CWE-306 · Missing Authentication for Critical Function (page 17)
Page 17 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47574 | High | 7.8 | 2024-11-13 | A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through… |
CVE-2024-7516 | High | 7.1 | 2024-11-12 | A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle attackers to conduct remote Service Session Hijacking that may arise f… |
CVE-2024-26011 | Medium | 5.3 | 2024-11-12 | A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6… |
CVE-2024-8074 | | 2024-11-12 | Missing Authentication for Critical Function, Missing Authorization vulnerability in Nomysoft Informatics Nomysem allows Collect Data as Provided by Users. Th… | |
CVE-2024-10284 | Critical | 9.8 | 2024-11-09 | The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded encryption key in… |
CVE-2024-50589 | High | 7.5 | 2024-11-08 | An unauthenticated attacker with access to the local network of the medical office can query an unprotected Fast Healthcare Interoperability Resources (FHIR)… |
CVE-2024-48953 | High | 7.5 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. Endpoints for creating, editing, or deleting third-party authentication modules lacked proper authorization c… |
CVE-2024-48952 | Medium | 6.4 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authenti… |
CVE-2024-48950 | High | 7.5 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. An endpoint used by Distributed Logpoint Setup was exposed, allowing unauthenticated attackers to bypass CSRF… |
CVE-2024-51493 | Medium | 5.3 | 2024-11-05 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows a… |
CVE-2024-51362 | Medium | 6.5 | 2024-11-05 | The LSC Smart Connect Indoor IP Camera V7.6.32 is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP prot… |
CVE-2024-9430 | Medium | 5.3 | 2024-10-31 | The Get Quote For Woocommerce – Request A Quote For Woocommerce plugin for WordPress is vulnerable to unauthorized access of Quote data due to a missing capabi… |
CVE-2024-51567 | Critical | 10.0 | 2024-10-29 | upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary… |
CVE-2024-50488 | High | 8.8 | 2024-10-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in yespbs Token Login token-login allows Authentication Bypass.This issue affects Token… |
CVE-2024-50489 | Critical | 9.8 | 2024-10-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in realtyworkstation Realty Workstation realty-workstation allows Authentication Bypass… |
CVE-2024-50487 | Critical | 9.8 | 2024-10-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo MaanStore API maanstore-api allows Authentication Bypass.This issue affects Maa… |
CVE-2024-50486 | Critical | 9.8 | 2024-10-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo Acnoo Flutter API acnoo-flutter-api allows Authentication Bypass.This issue aff… |
CVE-2024-50477 | Critical | 9.8 | 2024-10-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypa… |
CVE-2024-10386 | Critical | 9.8 | 2024-10-25 | CVE-2024-10386 IMPACT An authentication vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to se… |
CVE-2024-47406 | Critical | 9.1 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability. |
CVE-2024-48442 | Medium | 6.5 | 2024-10-24 | Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 allows attackers to access… |
CVE-2024-47902 | High | 7.2 | 2024-10-23 | A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 on… |
CVE-2024-47575 | Critical | 9.8 | 2024-10-23 | A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 th… |
CVE-2024-26519 | Critical | 9.0 | 2024-10-22 | An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the /www/cgi-bin/nas.c… |
CVE-2022-23862 | High | 7.8 | 2024-10-22 | A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Bec… |
CVE-2024-10002 | High | 8.8 | 2024-10-22 | The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insufficient validation… |
CVE-2024-40091 | Medium | 5.3 | 2024-10-21 | Vilo 5 Mesh WiFi System <= 5.16.1.33 lacks authentication in the Boa webserver, which allows remote, unauthenticated attackers to retrieve logs with sensitive… |
CVE-2024-40087 | Critical | 9.6 | 2024-10-21 | Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauth… |
CVE-2024-47912 | High | 8.2 | 2024-10-21 | A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated atta… |
CVE-2024-49604 | Critical | 9.8 | 2024-10-20 | Authentication Bypass Using an Alternate Path or Channel vulnerability in N-Media Simple User Registration wp-registration allows Authentication Bypass.This is… |
CVE-2024-49328 | Critical | 9.8 | 2024-10-20 | Authentication Bypass Using an Alternate Path or Channel vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Authentication Bypass.This issue a… |
CVE-2024-49399 | | 2024-10-17 | The affected product is vulnerable to an attacker being able to use commands without providing a password which may allow an attacker to leak information. | |
CVE-2024-48920 | Critical | 9.1 | 2024-10-17 | PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unaut… |
CVE-2024-9861 | High | 8.1 | 2024-10-17 | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due… |
CVE-2024-45844 | High | 7.2 | 2024-10-16 | BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings. Note: Software versions wh… |
CVE-2023-22650 | High | 8.8 | 2024-10-16 | A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider… |
CVE-2024-21272 | High | 7.5 | 2024-10-15 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficu… |
CVE-2024-5749 | High | 7.5 | 2024-10-15 | Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials. |
CVE-2024-45276 | High | 7.5 | 2024-10-15 | An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication. |
CVE-2024-45274 | Critical | 9.8 | 2024-10-15 | An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication. |
CVE-2024-9984 | Critical | 9.8 | 2024-10-15 | Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated remote attackers to use this functionalit… |
CVE-2024-48791 | High | 7.5 | 2024-10-14 | An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-9137 | Critical | 9.4 | 2024-10-14 | The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute s… |
CVE-2024-48777 | High | 7.5 | 2024-10-11 | LEDVANCE com.ledvance.smartplus.eu 2.1.10 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48776 | High | 7.5 | 2024-10-11 | An issue in Shelly com.home.shelly 1.0.4 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-48775 | High | 7.5 | 2024-10-11 | An issue in Plug n Play Camera com.ezset.delaney 1.2.0 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48774 | High | 7.5 | 2024-10-11 | An issue in Fermax Asia Pacific Pte Ltd com.fermax.vida 2.4.6 allows a remote attacker to obtain sensitve information via the firmware update process. |
CVE-2024-48773 | High | 7.5 | 2024-10-11 | An issue in WoFit v.7.2.3 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-48771 | High | 7.5 | 2024-10-11 | An issue in almando GmbH Almando Play APP (com.almando.play) 1.8.2 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-48768 | High | 7.5 | 2024-10-11 | An issue in almaodo GmbH appinventor.ai_google.almando_control 2.3.1 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-8530 | Medium | 5.9 | 2024-10-11 | CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generated “logcaptures” ar… |
CVE-2024-9164 | Critical | 9.6 | 2024-10-11 | An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 pri… |
CVE-2024-9522 | High | 8.8 | 2024-10-10 | The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to incorrect authentic… |
CVE-2024-43488 | High | 8.8 | 2024-10-08 | Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution th… |
CVE-2024-8943 | Critical | 9.8 | 2024-10-08 | The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insufficient verification o… |
CVE-2024-47555 | High | 8.3 | 2024-10-07 | Missing Authentication - User & System Configuration |
CVE-2024-41988 | | 2024-10-03 | TEM Opera Plus FM Family Transmitter allows access to an unprotected endpoint that allows MPFS File System binary image upload without authentication. This fil… | |
CVE-2024-35294 | Medium | 6.5 | 2024-10-02 | An unauthenticated remote attacker may use the devices traffic capture without authentication to grab plaintext administrative credentials. |
CVE-2024-35293 | Critical | 9.1 | 2024-10-02 | An unauthenticated remote attacker may use a missing authentication for critical function vulnerability to reboot or erase the affected devices resulting in da… |
CVE-2024-9289 | Critical | 9.8 | 2024-10-01 | The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is… |
CVE-2024-42017 | Critical | 10.0 | 2024-09-30 | An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenario, if the applicat… |
CVE-2024-46293 | Critical | 9.8 | 2024-09-30 | Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Incorrect Access Control. There is a lack of authorization checks for admin operations. Spe… |
CVE-2024-8456 | Critical | 9.8 | 2024-09-30 | Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attacker… |
CVE-2024-39364 | Medium | 6.3 | 2024-09-27 | Advantech ADAM-5630 has built-in commands that can be executed without authenticating the user. These commands allow for restarting the operating system, re… |
CVE-2024-8310 | Critical | 9.8 | 2024-09-27 | OPW Fuel Management Systems SiteSentinel could allow an attacker to bypass authentication to the server and obtain full admin privileges. |
CVE-2024-6981 | Critical | 9.8 | 2024-09-27 | OMNTEC Proteus Tank Monitoring OEL8000III Series could allow an attacker to perform administrative actions without proper authentication. |
CVE-2024-47130 | High | 8.8 | 2024-09-26 | The goTenna Pro App allows unauthenticated attackers to remotely update the local public keys used for P2P and group messages. It is advised to update your a… |
CVE-2024-7781 | High | 8.1 | 2024-09-26 | The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5. This is due to improper authenticat… |
CVE-2023-52949 | Medium | 5.5 | 2024-09-26 | Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allow… |
CVE-2023-52947 | Medium | 4.0 | 2024-09-26 | Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local… |
CVE-2024-6592 | Critical | 9.1 | 2024-09-25 | An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and… |
CVE-2024-45229 | Medium | 6.6 | 2024-09-20 | The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registratio… |
CVE-2022-25770 | High | 7.8 | 2024-09-18 | Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. Th… |
CVE-2024-6406 | | 2024-09-18 | Missing Authentication for Critical Function, Missing Authorization vulnerability in Yordam Information Technology Mobile Library Application allows Retrieve E… | |
CVE-2024-8956 | Critical | 9.1 | 2024-09-17 | PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to… |
CVE-2024-6582 | Medium | 4.3 | 2024-09-13 | A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Id… |
CVE-2024-8751 | High | 7.5 | 2024-09-12 | A vulnerability allows a remote unauthenticated attacker to modify the prod uct’s IP address over the Sopas ET interface. This can lead to a Denial of Service… |
CVE-2024-8277 | Critical | 9.8 | 2024-09-11 | The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due t… |
CVE-2024-8321 | Medium | 5.8 | 2024-09-10 | Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to isolate man… |
CVE-2024-8320 | Medium | 5.3 | 2024-09-10 | Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to spoof Netwo… |
CVE-2024-8012 | High | 7.8 | 2024-09-10 | An authentication bypass weakness in the message broker service of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated atta… |
CVE-2024-37991 | Medium | 5.3 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-7015 | Critical | 9.8 | 2024-09-09 | Missing Authentication for Critical Function vulnerability in Profelis Informatics and Consulting PassBox allows Authentication Abuse. This issue affects Pass… |
CVE-2024-8584 | Critical | 9.8 | 2024-09-09 | Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an… |
CVE-2024-45075 | High | 8.8 | 2024-09-04 | IBM webMethods Integration 10.15 could allow an authenticated user to create scheduler tasks that would allow them to escalate their privileges to administrato… |
CVE-2024-39300 | Low | 3.7 | 2024-08-30 | Missing authentication vulnerability exists in Telnet function of WAB-I1750-PS v1.5.10 and earlier. When Telnet function of the product is enabled, a remote at… |
CVE-2024-4428 | Critical | 9.8 | 2024-08-29 | Missing Authentication for Critical Function, Missing Authorization vulnerability in Menulux Information Technologies Managment Portal allows Collect Data as P… |
CVE-2024-45049 | High | 7.5 | 2024-08-27 | Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the s… |
CVE-2024-7940 | High | 8.3 | 2024-08-27 | The product exposes a service that is intended for local only to all network interfaces without any authentication. |
CVE-2024-7125 | High | 7.8 | 2024-08-27 | Authentication Bypass vulnerability in Hitachi Ops Center Common Services.This issue affects Hitachi Ops Center Common Services: from 10.9.3-00 before 11.0.2-0… |
CVE-2024-43798 | High | 8.6 | 2024-08-26 | Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environment variable used to… |
CVE-2024-36445 | Critical | 9.8 | 2024-08-22 | Swissphone DiCal-RED 4009 devices allow a remote attacker to gain a root shell via TELNET without authentication. |
CVE-2024-35151 | Medium | 6.5 | 2024-08-22 | IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive information through improper authorization controls on APIs. |
CVE-2024-43272 | Medium | 5.3 | 2024-08-19 | Missing Authentication for Critical Function vulnerability in icegram Icegram allows Accessing Functionality Not Properly Constrained by ACLs.This issue affect… |
CVE-2024-42462 | Critical | 9.8 | 2024-08-16 | Improper Authentication vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Bypass.This issue affects upKeeper Manager: through… |
CVE-2024-6347 | Medium | 6.5 | 2024-08-15 | * Unprotected privileged mode access through UDS session in the Blind Spot Detection Sensor ECU firmware in Nissan Altima (2022) allows attackers to trigger d… |
CVE-2024-7628 | High | 8.1 | 2024-08-15 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4… |
CVE-2024-38143 | Medium | 4.2 | 2024-08-13 | Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability |
CVE-2024-35124 | High | 7.5 | 2024-08-13 | A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password… |
CVE-2024-7503 | Critical | 9.8 | 2024-08-12 | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of l… |