Security Vulnerabilities, CVEs, Published In 2010 (Gain Privilege)
FTPServer.py in pyftpdlib before 0.2.0 does not increment the attempted_logins count for a USER command that specifies an invalid username, which makes it easier for remote attackers to obtain access via a brute-force attack.
Max CVSS
7.5
EPSS Score
0.33%
Published
2010-10-19
Updated
2010-10-20
Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not properly perform authentication, which allows remote Workspace Streaming servers and man-in-the-middle attackers to download arbitrary executable files onto a client system, and execute these files, via unspecified vectors.
Max CVSS
9.3
EPSS Score
0.24%
Published
2010-06-17
Updated
2017-08-08
ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.
Max CVSS
7.5
EPSS Score
0.33%
Published
2010-10-19
Updated
2010-10-20
CVE-2009-2936
Public exploit
** DISPUTED ** The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives. NOTE: the vendor disputes this report, saying that it is "fundamentally misguided and pointless."
Max CVSS
7.5
EPSS Score
51.79%
Published
2010-04-05
Updated
2018-10-10
admin.php in dB Masters Multimedia Links Directory 3.1.3 allows remote attackers to bypass authentication and gain administrative access via a certain value of the admin_log cookie.
Max CVSS
7.5
EPSS Score
0.37%
Published
2010-01-06
Updated
2013-08-09
The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter application settings by connecting to the application on port 32123, as demonstrated by setting the action option to wizardStep1.
Max CVSS
7.5
EPSS Score
0.48%
Published
2010-03-03
Updated
2017-09-19
admin/delitem.php in RoomPHPlanning 1.6 does not require authentication, which allows remote attackers to (1) delete arbitrary users via the user parameter or (2) delete arbitrary rooms via the room parameter.
Max CVSS
7.5
EPSS Score
0.54%
Published
2010-03-05
Updated
2017-09-19
Login.php in RoomPHPlanning 1.6 allows remote attackers to bypass authentication and obtain administrative access by setting the room_phplanning cookie to a value associated with the admin account.
Max CVSS
7.5
EPSS Score
0.54%
Published
2010-03-05
Updated
2017-09-19
admin/admin_info/index.php in the Mole Group Gastro Portal (Restaurant Directory) Script does not require administrative authentication, which allows remote attackers to change the admin password via an unspecified form submission.
Max CVSS
7.5
EPSS Score
0.94%
Published
2010-03-05
Updated
2017-09-19
EZ-Blog Beta 1 does not require authentication, which allows remote attackers to create or delete arbitrary posts via requests to PHP scripts.
Max CVSS
7.5
EPSS Score
0.54%
Published
2010-04-23
Updated
2018-10-10
admin/save_user.asp in Digital Interchange Document Library 1.0.1 does not require administrative authentication, which allows remote attackers to read or modify the administrator's credentials via unspecified vectors. NOTE: some of these details are obtained from third party information.
Max CVSS
7.5
EPSS Score
0.87%
Published
2010-04-23
Updated
2017-09-19
admin.php in Graugon PHP Article Publisher 1.0 allows remote attackers to bypass authentication and obtain administrative access by setting the g_admin cookie to 1.
Max CVSS
7.5
EPSS Score
1.00%
Published
2010-04-23
Updated
2017-09-19
The D-Link DIR-615 with firmware 3.10NA does not require administrative authentication for apply.cgi, which allows remote attackers to (1) change the admin password via the admin_password parameter, (2) disable the security requirement for the Wi-Fi network via unspecified vectors, or (3) modify DNS settings via unspecified vectors.
Max CVSS
5.0
EPSS Score
0.25%
Published
2010-04-27
Updated
2010-04-28
Unspecified vulnerability in OpenX 2.8.1 and 2.8.2 allows remote attackers to bypass authentication and obtain access to an Administrator account via unknown vectors, possibly related to www/admin/install.php, www/admin/install-plugins.php, and other www/admin/ files.
Max CVSS
7.5
EPSS Score
0.45%
Published
2010-04-27
Updated
2010-07-30
ToutVirtual VirtualIQ Pro before 3.5 build 8691 does not require administrative authentication for JBoss console access, which allows remote attackers to execute arbitrary commands via requests to (1) the JMX Management Console or (2) the Web Console.
Max CVSS
7.5
EPSS Score
2.76%
Published
2010-05-07
Updated
2018-10-10
The Identity Server in Novell Access Manager before 3.1 SP1 allows attackers with disabled Active Directory accounts to authenticate using X.509 authentication, which bypasses intended access restrictions.
Max CVSS
4.3
EPSS Score
0.07%
Published
2010-05-26
Updated
2010-05-27
admin/index.php in oBlog allows remote attackers to conduct brute-force password guessing attacks via HTTP requests.
Max CVSS
6.8
EPSS Score
0.48%
Published
2010-06-25
Updated
2017-08-17
WB News 2.1.2 allows remote attackers to bypass authentication and gain administrative access via a modified WBNEWS cookie, as demonstrated by setting this cookie to 1.
Max CVSS
7.5
EPSS Score
0.90%
Published
2010-07-12
Updated
2017-09-19
admin/manage_users.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary passwords via the newPW1 and newPW2 parameters.
Max CVSS
7.5
EPSS Score
0.90%
Published
2010-07-12
Updated
2017-09-19
admin/header.php in Scripteen Free Image Hosting Script 2.3 allows remote attackers to bypass authentication and gain administrative access by setting the cookgid cookie value to 1, a different vector than CVE-2008-3211.
Max CVSS
7.5
EPSS Score
2.45%
Published
2010-08-25
Updated
2017-09-19
System Security Services Daemon (SSSD) before 1.0.1, when the krb5 auth_provider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting ticket (TGT); and might allow remote attackers to bypass intended access restrictions via vectors involving an arbitrary password in conjunction with a valid TGT.
Max CVSS
3.7
EPSS Score
0.13%
Published
2010-01-14
Updated
2010-01-15
The helpmanager servlet in the web server in HP OpenView Performance Insight (OVPI) 5.4 and earlier does not properly authenticate and validate requests, which allows remote attackers to execute arbitrary commands via vectors involving upload of a JSP document.
Max CVSS
10.0
EPSS Score
4.90%
Published
2010-03-10
Updated
2018-10-10
Directory Services in Apple Mac OS X before 10.6.3 does not properly perform authorization during processing of record names, which allows local users to gain privileges via unspecified vectors.
Max CVSS
7.2
EPSS Score
0.04%
Published
2010-03-30
Updated
2010-03-31
Server Admin in Apple Mac OS X Server before 10.6.3 does not properly enforce authentication for directory binding, which allows remote attackers to obtain potentially sensitive information from Open Directory via unspecified LDAP requests.
Max CVSS
5.0
EPSS Score
0.19%
Published
2010-03-30
Updated
2010-06-21
admin.htm in Geo++ GNCASTER 1.4.0.7 and earlier does not properly enforce HTTP Digest Authentication, which allows remote authenticated users to use HTTP Basic Authentication, bypassing intended server policy.
Max CVSS
4.0
EPSS Score
0.26%
Published
2010-02-04
Updated
2018-10-10