL EXTERNAL which allows attackers to bypass authentication and modify and delete directory data via unknown attack vectors.


Unknown vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265 332 and 340 420 through 490 and 535 through 555 allows remote attackers to bypass authentication.


login.php in PCXP/TOPPE CMS allows remote attackers to bypass authentication and gain privileges by modifying the cookie to match the target userid.


login.php in phpWishlist before 0.1.15 allows remote attackers to bypass authentication via a direct request to admin.php.


Helpdesk software Hesk 0.92 does not properly verify usernames and passwords which allows remote attackers to bypass authentication via a direct request to admin_main.php.


Cisco IOS 12.2T through 12.4 allows remote attackers to bypass Authentication Authorization and Accounting (AAA) RADIUS authentication if the fallback method is set to none via a long username.


class.xmail.php in PhpXmail 0.7 through 1.1 does not properly handle large passwords which prevents an error message from being returned and allows remote attackers to bypass authentication and gain unauthorized access.


Unknown vulnerability in Parlano MindAlign 5.0 and later versions allows remote attackers to bypass authentication via unknown vectors.


Unknown vulnerability in Lasso Professional Server8.0.4 and 8.0.5 allows attackers to bypass authentication related to Auth tags.


B-FOCuS Router 312+ allows remote attackers to bypass authentication and gain unauthorized access via a direct request to firmwarecfg.


SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via crafted values in an XML file as demonstrated using the blogger.getPost method.


Unknown vulnerability in Linksys WRT54GS wireless router with firmware 4.50.6 with WPA Personal/TKIP authentication enabled allows remote clients to bypass authentication by connecting without using encryption.


BFCommand & Control Server Manager BFCC 1.22_A and earlier and BFVCC 2.14_B and earlier allows remote attackers to bypass authentication via (1) an unknown attack vector or (2) a NULL (0x00) as a username.


functions.php in Ragnarok Online Control Panel (ROCP) 4.3.4a allows remote attackers to bypass authentication by requesting account_manage.php with a trailing \/login.php\ PHP_SELF value which is not properly handled by the CHECK_AUTH function.


The login page in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424 6.2.3.23 and other versions before 6 allows remote attackers to bypass authentication and gain privileges as other users via a modified user_id parameter and a \/\ in the encoded_pw parameter.


Ocean12 Calendar Manager Pro 1.01 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to /admin/view.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


SAPID

CMS

before

allows

remote

attackers

to

bypass

authentication

via

direct

requests

to

the

usr/system

files

and

edit.php.


The security handler in GoAhead WebServer before 2.1.1 allows remote attackers to bypass authentication and obtain access to protected web content via \an extra slash in a URL \ a different vulnerability than CVE-2002-1603.


Savant Web Server 3.1 and earlier allows remote attackers to bypass authentication for password protected user folders via a URL with a hex encoded space (%20) and a '.' (%2e) at the end of the filename.


Falcon web server 2.0.0.1020 and earlier allows remote attackers to bypass authentication and read restricted files via an extra / (slash) in the requested URL.


(1) Webmin 0.96 and (2) Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information which can force Webmin or Usermin to accept arbitrary username/session ID combinations.


The Web server for Polycom ViewStation before 7.2.4 allows remote attackers to bypass authentication and read files via Unicode encoded requests.


Citrix NFuse 1.6 allows remote attackers to bypass authentication and obtain sensitive information by directly calling launch.asp with invalid NFUSE_USER and NFUSE_PASSWORD parameters.


Lucent VitalSuite 8.0 through 8.2 including VitalNet VitalEvent and VitalHelp/VitalAnalysis allows remote attackers to bypass authentication via a direct HTTP request to the VsSetCookie.exe program which returns a valid cookie for the desired user.


Web configuration utility in HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier allows unauthorized users to bypass authentication via a direct HTTP request to the web_access.html file which allows the user to change the switch's configuration and modify the administrator password.


dnstools.php for DNSTools 2.0 beta 4 and earlier allows remote attackers to bypass authentication and gain privileges by setting the user_logged_in or user_dnstools_administrator parameters.


Oracle 8i and 9i with PL/SQL package for External Procedures (EXTPROC) allows remote attackers to bypass authentication and execute arbitrary functions by using the TNS Listener to directly connect to the EXTPROC process.


AOL AOLserver 3.4.2 Win32 allows remote attackers to bypass authentication and read password-protected files via a URL that directly references the file.


Macromedia JRun Administration Server allows remote attackers to bypass authentication on the login form via an extra slash (/) in the URL.


admin.asp in AdMentor 2.11 allows remote attackers to bypass authentication and gain privileges via a SQL injection attack on the Login and Password arguments.


The web-based configuration interface for the Cisco ATA 186 Analog Telephone Adaptor allows remote attackers to bypass authentication via an HTTP POST request with a single byte which allows the attackers to (1) obtain the password from the login screen or (2) reconfigure the adaptor by modifying certain request parameters.


ASP-Nuke RC2 and earlier allows remote attackers to bypass authentication and gain privileges by modifying the \pseudo\ cookie.


Microsoft Metadirectory Services (MMS) 2.2 allows remote attackers to bypass authentication and modify sensitive data by using an LDAP client to directly connect to MMS and bypass the checks for MMS credentials.


PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to bypass authentication for a Database Access Descriptor (DAD) by modifying the URL to reference an alternate DAD that already has valid credentials.


Open Bulletin Board (OpenBB) 1.0.0 RC3 allows remote attackers to bypass authentication and access modifier options via a direct request to moderator.php with the action and ismod parameters.


RCONAG6 for Novell Netware SP2 while running RconJ in secure mode allows remote attackers to bypass authentication using the RconJ \Secure IP\ (SSL) option during a connection.


PHProjekt 2.0 through 3.1 relies on the $PHP_SELF variable for authentication which allows remote attackers to bypass authentication for scripts via a request to a .php file with \sms\ in the URL which is included in the PATH_INFO portion of the $PHP_SELF variable as demonstrated using \mail_send.php/sms\.


The remote administration capability for the D-Link DI-804 router 4.68 allows remote attackers to bypass authentication and release DHCP addresses or obtain sensitive information via a direct web request to the pages (1) release.htm (2) Device Status or (3) Device Information.


index.php in gBook 1.4 allows remote attackers to bypass authentication and gain administrative privileges by setting the login parameter to true.


secure_inc.php in PhotoDB 1.4 allows remote attackers to bypass authentication via a URL with a large Time parameter non-empty rmtusername and rmtpassword parameter and an accesslevel parameter that is lower than the access level of the requested page.


index.php in dotProject 0.2.1.5 allows remote attackers to bypass authentication via a cookie or URL with the user_cookie parameter set to 1.


Nukeviet 2.0 Beta allows remote attackers to bypass authentication and gain administrative access by setting the admf cookie to 1. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


admin/forums.php in sCssBoard 1.0 1.1 1.11 and 1.12 allows remote attackers to bypass authentication and gain administrative access via a large value of the current_userusers_level parameter.


SapporoWorks BlackJumboDog (BJD) before 4.2.3 allows remote attackers to bypass authentication and obtain sensitive information via unspecified vectors.


Graphiks MyForum 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the (1) myforum_login and (2) myforum_pass cookies to 1.


Nodstrum MySQL Calendar 1.1 and 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the nodstrumCalendarV2 cookie to 1. NOTE: some of these details are obtained from third party information.


Multiple unspecified vulnerabilities in the Backup Exec remote-agent logon process in Symantec Backup Exec for Windows Servers 11.0 (aka 11d) builds 6235 and 7170 12.0 build 1364 and 12.5 build 2213 allow remote attackers to bypass authentication and read or delete files via unknown vectors.


admin.php in CCleague Pro 1.2 allows remote attackers to bypass authentication by setting the type cookie value to admin.


Yerba SACphp 6.3 and earlier allows remote attackers to bypass authentication and gain administrative access via a galletasesion cookie that has a value beginning with 1:1: followed by a username.


V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1.


admin/auth.php in Gobbl CMS 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to \ok\.


PHP iCalendar 2.24 and earlier allows remote attackers to bypass authentication by setting the phpicalendar and phpicalendar_login cookies to 1.


Ipswitch WS_FTP Server Manager before 6.1.1 and possibly other Ipswitch products allows remote attackers to bypass authentication and read logs via a logLogout action to FTPLogServer/login.asp followed by a request to FTPLogServer/LogViewer.asp with the localhostnull account name.


BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the login_auth cookie to true.


Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote attackers to bypass authentication and perform administrative actions via vectors involving \simply skipping the auth stage.\


Gallery 1.5.x before 1.5.10 and 1.6 before 1.6-RC3 when register_globals is enabled allows remote attackers to bypass authentication and gain administrative via unspecified cookies. NOTE: some of these details are obtained from third party information.


Zeeways PhotoVideoTube 1.1 and earlier allows remote attackers to bypass authentication and perform administrative tasks via a direct request to admin/home.php.


PHP infoBoard V.7 Plus allows remote attackers to bypass authentication and gain administrative access by setting the infouser cookie to 1.


Atomic Photo Album 1.1.0 pre4 does not properly handle the apa_cookie_login and apa_cookie_password cookies which probably allows remote attackers to bypass authentication and gain administrative access via modified cookies.


BbZL.PhP 0.92 allows remote attackers to bypass authentication and gain administrative access by setting the phorum_admin_session cookie to 1.


PHP Jabbers Post Comment 3.0 allows remote attackers to bypass authentication and gain administrative access by setting the PostCommentsAdmin cookie to \logged.\


fileadmin.php in Libra File Manager (aka Libra PHP File Manager) 1.18 and earlier allows remote attackers to bypass authentication and read arbitrary files modify arbitrary files and list arbitrary directories by inserting certain user and isadmin parameters in the query string.


Rianxosencabos CMS 0.9 allows remote attackers to bypass authentication and gain administrative access by setting the usuario and pass cookies to 1.


Podcast Producer in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to bypass authentication and gain administrative access via unspecified vectors.


Blue Coat K9 Web Protection 4.0.230 Beta relies on client-side JavaScript as a protection mechanism which allows remote attackers to bypass authentication and access the (1) summary (2) detail (3) overrides and (4) pwemail pages by disabling JavaScript.


The isLoggedIn function in fastnews-code.php in phpFastNews 1.0.0 allows remote attackers to bypass authentication and gain administrative access by setting the fn-loggedin cookie to 1.


add.php in MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication and gain administrative access by setting a cookie with admin=yes and login=admin.


configure.php in PokerMax Poker League Tournament Script 0.13 allows remote attackers to bypass authentication and gain administrative access by setting the ValidUserAdmin cookie.


board/admin/reguser.php in Chipmunk CMS 1.3 allows remote attackers to bypass authentication and gain administrator privileges via a direct request. NOTE: some of these details are obtained from third party information.


Zeeways SHAADICLONE 2.0 allows remote attackers to bypass authentication and gain administrative privileges via a direct request to admin/home.php.


Joovili 3.1.4 allows remote attackers to bypass authentication and gain privileges as other users including the administrator by setting the (1) session_id session_logged_in and session_username cookies for user privileges; (2) session_admin_id session_admin_username and session_admin cookies for admin privileges; and (3) session_staff_id session_staff_username and session_staff cookies for staff users.


action.php in SH-News 3.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the shuser and shpass cookies to non-zero values.


Siemens SpeedStream 5200 with NetPort Software 1.1 allows remote attackers to bypass authentication via an invalid Host header possibly involving a trailing dot in the hostname.


** DISPUTED ** Tribiq CMS 5.0.9a beta allows remote attackers to bypass authentication and gain administrative access by setting the COOKIE_LAST_ADMIN_USER and COOKIE_LAST_ADMIN_LANG cookies. NOTE: a third party reports that the vendor disputes the existence of this issue.


admin.php in xeCMS 1.0.0 RC2 and earlier allows remote attackers to bypass authentication and access the admin panel by setting the xecms_username cookie.


Pre Shopping Mall allows remote attackers to bypass authentication and gain administrative access by setting the (1) adminname and the (2) adminid cookies to \admin\.


Absolute Podcast .NET 1.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.


RSMScript 1.21 allows remote attackers to bypass authentication and gain administrative privileges by setting the verified cookie to an arbitrary value and performing a direct request to (1) delete.php (2) edit-submit.php (3) edit.php (4) submit.php and (5) update.php which bypasses the security check that is performed by verify.php.


admin/Index.php in Acc Statistics 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the username_cookie cookie to \admin.\


Absolute Content Rotator 6.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.


Acc PHP eMail 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the NEWSLETTERLOGIN cookie to \admin\.


Xigla Software Absolute News Manager.NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.


AJ

Square

AJ

Auction

OOPD

Pro

Platinum

Skin

Pro

Platinum

Skin

and

Web

send

a

redirect

but

do

not

exit

when

certain

scripts

are

called

directly

which

allows

remote

attackers

to

bypass

authentication

via

a

direct

request

to

site.php

auction.php

mail.php

earnings.php

subcategory.php

category.php

report.php

and

in

admin/

and

possibly

other

vectors.


Galatolo WebManager 1.3a allows remote attackers to bypass authentication and gain administrative access by setting the (1) gwm_user and (2) gwm_pass cookies to admin. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Xigla Software Absolute Form Processor .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.


login2.php in Silentum LoginSys 1.0.0 allows remote attackers to bypass authentication and obtain access to an arbitrary account by setting the logged_in cookie to that account's username.


Bux.to Clone script allows remote attackers to bypass authentication and gain administrative access by setting the loggedin cookie to 1 and the usNick cookie to admin.


Plesk 8.6.0 when short mail login names (SHORTNAMES) are enabled allows remote attackers to bypass authentication and send spam e-mail via a message with (1) a base64-encoded username that begins with a valid shortname or (2) a username that matches a valid password as demonstrated using (a) SMTP and qmail and (b) Courier IMAP and POP3.


win/content/upload.php in Goople CMS 1.7 allows remote attackers to bypass authentication and gain administrative access by setting the loggedin cookie to 1.


profileedit.php TaskDriver 1.3 and earlier allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to \fook!admin.\


admin.php in TurnkeyForms Text Link Sales allows remote attackers to bypass authentication and gain administrative privileges via a direct request.


Xigla Software Absolute FAQ Manager.NET 6.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.


admin/Index.php in Acc Real Estate 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the username_cookie to \admin.\


Pre Classified Listing PHP allows remote attackers to bypass authentication and gain administrative access by setting the (1) adminname and the (2) adminid cookies to \admin\.


TurnkeyForms Local Classifieds allows remote attackers to bypass authentication and gain administrative access via a direct request to Site_Admin/admin.php.


Xigla Software Absolute Newsletter 6.0 and 6.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.


Explay CMS 2.1 and earlier allows remote attackers to bypass authentication and gain administrative access by setting the login cookie to 1.


Absolute Banner Manager .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.


A+ PHP Scripts News Management System (NMS) allows remote attackers to bypass authentication and gain administrator privileges by setting the mobsuser and mobspass cookies to 1.


TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and (1) gain administrative privileges by setting the adm cookie to 1 or (2) gain privileges as another user by setting the logged cookie to the target username.


phpscripts Ranking Script allows remote attackers to bypass authentication and gain administrative access by sending an admin=ja cookie.


index.php in ADN Forum 1.0b and earlier allows remote attackers to bypass authentication and gain sysop access via a fpusuario cookie composed of an initial sysop: string an arbitrary password field and a final :sysop:0 string.


Xigla Software Absolute Control Panel XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.


auth.php in openInvoice 0.90 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the oiauth cookie. NOTE: this can be leveraged with a separate vulnerability in resetpass.php to modify passwords for arbitrary users.


login.php in PhpAddEdit 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the addedit cookie parameter.


Pre Multi-Vendor Shopping Malls allows remote attackers to bypass authentication and gain administrative access by setting the (1) adminname and the (2) adminid cookies to \admin\.


E-topbiz Link Back Checker 1 allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to \admin.\


Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.


Acc Autos 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) username_cookie to \admin \ (2) right_cookie to \1 \ and (3) id_cookie to \1.\


Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a certain cookie.


AJ Square AJ Auction Pro Platinum Skin #1 sends a redirect but does not exit when it is called directly which allows remote attackers to bypass authentication via a direct request to admin/user.php.


admin.php in Maran PHP Shop allows remote attackers to bypass authentication and gain administrative access by setting the user cookie to \demo.\


TurnkeyForms Entertainment Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the adminLogged cookie to Administrator.


Xigla Software Absolute Poll Manager XE 4.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.


The web interface to the Belkin Wireless G router and ADSL2 modem F5D7632-4V6 with firmware 6.01.08 allows remote attackers to bypass authentication and gain administrator privileges via a direct request to (1) statusprocess.exe (2) system_all.exe or (3) restore.exe in cgi-bin/. NOTE: the setup_dns.exe vector is already covered by CVE-2008-1244.


The Manager in Eye-Fi 1.1.2 generates predictable snonce values based on the time of day which allows remote attackers to bypass authentication and upload arbitrary images by guessing the snonce.


The password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1 when using PHPBB3 authentication (1) does not invoke the CheckPassword function with the required arguments which always triggers an authentication failure and (2) returns true instead of false when an authentication failure occurs which allows remote attackers to bypass authentication and gain privileges with an arbitrary password.


Free PHP VX Guestbook 1.06 allows remote attackers to bypass authentication and gain administrative access by setting the (1) admin_name and (2) admin_pass cookie values to 1.


AJ

Square

AJ

Article

allows

remote

attackers

to

bypass

authentication

and

access

administrator

functionality

via

a

direct

request

to

user.php

articles.php

articlesuspend.php

site.php

statistics.php

mail.php

category.php

subcategory.php

changepassword.php

polling.php

and

logo.php

in

admin/.


Unspecified vulnerability in DotNetNuke 4.4.1 through 4.8.4 allows remote authenticated users to bypass authentication and gain privileges via unknown vectors related to a \unique id\ for user actions and improper validation of a \user identity.\


Free PHP VX Guestbook 1.06 allows remote attackers to bypass authentication and download a backup of the database via a direct request to admin/backupdb.php.


AJ Classifieds allows remote attackers to bypass authentication and gain administrator privileges via a direct request to admin/home.php.


userHandler.cgi in RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1 allows remote attackers to bypass authentication and gain administrator privileges by setting the login parameter to admin. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Aruba Mobility Controller running ArubaOS 3.3.1.16 and possibly other versions installs the same default X.509 certificate for all installations which allows remote attackers to bypass authentication. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.


AJ Square Free Polling Script (AJPoll) Database version allows remote attackers to bypass authentication and reset poll votes via a direct request to admin/resetvote.php.


Libra File Manager 1.18 and earlier allows remote attackers to bypass authentication and gain privileges by setting the user and pass cookies to 1.


OpenForum 0.66 Beta allows remote attackers to bypass authentication and reset passwords of other users via a direct request with the update parameter set to 1 and modified user and password parameters.


HyperStop Web Host Directory 1.2 allows remote attackers to bypass authentication and download a database backup via a direct request to admin/backup/db.


AJ Square Free Polling Script (AJPoll) allows remote attackers to bypass authentication and create new polls via a direct request to admin/include/newpoll.php a different vector than CVE-2008-7045. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain administrator privileges by setting the user cookie to \admin\ and setting the name parameter to \users.\


Maian Greetings 2.1 allows remote attackers to bypass authentication and gain administrative privileges by setting the mecard_admin_cookie cookie to admin.


Esqlanelapse 2.6.1 and 2.6.2 allows remote attackers to bypass authentication and gain privileges via modified (1) enombre and (2) euri cookies.


RPG.Board 0.8 Beta2 and earlier allows remote attackers to bypass authentication and gain privileges by setting the keep4u cookie to a certain value.


OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMIN_Hora ADMIN_Logado and ADMIN_Nome cookies to certain values as reachable in Admin/index.php.


JnSHosts PHP Hosting Directory 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the \adm\ cookie value to 1.


AlphAdmin CMS 1.0.5/03 allows remote attackers to bypass authentication and gain administrative access by setting the aa_login cookie value to 1. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to bypass authentication and obtain administrative access via a direct request with (1) an IsAdmin=true cookie value or (2) no cookie.


admin/wr_admin.php in PHP-Ring Webring System (aka uPHP_ring_website) 0.9.1 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1.


Unspecified vulnerability in Cisco Unity 4.x before 4.2(1)ES161 5.x before 5.0(1)ES53 and 7.x before 7.0(2)ES8 when using anonymous authentication (aka native Unity authentication) allows remote attackers to bypass authentication and read or modify system configuration parameters by going to a specific link more than once.


IBM WebSphere Portal 5.1 through 6.1.0.0 allows remote attackers to bypass authentication and obtain administrative access via unspecified vectors.


Free Hosting Manager 1.2 and 2.0 allows remote attackers to bypass authentication and gain administrative access by setting both the adminuser and loggedin cookies.


Scripteen Free Image Hosting Script 1.2 and 1.2.1 allows remote attackers to bypass authentication and gain administrative access by setting the cookid cookie value to 1.


The jrCookie function in includes/jamroom-misc.inc.php in JamRoom before 3.4.0 allows remote attackers to bypass authentication and gain administrative access via a boolean value within serialized data in a JMU_Cookie cookie.


Microsoft Host Integration Server (HIS) 2000 2004 and 2006 does not limit RPC access to administrative functions which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function aka \HIS Command Execution Vulnerability.\


constants.inc in EZWebAlbum 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the photoalbumadmin cookie as demonstrated via addpage.php.


Login Window in Apple Mac OS X 10.4.11 does not clear the current password when a user makes a password-change attempt that is denied by policy which allows opportunistic physically proximate attackers to bypass authentication and change this user's password by later entering an acceptable new password on the same login screen.


admin.php in Internet Photoshow and Internet Photoshow Special Edition (SE) allows remote attackers to bypass authentication by setting the login_admin cookie to true.


The Real-Time Information Server (RIS) Data Collector service in Cisco Unified Communications Manager (CUCM) before 4.2(3)SR4 and 4.3 before 4.3(2)SR1 allows remote attackers to bypass authentication and obtain cluster configuration information and statistics via a direct TCP connection to the service port aka Bug ID CSCsq35151.


_RealmAdmin/login.asp in Realm CMS 2.3 and earlier allows remote attackers to bypass authentication and access admin pages via certain modified cookies probably including (1) cUserRole (2) cUserName and (3) cUserID.


admin.php in Multi-Page Comment System (MPCS) 1.0 and 1.1 allows remote attackers to bypass authentication and gain privileges by setting the CommentSystemAdmin cookie to 1.


The admin.php file in Rantx allows remote attackers to bypass authentication and gain privileges by setting the logininfo cookie to \<?php\ or \?>\ which is present in the password file and probably passes an insufficient comparison.


The Real-Time Information Server (RIS) Data Collector service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3) and 6.x before 6.1(1) allows remote attackers to bypass authentication and obtain cluster configuration information and statistics via a direct TCP connection to the service port aka Bug ID CSCsj90843.


The administration application server in Sun Java Active Server Pages (ASP) Server before 4.0.3 allows remote attackers to bypass authentication via direct requests on TCP port 5102.


Admin.php in Web Slider 0.6 allows remote attackers to bypass authentication and gain privileges by setting the admin cookie to 1.


AustinSmoke GasTracker (AS-GasTracker) 1.0.0 allows remote attackers to bypass authentication and gain privileges by setting the gastracker_admin cookie to TRUE.


Unspecified vulnerability in cron.php in FreeSeat before 1.1.5d when format.php has certain modifications allows remote attackers to bypass authentication and gain privileges via unspecified vectors related to the show_foot function.


Unspecified vulnerability in the LDAP authentication feature in Aruba Mobility Controller 2.3.6.15 2.5.2.11 2.5.4.25 2.5.5.7 3.1.1.3 and 2.4.8.11-FIPS or earlier allows remote attackers to bypass authentication mechanisms and obtain management or VPN interface access.


The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '=' characters in a Distinguished Name (DN) in a client certificate which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables.


Plugin/passwordauth.pm (aka the passwordauth plugin) in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication and login to any account for which an OpenID identity is configured and a password is not configured by specifying an empty password during the login sequence.


EMV DiskXtender 6.20.060 has a hard-coded login and password which allows remote attackers to bypass authentication via the RPC interface.


The control panel on the Belkin F5D7230-4 router with firmware 9.01.10 maintains authentication state by IP address which allows remote attackers to bypass authentication by establishing a session from a source IP address of a previously authenticated user a different vulnerability than CVE-2005-3802.


The ZyXEL P-660HW series router maintains authentication state by IP address which allows remote attackers to bypass authentication by establishing a session from a source IP address of a previously authenticated user.


The Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware maintains authentication state by IP address which allows remote attackers to bypass authentication by establishing a session from a source IP address of a user who previously authenticated within the previous 5 minutes.


Unspecified vulnerability in xscreensaver in Sun Solaris 10 Java Desktop System (JDS) when using the GNOME On-Screen Keyboard (GOK) allows local users to bypass authentication via unknown vectors that cause the screen saver to crash.


cgi/b on the BT Home Hub router allows remote attackers to bypass authentication and read or modify administrative settings or make arbitrary VoIP telephone calls by placing a character at the end of the PATH_INFO as demonstrated by (1) %5C (encoded backslash) (2) '%' (percent) and (3) '~' (tilde). NOTE: the '/' (slash) vector is already covered by CVE-2007-5383.


Cumin in Red Hat Enterprise Messaging Realtime and Grid (MRG) 2.0 records broker authentication credentials in a log file which allows local users to bypass authentication and perform unauthorized actions on jobs and message queues via a direct connection to the broker.


Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field without disabling the autocomplete feature which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation.


The ocsp_check function in rlm_eap_tls.c in FreeRADIUS 2.1.11 when OCSP is enabled does not properly parse replies from OCSP responders which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate.


The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl as used by CGI::Fast uses environment variable values from one request during processing of a later request which allows remote attackers to bypass authentication via crafted HTTP headers.


The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) allows remote attackers to bypass authentication via unspecified data associated with a \true\ authentication status related to AMF data and the LSRoom_Remoting.authenticate function in gateway.php.


imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an AUTHINFO USER command without sending an additional AUTHINFO PASS command.


The administration functionality in Wuzly 2.0 allows remote attackers to bypass authentication by setting the dXNlcm5hbWU cookie.


Cisco

Adaptive

Security

Appliances

(ASA)

series

devices

and

the

ASA

Services

module

in

Cisco

Catalyst

series

devices

with

software

before

and

before

before

before

before

before

before

and

before

and

Cisco

Firewall

Services

Module

(aka

FWSM)

before

before

before

and

before

allow

remote

attackers

to

bypass

authentication

via

a

crafted

TACACS+

reply

aka

Bug

IDs

and


Opengear console servers with firmware before 2.2.1 allow remote attackers to bypass authentication and modify settings or access connected equipment via unspecified vectors.


Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20 6.0.0 through 6.0.33 5.5.0 through 5.5.33 and possibly other versions allow remote attackers to spoof AJP requests bypass authentication and obtain sensitive information by causing the connector to interpret a request body as a new request.


The crypt function in PHP 5.3.7 when the MD5 hash type is used returns the value of the salt argument instead of the hashed string which might allow remote attackers to bypass authentication via an arbitrary password a different vulnerability than CVE-2011-2483.


includes/User.php in MediaWiki before 1.16.5 when wgBlockDisablesLogin is enabled does not clear certain cached data after verification of an auth token fails which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies or by leveraging an unattended workstation.


The NetGear ProSafe WNAP210 with firmware 2.0.12 allows remote attackers to bypass authentication and obtain access to the configuration page by visiting recreate.php and then visiting index.php.


Ecava IntegraXor HMI before n 3.60 (Build 4032) allows remote attackers to bypass authentication and execute arbitrary SQL statements via unspecified vectors related to a crafted POST request. NOTE: some sources have reported this issue as SQL injection but this might not be accurate.


The Web User Interface on the IBM TS3100 and TS3200 tape libraries with firmware before A.60 allows remote attackers to bypass authentication and obtain administrative access via unspecified vectors.


The LDAP login feature in bos.rte.security 6.1.6.4 in IBM AIX 6.1 when ldap_auth is enabled in ldap.cfg allows remote attackers to bypass authentication via a login attempt with an arbitrary password.


The mail-filter web interface in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3 5.5.4 5.5.5 6.0.2 6.1.1 and 6.2.0 allows remote attackers to bypass authentication via unspecified vectors.


Frams's Fast File EXchange (F*EX aka fex) 20100208 and possibly other versions before 20110610 allows remote attackers to bypass authentication and upload arbitrary files via a request that lacks an authentication ID.


Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1 and IdP before 2.3.2 allows remote attackers to forge messages and bypass authentication via an \XML Signature wrapping attack.\


solid.exe in IBM solidDB before 4.5.181 6.0.x before 6.0.1067 6.1.x and 6.3.x before 6.3.47 and 6.5.x before 6.5.0.3 uses a password-hash length specified by the client which allows remote attackers to bypass authentication via a short length value.


nslcd/pam.c in the nss-pam-ldapd 0.8.0 PAM module returns a success code when a user is not found in LDAP which allows remote attackers to bypass authentication.


Cisco TelePresence Manager 1.2.x through 1.6.x allows remote attackers to bypass authentication and invoke arbitrary methods via a malformed SOAP request aka Bug ID CSCtc59562.


The PKI functionality in Cisco IOS 15.0 and 15.1 does not prevent permanent caching of certain public keys which allows remote attackers to bypass authentication and have unspecified other impact by leveraging an IKE peer relationship in which a key was previously valid but later revoked aka Bug ID CSCth82164 a different vulnerability than CVE-2010-4685.


qemu-kvm before 0.11.0 disables VNC authentication when the password is cleared which allows remote attackers to bypass authentication and establish VNC sessions.


The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 generates a password form field without disabling the autocomplete feature which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation as demonstrated by forms in admin/reseller/login-info/ and certain other files.


The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2 SOA Platform before 5.2.0 BRMS Platform before 5.3.0 and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods which allow remote attackers to bypass authentication by sending a request with a different method. NOTE: this vulnerability exists because of a CVE-2010-0738 regression.


The check_password function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password.


The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates a password form field without disabling the autocomplete feature which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation as demonstrated by forms in smb/my-profile and certain other files.


html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted username.


The HMI web server in Siemens WinCC flexible 2004 2005 2007 and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP OP MP Comfort Panels and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime generates predictable authentication tokens for cookies which makes it easier for remote attackers to bypass authentication via a crafted cookie.


Parallels Plesk Small Business Panel 10.2.0 generates a password form field without disabling the autocomplete feature which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation as demonstrated by forms in smb/auth and certain other files.


The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates a password form field without disabling the autocomplete feature which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation as demonstrated by forms in server/google-tools/ and certain other files.


The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 generates a password form field without disabling the autocomplete feature which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation as demonstrated by forms on certain pages under admin/index.php/default.


OneOrZero Action & Information Management System (AIMS) 2.7.0 allows remote attackers to bypass authentication and obtain administrator privileges via a crafted oozimsrememberme cookie.


TYPO3 before 4.3.12 4.4.x before 4.4.9 and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request.


The D-Link DIR-685 router when certain WPA and WPA2 configurations are used does not maintain an encrypted wireless network during transfer of a large amount of network traffic which allows remote attackers to obtain sensitive information or bypass authentication via a Wi-Fi device.


In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836 remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username.


The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces which allows remote attackers to bypass authentication and gain administrative access via direct requests.


The default installation of Trend Micro OfficeScan 3.0 through 3.54 and 5.x allows remote attackers to bypass authentication from cgiChkMasterPasswd.exe and gain access to the web management console via a direct request to cgiMasterPwd.exe.


A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0


Admin Framework in Apple OS X before 10.10.4 does not properly verify XPC entitlements which allows local users to bypass authentication and obtain admin privileges via unspecified vectors.


IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32 3.5 before 3.5.0.24 and 4.1 before 4.1.0.7 in certain cipherList configurations allows remote attackers to bypass authentication and execute arbitrary programs as root via unspecified vectors.


admin/index.php in Advanced Poll 2.0.0 through 2.0.5-dev allows remote attackers to bypass authentication and gain administrator privileges by obtaining a valid session identifier and setting the uid parameter to 1.


admin/index.php in IPrimal Forums as of 20061105 allows remote attackers to bypass authentication and modify user passwords via a direct request possibly related to an authentication issue in admin/chk_admin.php.