CWE-306 · Missing Authentication for Critical Function (page 18)
Page 18 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-3279 | Critical | 9.1 | 2024-08-12 | An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allo… |
CVE-2024-32765 | Medium | 4.2 | 2024-08-12 | A vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow local authenticated administrators to gain ac… |
CVE-2024-35143 | Medium | 6.7 | 2024-08-04 | IBM Planning Analytics Local 2.0 and 2.1 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is… |
CVE-2024-3219 | | 2024-07-29 | The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that don’t support AF_UNIX, such as Windows. This pure… | |
CVE-2024-7154 | Medium | 4.3 | 2024-07-28 | A vulnerability, which was classified as problematic, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is an unknown function of the file /wizard.h… |
CVE-2024-7007 | Critical | 9.8 | 2024-07-25 | Positron Broadcast Signal Processor TRA7005 v1.20 is vulnerable to an authentication bypass exploit that could allow an attacker to have unauthorized access to… |
CVE-2024-7079 | Medium | 6.5 | 2024-07-24 | A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remo… |
CVE-2024-39601 | Medium | 6.5 | 2024-07-22 | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). Affected dev… |
CVE-2024-38437 | Critical | 9.8 | 2024-07-21 | D-Link - CWE-288:Authentication Bypass Using an Alternate Path or Channel |
CVE-2024-6635 | High | 7.3 | 2024-07-20 | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient… |
CVE-2024-6895 | | 2024-07-19 | Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical s… | |
CVE-2024-21183 | High | 7.5 | 2024-07-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-21146 | High | 8.1 | 2024-07-16 | Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: GL Accounts). Supported versions that are affected are 12.2.3-12.2… |
CVE-2024-36457 | | 2024-07-15 | The vulnerability allows an attacker to bypass the authentication requirements for a specific PAM endpoint. | |
CVE-2024-5910 | Critical | 9.8 | 2024-07-10 | Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network acc… |
CVE-2024-6422 | Critical | 9.8 | 2024-07-10 | An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data. |
CVE-2024-37767 | High | 7.5 | 2024-07-05 | Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request. |
CVE-2024-1573 | Medium | 5.9 | 2024-07-04 | Missing Authentication for Critical Function vulnerability in the mobile monitoring feature of Mitsubishi Electric GENESIS64 versions 10.97.2 and prior, Mitsub… |
CVE-2023-41918 | Critical | 10.0 | 2024-07-02 | A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands po… |
CVE-2024-31916 | High | 7.5 | 2024-06-27 | IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authenticatio… |
CVE-2024-0949 | Critical | 9.8 | 2024-06-27 | Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows… |
CVE-2024-33622 | Medium | 6.5 | 2024-06-18 | Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sen… |
CVE-2024-37368 | High | 7.5 | 2024-06-14 | A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote system with FTView to… |
CVE-2024-27169 | High | 8.4 | 2024-06-14 | Toshiba printers provides API without authentication for internal access. A local attacker can bypass authentication in applications, providing administrative… |
CVE-2024-5952 | Medium | 6.5 | 2024-06-13 | Deep Sea Electronics DSE855 Restart Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass auth… |
CVE-2024-5951 | Medium | 6.5 | 2024-06-13 | Deep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypas… |
CVE-2024-5947 | Medium | 6.5 | 2024-06-13 | Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attack… |
CVE-2024-38279 | Medium | 4.6 | 2024-06-13 | The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file syste… |
CVE-2024-2013 | Critical | 10.0 | 2024-06-11 | An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to in… |
CVE-2024-32752 | Critical | 9.1 | 2024-06-06 | The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain… |
CVE-2024-22326 | Medium | 5.0 | 2024-06-06 | IBM System Storage DS8900F 89.22.19.0, 89.30.68.0, 89.32.40.0, 89.33.48.0, 89.40.83.0, and 89.40.93.0 could allow a remote user to create an LDAP connection wi… |
CVE-2024-37152 | Medium | 5.3 | 2024-06-06 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /a… |
CVE-2024-1662 | High | 7.5 | 2024-06-05 | Missing Authentication for Critical Function, Missing Authorization vulnerability in PORTY Smart Tech Technology Joint Stock Company PowerBank Application allo… |
CVE-2024-31684 | Low | 3.5 | 2024-06-03 | Incorrect access control in the fingerprint authentication mechanism of Bitdefender Mobile Security v4.11.3-gms allows attackers to bypass fingerprint authenti… |
CVE-2024-4332 | | 2024-06-03 | An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use L… | |
CVE-2024-0336 | | 2024-06-03 | Missing Authentication for Critical Function vulnerability in EMTA Grup PDKS allows Exploiting Incorrectly Configured Access Control Security Levels. This iss… | |
CVE-2024-36388 | Critical | 10.0 | 2024-06-02 | MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function |
CVE-2024-36470 | High | 8.1 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases |
CVE-2024-35342 | Medium | 4.6 | 2024-05-28 | Certain Anpviz products allow unauthenticated users to modify or disable camera related settings such as microphone volume, speaker volume, LED lighting, NTP… |
CVE-2024-5143 | Medium | 6.8 | 2024-05-23 | A user with device administrative privileges can change existing SMTP server settings on the device, without having to re-enter SMTP server credentials. By re… |
CVE-2024-20391 | Medium | 6.8 | 2024-05-15 | A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical access to an affected d… |
CVE-2023-5935 | High | 7.4 | 2024-05-15 | When configuring Arc (e.g. during the first setup), a local web interface is provided to ease the configuration process. Such web interface lacks authenticatio… |
CVE-2024-27942 | High | 7.5 | 2024-05-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow any unauthenticated client to disconnect any active… |
CVE-2024-32735 | Critical | 9.8 | 2024-05-14 | An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker… |
CVE-2022-32503 | High | 7.6 | 2024-05-14 | An issue was discovered on certain Nuki Home Solutions devices. An attacker with physical access to this JTAG port may be able to connect to the device and byp… |
CVE-2024-1076 | Medium | 6.5 | 2024-05-08 | The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to… |
CVE-2024-2860 | High | 7.8 | 2024-05-08 | The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM wh… |
CVE-2023-37325 | Medium | 5.4 | 2024-05-07 | D-Link DAP-2622 DDP Set SSID List Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to make unauthorized changes to de… |
CVE-2021-34983 | Medium | 6.5 | 2024-05-07 | NETGEAR Multiple Routers httpd Missing Authentication for Critical Function Information Disclosure Vulnerability. This vulnerability allows network-adjacent at… |
CVE-2024-3661 | High | 7.6 | 2024-05-06 | DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traff… |
CVE-2023-51587 | High | 7.5 | 2024-05-03 | Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose… |
CVE-2023-50199 | High | 8.8 | 2024-05-03 | D-Link G416 httpd Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to byp… |
CVE-2023-44413 | High | 7.5 | 2024-05-03 | D-Link D-View shutdown_coreserver Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-serv… |
CVE-2023-42121 | Critical | 9.8 | 2024-05-03 | Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2023-41187 | High | 8.8 | 2024-05-03 | D-Link DAP-1325 HNAP Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code… |
CVE-2023-41186 | Medium | 6.5 | 2024-05-03 | D-Link DAP-1325 CGI Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to access various functio… |
CVE-2023-41183 | High | 8.8 | 2024-05-03 | NETGEAR Orbi 760 SOAP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected instal… |
CVE-2023-39466 | Medium | 5.3 | 2024-05-03 | Triangle MicroWorks SCADA Data Gateway get_config Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to di… |
CVE-2023-39457 | Critical | 9.8 | 2024-05-03 | Triangle MicroWorks SCADA Data Gateway Missing Authentication Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected in… |
CVE-2023-38123 | High | 8.8 | 2024-05-03 | Inductive Automation Ignition OPC UA Quick Client Missing Authentication for Critical Function Authentication Bypass Vulnerability. This vulnerability allows r… |
CVE-2023-27357 | Medium | 6.5 | 2024-05-03 | NETGEAR RAX30 GetInfo Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive i… |
CVE-2023-47166 | High | 8.8 | 2024-05-01 | A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. A specially crafted network request can lead… |
CVE-2024-32764 | Critical | 9.9 | 2024-04-26 | A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users wi… |
CVE-2023-51478 | Critical | 9.8 | 2024-04-25 | Improper Authentication vulnerability in Abdul Hakeem Build App Online allows Privilege Escalation.This issue affects Build App Online: from n/a through 1.0.19. |
CVE-2024-21846 | Medium | 5.3 | 2024-04-18 | An unauthenticated attacker can reset the board and stop transmitter operations by sending a specially-crafted GET request to the command.cgi gateway, result… |
CVE-2024-1491 | High | 7.5 | 2024-04-18 | The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file system module pro… |
CVE-2024-21014 | Critical | 9.8 | 2024-04-16 | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: Simphony Enterprise Server). Supported versions… |
CVE-2024-21007 | High | 7.5 | 2024-04-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2024-21006 | High | 7.5 | 2024-04-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2023-4857 | High | 7.5 | 2024-04-15 | An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI calls that could lead… |
CVE-2024-3701 | Critical | 9.8 | 2024-04-15 | The system application (com.transsion.kolun.aiservice) component does not perform an authentication check, which allows attackers to perform malicious exploita… |
CVE-2024-3777 | Critical | 9.8 | 2024-04-15 | The password reset feature of Ai3 QbiBot lacks proper access control, allowing unauthenticated remote attackers to reset any user's password. |
CVE-2024-3774 | Medium | 5.3 | 2024-04-15 | aEnrich Technology a+HRD's functionality for front-end retrieval of system configuration values lacks proper restrictions on a specific parameter, allowing att… |
CVE-2024-30391 | Medium | 4.8 | 2024-04-12 | A Missing Authentication for Critical Function vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series with SPC3, and SRX… |
CVE-2024-26235 | High | 7.8 | 2024-04-09 | Windows Update Stack Elevation of Privilege Vulnerability |
CVE-2024-3281 | High | 8.8 | 2024-04-09 | A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices. A flaw in the firmware build process did not pro… |
CVE-2023-1083 | Critical | 9.8 | 2024-04-09 | An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands… |
CVE-2023-25493 | Medium | 6.7 | 2024-04-05 | A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products that could allow a… |
CVE-2023-48426 | Critical | 10.0 | 2024-04-05 | u-boot bug that allows for u-boot shell and interrupt over UART |
CVE-2024-31218 | Critical | 9.8 | 2024-04-05 | Webhood is a self-hosted URL scanner used analyzing phishing and malicious sites. Webhood's backend container images in versions 0.9.0 and earlier are subject… |
CVE-2023-6949 | Medium | 5.2 | 2024-04-02 | A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an atta… |
CVE-2023-51571 | High | 7.5 | 2024-04-01 | Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a deni… |
CVE-2024-2921 | Critical | 9.8 | 2024-03-26 | Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access un… |
CVE-2022-38057 | Medium | 6.5 | 2024-03-25 | Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1. |
CVE-2020-26942 | Critical | 9.1 | 2024-03-21 | An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a setAdminPassword op… |
CVE-2024-28179 | Critical | 9.0 | 2024-03-20 | Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to… |
CVE-2024-24578 | Critical | 10.0 | 2024-03-18 | RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a u… |
CVE-2024-21824 | Medium | 5.3 | 2024-03-18 | Improper authentication vulnerability in exists in multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. If… |
CVE-2024-22513 | Medium | 5.5 | 2024-03-16 | djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their ac… |
CVE-2024-2450 | High | 8.8 | 2024-03-15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switchi… |
CVE-2022-34321 | High | 8.2 | 2024-03-12 | Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable… |
CVE-2024-27758 | High | 8.4 | 2024-03-12 | In RPyC before 6.0.0, when a server exposes a method that calls the attribute named __array__ for a client-provided netref (e.g., np.array(client_netref)), a r… |
CVE-2024-2076 | Medium | 5.3 | 2024-03-01 | A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionali… |
CVE-2023-37495 | Medium | 5.9 | 2024-02-29 | Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in the Domino® Administ… |
CVE-2022-48621 | High | 7.5 | 2024-02-18 | Vulnerability of missing authentication for critical functions in the Wi-Fi module.Successful exploitation of this vulnerability may affect service confidentia… |
CVE-2024-26263 | Medium | 5.3 | 2024-02-15 | EBM Technologies RISWEB's specific URL path is not properly controlled by permission, allowing attackers to browse specific pages and query sensitive data with… |
CVE-2024-25618 | Medium | 4.2 | 2024-02-14 | Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers (CAS, SAML… |
CVE-2024-23783 | High | 8.8 | 2024-02-14 | Improper authentication vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent u… |
CVE-2023-40545 | High | 8.8 | 2024-02-06 | Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests. |
CVE-2024-23917 | Critical | 9.8 | 2024-02-06 | In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible |