CWE-287— Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.— MITRE CWE catalog
4,924 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-287page 5 of 99
- CVE-2008-3503MEDIUMCVSS v2 5.0EG 5.02008-08-06
RSSFromParent in Plain Black WebGUI before 7.5.13 does not restrict view access to Collaboration System (CS) RSS feeds, which allows remote attackers to obtain sensitive information (CS data).
- CVE-2008-3504HIGHCVSS v2 7.5EG 7.52008-08-06
Unspecified vulnerability in mask PHP File Manager (mPFM) before 2.3 has unknown impact and remote attack vectors related to "manipulation of cookies."
- CVE-2008-3579HIGHCVSS v2 7.8EG 7.82008-08-10
Calacode @Mail 5.41 on Linux does not require administrative authentication for build-plesk-upgrade.php, which allows remote attackers to obtain sensitive information by creating and downloading a backup archive of the entire @Mail directo…
- CVE-2008-3610HIGHCVSS v2 7.6EG 7.62008-09-16
Race condition in Login Window in Apple Mac OS X 10.5 through 10.5.4, when a blank-password account is enabled, allows attackers to bypass password authentication and login to any account via multiple attempts to login to the blank-passwor…
- CVE-2008-3611MEDIUMCVSS v2 6.3EG 6.32008-09-16
Login Window in Apple Mac OS X 10.4.11 does not clear the current password when a user makes a password-change attempt that is denied by policy, which allows opportunistic, physically proximate attackers to bypass authentication and change…
- CVE-2008-3703HIGHCVSS v2 10.0EG 10.02008-08-18
The management console in the Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation for Windows (SFW) 5.0, 5.0 RP1a, and 5.1 accepts NULL NTLMSSP authentication, which allows remote attackers to e…
- CVE-2008-3729HIGHCVSS v2 7.5EG 7.52008-08-20
Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to bypass authentication and obtain administrative access via a direct request with (1) an IsAdmin=true cookie value or (2) no cookie.
- CVE-2008-3738CRITICALCVSS 9.1EG 9.12008-08-27
Session fixation vulnerability in SpaceTag LacoodaST 2.1.3 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
- CVE-2008-3814MEDIUMCVSS v2 5.8EG 5.82008-10-08
Unspecified vulnerability in Cisco Unity 4.x before 4.2(1)ES161, 5.x before 5.0(1)ES53, and 7.x before 7.0(2)ES8, when using anonymous authentication (aka native Unity authentication), allows remote attackers to bypass authentication and r…
- CVE-2008-3815MEDIUMCVSS v2 4.3EG 4.32008-10-23
Unspecified vulnerability in Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.0 before 7.0(8)3, 7.1 before 7.1(2)78, 7.2 before 7.2(4)16, 8.0 before 8.0(4)6, and 8.1 before 8.1(1)13, when configured as a V…
- CVE-2008-3866MEDIUMCVSS v2 4.6EG 4.62009-01-21
The Trend Micro Personal Firewall service (aka TmPfw.exe) in Trend Micro Network Security Component (NSC) modules, as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224, relies on client-side passw…
- CVE-2008-3891HIGHCVSS v2 7.5EG 7.52008-09-03
The SAML Single Sign-On (SSO) Service for Google Apps allows remote service providers to impersonate users at arbitrary service providers via vectors related to authentication responses that lack a request identifier and recipient field.
- CVE-2008-3905MEDIUMCVSS v2 5.8EG 5.82008-09-04
resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoo…
- CVE-2008-4032HIGHCVSS v2 7.5EG 7.52008-12-10
Microsoft Office SharePoint Server 2007 Gold and SP1 and Microsoft Search Server 2008 do not properly perform authentication and authorization for administrative functions, which allows remote attackers to cause a denial of service (server…
- CVE-2008-4037HIGHCVSS v2 9.3EG 9.32008-11-12
Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a clien…
- CVE-2008-4081HIGHCVSS v2 7.5EG 7.52008-09-15
admin/login.php in Stash 1.0.3 allows remote attackers to bypass authentication and gain administrative access by setting a bsm cookie.
- CVE-2008-4146MEDIUMCVSS v2 5.0EG 5.02008-09-24
Addalink 1.0 beta 4 and earlier allows remote attackers to (1) approve web-site additions via a modified approved field and (2) change the visit-counter value via a modified counter field.
- CVE-2008-4167MEDIUMCVSS v2 6.4EG 6.42008-09-22
useradmin.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 does not require administrative authentication, which allows remote attackers to (1) add or (2) remove an Administrator account.
- CVE-2008-4223HIGHCVSS v2 10.0EG 10.02008-12-17
Podcast Producer in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to bypass authentication and gain administrative access via unspecified vectors.
- CVE-2008-4244HIGHCVSS v2 7.5EG 7.52008-09-25
Rianxosencabos CMS 0.9 allows remote attackers to bypass authentication and gain administrative access by setting the usuario and pass cookies to 1.
- CVE-2008-4319MEDIUMCVSS v2 6.4EG 6.42008-09-29
fileadmin.php in Libra File Manager (aka Libra PHP File Manager) 1.18 and earlier allows remote attackers to bypass authentication, and read arbitrary files, modify arbitrary files, and list arbitrary directories, by inserting certain user…
- CVE-2008-4389HIGHCVSS v2 9.3EG 9.32010-06-17
Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not properly perform authentication, which allows remote Workspace Streaming servers and man-in-the-middle attackers to download arbitrary executable f…
- CVE-2008-4427HIGHCVSS v2 7.5EG 7.52008-10-03
changepassword.php in Phlatline's Personal Information Manager (pPIM) 1.0 and earlier does not require administrative authentication, which allows remote attackers to change arbitrary passwords.
- CVE-2008-4515HIGHCVSS v2 7.5EG 7.52008-10-09
Blue Coat K9 Web Protection 4.0.230 Beta relies on client-side JavaScript as a protection mechanism, which allows remote attackers to bypass authentication and access the (1) summary, (2) detail, (3) overrides, and (4) pwemail pages by dis…
- CVE-2008-4576HIGHCVSS v2 7.8EG 7.82008-10-15
sctp in Linux kernel before 2.6.25.18 allows remote attackers to cause a denial of service (OOPS) via an INIT-ACK that states the peer does not support AUTH, which causes the sctp_process_init function to clean up active transports and tri…
- CVE-2008-4614HIGHCVSS v2 7.5EG 7.52008-10-20
PortalApp 4.0 does not require authentication for (1) forums.asp and (2) content.asp, which allows remote attackers to create and delete forums, topics, and replies.
- CVE-2008-4622HIGHCVSS v2 7.5EG 7.52008-10-21
The isLoggedIn function in fastnews-code.php in phpFastNews 1.0.0 allows remote attackers to bypass authentication and gain administrative access by setting the fn-loggedin cookie to 1.
- CVE-2008-4649HIGHCVSS v2 7.5EG 7.52008-10-22
Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
- CVE-2008-4679MEDIUMCVSS v2 6.8EG 6.82008-10-22
The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when Certificate Store Collections is configured to use Certificate Revocation Lists (CRL), does not call the setR…
- CVE-2008-4689HIGHCVSS v2 7.5EG 7.52008-10-22
Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions.
- CVE-2008-4708HIGHCVSS v2 7.5EG 7.52008-10-23
BbZL.PhP 0.92 allows remote attackers to bypass authentication and gain administrative access by setting the phorum_admin_session cookie to 1.
- CVE-2008-4714HIGHCVSS v2 7.5EG 7.52008-10-23
Atomic Photo Album 1.1.0 pre4 does not properly handle the apa_cookie_login and apa_cookie_password cookies, which probably allows remote attackers to bypass authentication and gain administrative access via modified cookies.
- CVE-2008-4721HIGHCVSS v2 7.5EG 7.52008-10-23
PHP Jabbers Post Comment 3.0 allows remote attackers to bypass authentication and gain administrative access by setting the PostCommentsAdmin cookie to "logged."
- CVE-2008-4722HIGHCVSS v2 9.0EG 9.02008-10-23
Unspecified vulnerability in Sun Integrated Lights-Out Manager (ILOM) 2.0.1.5 through 2.0.4.26 allows remote authenticated users to (1) access the service processor (SP) and cause a denial of service (shutdown or reboot), or (2) access the…
- CVE-2008-4752HIGHCVSS v2 7.5EG 7.52008-10-27
TlNews 2.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlNews_login cookie to admin.
- CVE-2008-4783HIGHCVSS v2 7.5EG 7.52008-10-29
tlAds 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the tlAds_login cookie to "admin."
- CVE-2008-4784HIGHCVSS v2 7.5EG 7.52008-10-29
aflog 1.01 allows remote attackers to bypass authentication and gain administrative access by setting the aflog_auth_a cookie to "A" or "O" in (1) edit_delete.php, (2) edit_cat.php, (3) edit_lock.php, and (4) edit_form.php.
- CVE-2008-5022HIGHCVSS v2 7.5EG 7.52008-11-13
The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execu…
- CVE-2008-5040HIGHCVSS v2 7.5EG 7.52008-11-12
Graphiks MyForum 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the (1) myforum_login and (2) myforum_pass cookies to 1.
- CVE-2008-5042HIGHCVSS v2 7.5EG 7.52008-11-12
Zeeways PhotoVideoTube 1.1 and earlier allows remote attackers to bypass authentication and perform administrative tasks via a direct request to admin/home.php.
- CVE-2008-5065HIGHCVSS v2 7.5EG 7.52008-11-13
TlGuestBook 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlGuestBook_login cookie to admin.
- CVE-2008-5082MEDIUMCVSS v2 6.0EG 6.02009-01-30
The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, wh…
- CVE-2008-5124HIGHCVSS v2 7.5EG 7.52008-11-18
JSCAPE Secure FTP Applet 4.8.0 and earlier does not ask the user to verify a new or mismatched SSH host key, which makes it easier for remote attackers to perform man-in-the-middle attacks.
- CVE-2008-5125MEDIUMCVSS v2 6.8EG 6.82008-11-18
admin.php in CCleague Pro 1.2 allows remote attackers to bypass authentication by setting the type cookie value to admin.
- CVE-2008-5158HIGHCVSS v2 7.5EG 7.52008-11-18
Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote attackers to bypass authentication and perform administrative actions via vectors involving "simply skipping the auth stage."
- CVE-2008-5219HIGHCVSS v2 7.5EG 7.52008-11-25
The password change feature (admin/cp.php) in VideoScript 4.0.1.50 and earlier does not check for administrative authentication and does not require knowledge of the original password, which allows remote attackers to change the admin acco…
- CVE-2008-5221HIGHCVSS v2 7.5EG 7.52008-11-25
The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via mod…
- CVE-2008-5296MEDIUMCVSS v2 6.8EG 6.82008-12-01
Gallery 1.5.x before 1.5.10 and 1.6 before 1.6-RC3, when register_globals is enabled, allows remote attackers to bypass authentication and gain administrative via unspecified cookies. NOTE: some of these details are obtained from third pa…
- CVE-2008-5355HIGHCVSS v2 10.0EG 10.02008-12-05
The "Java Update" feature for Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not verify the signature of the JRE that is download…
- CVE-2008-5407HIGHCVSS v2 9.4EG 9.42008-12-10
Multiple unspecified vulnerabilities in the Backup Exec remote-agent logon process in Symantec Backup Exec for Windows Servers 11.0 (aka 11d) builds 6235 and 7170, 12.0 build 1364, and 12.5 build 2213 allow remote attackers to bypass authe…
Map vulnerabilities like CWE-287 to your infrastructure
EchelonGraph correlates every CVE — across CWE-287 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Start Free Scan →