IBM Rational Requirements Composer before 4.0.4 does not properly perform authentication, which has unspecified impact and remote attack vectors.

CVE-2013-3046NONECVSS 0.0EG 0.0

2014-05-26

The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not send the HSTS Strict-Transport-Security header, which makes it easier for man-in-the-middle attackers to hijack sessions or obtain sensitive informatio…

CVE-2013-3071CRITICALCVSS 9.8EG 9.8

2020-01-28

NETGEAR Centria WNDR4700 devices with firmware 1.0.0.34 allow authentication bypass.

CVE-2013-3072CRITICALCVSS 9.8EG 9.8

2019-11-14

An Authentication Bypass vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34 in http://<router_ip>/apply.cgi?/hdd_usr_setup.htm that when visited by any user, authenticated or not, causes the router to no longer require a pa…

CVE-2013-3085CRITICALCVSS 9.8EG 9.8

2019-12-26

An authentication bypass exists in the web management interface in Belkin F5D8236-4 v2.

CVE-2013-3088CRITICALCVSS 9.8EG 9.8

2019-12-26

Belkin N900 router (F9K1104v1) contains an Authentication Bypass using "Javascript debugging".

CVE-2013-3091CRITICALCVSS 9.8EG 9.8

2020-02-07

An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication using "Javascript debugging."

CVE-2013-3092NONECVSS 0.0EG 0.0

2014-09-29

The Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication and gain privileges via vectors related to incorrect validation of the HTTP Authorization header.

CVE-2013-3096MEDIUMCVSS 5.9EG 5.9

2020-02-07

D-Link DIR865L v1.03 suffers from an "Unauthenticated Hardware Linking" vulnerability.

CVE-2013-3215CRITICALCVSS 9.8EG 9.8

2020-01-29

vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function.

CVE-2013-3268NONECVSS 0.0EG 0.0

2013-04-24

Novell iManager 2.7 before SP6 Patch 1 does not refresh a token after a logout action, which has unspecified impact and remote attack vectors.

CVE-2013-3316CRITICALCVSS 9.8EG 9.8

2020-01-29

Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass due to the server skipping checks for URLs containing a ".jpg".

CVE-2013-3317CRITICALCVSS 9.8EG 9.8

2020-01-29

Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass via the NtgrBak key.

CVE-2013-3367CRITICALCVSS 9.8EG 9.8

2019-11-13

Undocumented TELNET service in TRENDnet TEW-691GR and TEW-692GR when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg_24Mhw3.

CVE-2013-3417NONECVSS 0.0EG 0.0

2013-09-30

The administrative web interface in Cisco Video Surveillance Operations Manager does not properly perform authentication, which allows remote attackers to watch video feeds via a crafted URL, aka Bug ID CSCtg72262.

CVE-2013-3430NONECVSS 0.0EG 0.0

2013-07-25

Cisco Video Surveillance Manager (VSM) before 7.0.0 allows remote attackers to obtain sensitive configuration, archive, and log information via unspecified vectors, related to the Cisco_VSBWT (aka Broadware sample code) package, aka Bug ID…

CVE-2013-3431NONECVSS 0.0EG 0.0

2013-07-25

Cisco Video Surveillance Manager (VSM) before 7.0.0 does not require authentication for access to VSMC monitoring pages, which allows remote attackers to obtain sensitive configuration, archive, and log information via unspecified vectors,…

CVE-2013-3466NONECVSS 0.0EG 0.0

2013-08-29

The EAP-FAST authentication module in Cisco Secure Access Control Server (ACS) 4.x before 4.2.1.15.11, when a RADIUS server configuration is enabled, does not properly parse user identities, which allows remote attackers to execute arbitra…

CVE-2013-3473NONECVSS 0.0EG 0.0

2013-09-20

The web framework in Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance before 9.1.1 does not properly determine the existence of an authenticated session, which allows remote attackers to discover usernames and password…

CVE-2013-3581NONECVSS 0.0EG 0.0

2013-07-02

ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to obtain sensitive information via an Ajax (1) wmxState or (2) netState request.

CVE-2013-3586NONECVSS 0.0EG 0.0

2013-08-28

Samsung Web Viewer for Samsung DVR devices allows remote attackers to bypass authentication via an arbitrary SessionID value in a cookie.

CVE-2013-3610NONECVSS 0.0EG 0.0

2013-10-05

qis/QIS_finish.htm on the ASUS RT-N10E router with firmware before 2.0.0.25 does not require authentication, which allows remote attackers to discover the administrator password via a direct request.

CVE-2013-3613NONECVSS 0.0EG 0.0

2013-09-17

Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack against the TELNET port.

CVE-2013-3656NONECVSS 0.0EG 0.0

2013-07-20

Cybozu Office 9.1.0 and earlier does not properly manage sessions, which allows remote attackers to bypass authentication by leveraging knowledge of a login URL.

CVE-2013-3659NONECVSS 0.0EG 0.0

2013-08-09

The NTT DOCOMO overseas usage application 2.0.0 through 2.0.4 for Android does not properly connect to Wi-Fi access points, which allows remote attackers to obtain sensitive information by leveraging presence in an 802.11 network's coverag…

CVE-2013-3977NONECVSS 0.0EG 0.0

2014-05-26

The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to determine which meeting rooms are owned by a user by leveraging knowledge of valid user names.

CVE-2013-4001NONECVSS 0.0EG 0.0

2013-12-14

Session fixation vulnerability in IBM Cognos Command Center before 10.2 allows remote attackers to hijack web sessions via an authorization cookie.

CVE-2013-4061NONECVSS 0.0EG 0.0

2013-09-09

IBM Rational Policy Tester 8.5 before 8.5.0.5 does not properly check authorization for changes to the set of authentication hosts, which allows remote authenticated users to perform spoofing attacks involving an HTTP redirect via unspecif…

CVE-2013-4178NONECVSS 0.0EG 0.0

2014-05-29

The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to obtain access by replaying the username, password, and one-time password (OTP).

CVE-2013-4304NONECVSS 0.0EG 0.0

2014-01-26

The CentralAuth extension for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 caches a valid CentralAuthUser object in the centralauth_User cookie even when a user has not successfully logged in, which allows…

CVE-2013-4454CRITICALCVSS 9.1EG 9.1

2020-02-18

WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities

CVE-2013-4462CRITICALCVSS 9.1EG 9.1

2020-01-27

WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability

CVE-2013-4471NONECVSS 0.0EG 0.0

2014-05-14

The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the auth…

CVE-2013-4552NONECVSS 0.0EG 0.0

2014-05-13

lib/Auth/Source/External.php in the drupalauth module before 1.2.2 for simpleSAMLphp allows remote attackers to authenticate as an arbitrary user via the user name (uid) in a cookie.

CVE-2013-4580NONECVSS 0.0EG 0.0

2014-05-12

GitLab before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1, when using a MySQL backend, allows remote attackers to impersonate arbitrary users and bypass authentication via unspecified API calls.

CVE-2013-4593HIGHCVSS 7.5EG 7.5

2019-12-11

RubyGem omniauth-facebook has an access token security vulnerability

CVE-2013-4594NONECVSS 0.0EG 0.0

2014-10-25

The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment.

CVE-2013-4621CRITICALCVSS 9.8EG 9.8

2019-12-27

Magnolia CMS before 4.5.9 has multiple access bypass vulnerabilities

CVE-2013-4731NONECVSS 0.0EG 0.0

2013-06-30

ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to execute arbitrary commands via shell metacharacters in the pip parameter in an Ajax tag_ipPing request, a different vuln…

CVE-2013-4772NONECVSS 0.0EG 0.0

2014-05-12

D-Link DIR-505L SharePort Mobile Companion 1.01 and DIR-826L Wireless N600 Cloud Router 1.02 allows remote attackers to bypass authentication via a direct request when an authorized session is active.

CVE-2013-4782NONECVSS 0.0EG 0.0

2013-07-08

The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.

CVE-2013-4783NONECVSS 0.0EG 0.0

2013-07-08

The Dell iDRAC6 with firmware 1.x before 1.92 and 2.x and 3.x before 3.42, and iDRAC7 with firmware before 1.23.23, allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher ze…

CVE-2013-4784NONECVSS 0.0EG 0.0

2013-07-08

The HP Integrated Lights-Out (iLO) BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.

CVE-2013-4793NONECVSS 0.0EG 0.0

2014-12-27

The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a cra…

CVE-2013-4824NONECVSS 0.0EG 0.0

2013-10-13

Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote attackers to bypass authentication via unknown vectors, aka ZDI-CAN-1644.

CVE-2013-4863HIGHCVSS 8.8EG 8.8

2020-01-28

The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute arbitrary Lua code via a RunLua action in a request to upnp/control/hag on port 49451 or (2) remote authenticated users …

CVE-2013-4874NONECVSS 0.0EG 0.0

2013-07-18

The Uboot bootloader on the Verizon Wireless Network Extender SCS-26UC4 allows physically proximate attackers to obtain root access by connecting a crafted HDMI cable and using a sys session to modify the ramboot environment variable.

CVE-2013-4875NONECVSS 0.0EG 0.0

2013-07-18

The Uboot bootloader on the Verizon Wireless Network Extender SCS-2U01 allows physically proximate attackers to bypass the intended boot process and obtain a login prompt by connecting a crafted HDMI cable and sending a SysReq interrupt.

CVE-2013-4877NONECVSS 0.0EG 0.0

2013-07-18

The Verizon Wireless Network Extender SCS-26UC4 and SCS-2U01 does not use CAVE authentication, which makes it easier for remote attackers to obtain ESN and MIN values from arbitrary phones, and conduct cloning attacks, by sniffing the netw…

CVE-2013-4958NONECVSS 0.0EG 0.0

2013-08-20

Puppet Enterprise before 3.0.1 does not use a session timeout, which makes it easier for attackers to gain privileges by leveraging an unattended workstation.

CWE-287— Improper Authentication

CVEs classified under CWE-287page 16 of 87

Map vulnerabilities like CWE-287 to your infrastructure