CWE-287— Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.— MITRE CWE catalog
4,924 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-287page 7 of 99
- CVE-2008-6854HIGHCVSS v2 7.5EG 7.52009-07-14
Xigla Software Absolute FAQ Manager.NET 6.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
- CVE-2008-6855HIGHCVSS v2 7.5EG 7.52009-07-14
Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a certain cookie.
- CVE-2008-6856HIGHCVSS v2 7.5EG 7.52009-07-14
Xigla Software Absolute News Manager.NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
- CVE-2008-6857HIGHCVSS v2 7.5EG 7.52009-07-14
Absolute Podcast .NET 1.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
- CVE-2008-6858HIGHCVSS v2 7.5EG 7.52009-07-14
Absolute Banner Manager .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
- CVE-2008-6859HIGHCVSS v2 7.5EG 7.52009-07-14
Xigla Software Absolute Control Panel XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
- CVE-2008-6860HIGHCVSS v2 7.5EG 7.52009-07-14
Xigla Software Absolute Poll Manager XE 4.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
- CVE-2008-6861HIGHCVSS v2 7.5EG 7.52009-07-14
Xigla Software Absolute Newsletter 6.0 and 6.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
- CVE-2008-6862HIGHCVSS v2 7.5EG 7.52009-07-14
Absolute Content Rotator 6.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
- CVE-2008-6863HIGHCVSS v2 7.5EG 7.52009-07-14
Xigla Software Absolute Form Processor .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
- CVE-2008-6864HIGHCVSS v2 7.5EG 7.52009-07-14
Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
- CVE-2008-6912HIGHCVSS v2 7.5EG 7.52009-08-07
Zeeways SHAADICLONE 2.0 allows remote attackers to bypass authentication and gain administrative privileges via a direct request to admin/home.php.
- CVE-2008-6916HIGHCVSS v2 10.0EG 10.02009-08-07
Siemens SpeedStream 5200 with NetPort Software 1.1 allows remote attackers to bypass authentication via an invalid Host header, possibly involving a trailing dot in the hostname.
- CVE-2008-6919HIGHCVSS v2 7.5EG 7.52009-08-10
profileedit.php TaskDriver 1.3 and earlier allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to "fook!admin."
- CVE-2008-6939HIGHCVSS v2 7.5EG 7.52009-08-12
TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and (1) gain administrative privileges by setting the adm cookie to 1 or (2) gain privileges as another user by setting the logged cookie to the target use…
- CVE-2008-6947HIGHCVSS v2 7.5EG 7.52009-08-12
Collabtive 0.4.8 allows remote attackers to bypass authentication and create new users, including administrators, via unspecified vectors associated with the added mode in a users action to admin.php.
- CVE-2008-6951HIGHCVSS v2 7.5EG 7.52009-08-12
MauryCMS 0.53.2 and earlier does not require administrative authentication for Editors/fckeditor/editor/filemanager/browser/default/browser.html, which allows remote attackers to upload arbitrary files via a direct request.
- CVE-2008-6965HIGHCVSS v2 7.5EG 7.52009-08-13
AJ Square AJ Auction OOPD, Pro Platinum Skin #1, Pro Platinum Skin #2, and Web 2.0 send a redirect but do not exit when certain scripts are called directly, which allows remote attackers to bypass authentication via a direct request to (1)…
- CVE-2008-6984MEDIUMCVSS v2 5.8EG 5.82009-08-19
Plesk 8.6.0, when short mail login names (SHORTNAMES) are enabled, allows remote attackers to bypass authentication and send spam e-mail via a message with (1) a base64-encoded username that begins with a valid shortname, or (2) a username…
- CVE-2008-7006MEDIUMCVSS v2 5.0EG 5.02009-08-19
Free PHP VX Guestbook 1.06 allows remote attackers to bypass authentication and download a backup of the database via a direct request to admin/backupdb.php.
- CVE-2008-7007HIGHCVSS v2 7.5EG 7.52009-08-19
Free PHP VX Guestbook 1.06 allows remote attackers to bypass authentication and gain administrative access by setting the (1) admin_name and (2) admin_pass cookie values to 1.
- CVE-2008-7008MEDIUMCVSS v2 5.0EG 5.02009-08-19
HyperStop Web Host Directory 1.2 allows remote attackers to bypass authentication and download a database backup via a direct request to admin/backup/db.
- CVE-2008-7019HIGHCVSS v2 7.5EG 7.52009-08-21
Esqlanelapse 2.6.1 and 2.6.2 allows remote attackers to bypass authentication and gain privileges via modified (1) enombre and (2) euri cookies.
- CVE-2008-7027HIGHCVSS v2 7.5EG 7.52009-08-21
Libra File Manager 1.18 and earlier allows remote attackers to bypass authentication and gain privileges by setting the user and pass cookies to 1.
- CVE-2008-7028HIGHCVSS v2 7.5EG 7.52009-08-21
RPG.Board 0.8 Beta2 and earlier allows remote attackers to bypass authentication and gain privileges by setting the keep4u cookie to a certain value.
- CVE-2008-7041HIGHCVSS v2 7.5EG 7.52009-08-24
AJ Classifieds allows remote attackers to bypass authentication and gain administrator privileges via a direct request to admin/home.php.
- CVE-2008-7045MEDIUMCVSS v2 6.4EG 6.42009-08-24
AJ Square Free Polling Script (AJPoll) Database version allows remote attackers to bypass authentication and reset poll votes via a direct request to admin/resetvote.php.
- CVE-2008-7046MEDIUMCVSS v2 6.4EG 6.42009-08-24
AJ Square Free Polling Script (AJPoll) allows remote attackers to bypass authentication and create new polls via a direct request to admin/include/newpoll.php, a different vector than CVE-2008-7045. NOTE: the provenance of this information…
- CVE-2008-7047HIGHCVSS v2 7.5EG 7.52009-08-24
NatterChat 1.1 allows remote attackers to bypass authentication and gain administrator privileges to read or delete rooms and messages via a direct request to admin/home.asp.
- CVE-2008-7051HIGHCVSS v2 7.5EG 7.52009-08-24
AJ Square AJ Article allows remote attackers to bypass authentication and access administrator functionality via a direct request to (1) user.php, (2) articles.php, (3) articlesuspend.php, (4) site.php, (5) statistics.php, (6) mail.php, (7…
- CVE-2008-7081HIGHCVSS v2 10.0EG 10.02009-08-25
userHandler.cgi in RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1 allows remote attackers to bypass authentication and gain administrator privileges by setting the login parameter to admin. NOTE: the provenance of this information is unkno…
- CVE-2008-7086HIGHCVSS v2 7.5EG 7.52009-08-26
Maian Greetings 2.1 allows remote attackers to bypass authentication and gain administrative privileges by setting the mecard_admin_cookie cookie to admin.
- CVE-2008-7124HIGHCVSS v2 7.5EG 7.52009-08-31
zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers to gain administrator privileges via a direct request, as demonstrated by adding a new administrato…
- CVE-2008-7156MEDIUMCVSS v2 6.8EG 6.82009-09-02
EkinBoard 1.1.0 and earlier, when register_globals is enabled, allows remote attackers to bypass authorization and gain administrator privileges by setting the _groups[] parameter to 2, as demonstrated via backup.php.
- CVE-2008-7179HIGHCVSS v2 7.5EG 7.52009-09-08
OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMIN_Hora, ADMIN_Logado, and ADMIN_Nome cookies to certain values, as reachable in Admin/index.php.
- CVE-2009-0021MEDIUMCVSS v2 5.0EG 5.02009-01-07
NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS sig…
- CVE-2009-0025MEDIUMCVSS v2 6.8EG 6.82009-01-07
BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a si…
- CVE-2009-0030MEDIUMCVSS v2 6.5EG 6.52009-01-21
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by usin…
- CVE-2009-0046MEDIUMCVSS v2 5.0EG 5.02009-01-07
Sun GridEngine 5.3 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and EC…
- CVE-2009-0047MEDIUMCVSS v2 5.0EG 5.02009-01-07
Gale 0.99 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys,…
- CVE-2009-0048MEDIUMCVSS v2 5.0EG 5.02009-01-07
OpenEvidence 1.0.6 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and EC…
- CVE-2009-0049MEDIUMCVSS v2 5.0EG 5.02009-01-07
Belgian eID middleware (eidlib) 2.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signa…
- CVE-2009-0051MEDIUMCVSS v2 5.0EG 5.02009-01-07
ZXID 0.29 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to …
- CVE-2009-0085HIGHCVSS v2 7.1EG 7.12009-03-10
The Secure Channel (aka SChannel) authentication component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, when certificate authentication is used, does not properly validate the…
- CVE-2009-0124MEDIUMCVSS v2 5.0EG 5.02009-01-15
The tqsl_verifyDataBlock function in openssl_cert.cpp in American Radio Relay League (ARRL) tqsllib 2.0 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation …
- CVE-2009-0125MEDIUMCVSS v2 5.0EG 5.02009-01-15
NOTE: this issue has been disputed by the upstream vendor. nasl/nasl_crypto2.c in the Nessus Attack Scripting Language library (aka libnasl) 2.2.11 does not properly check the return value from the OpenSSL DSA_do_verify function, which all…
- CVE-2009-0126MEDIUMCVSS v2 5.0EG 5.02009-01-15
The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSA_public_decrypt function, which allows remote att…
- CVE-2009-0127MEDIUMCVSS v2 5.0EG 5.02009-01-15
M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain vi…
- CVE-2009-0128MEDIUMCVSS v2 5.0EG 5.02009-01-15
plugins/crypto/openssl/crypto_openssl.c in Simple Linux Utility for Resource Management (aka SLURM or slurm-llnl) does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass v…
- CVE-2009-0129MEDIUMCVSS v2 5.0EG 5.02009-01-15
libcrypt-openssl-dsa-perl does not properly check the return value from the OpenSSL DSA_verify and DSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature,…
Map vulnerabilities like CWE-287 to your infrastructure
EchelonGraph correlates every CVE — across CWE-287 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Start Free Scan →