CWE-306 · Missing Authentication for Critical Function (page 19)
Page 19 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6221 | High | 7.7 | 2024-02-01 | The cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic controller (PLC), PumpSe… |
CVE-2023-49617 | Critical | 10.0 | 2024-02-01 | The MachineSense application programmable interface (API) is improperly protected and can be accessed without authentication. A remote attacker could retr… |
CVE-2023-49115 | High | 7.5 | 2024-02-01 | MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users. |
CVE-2024-22449 | Medium | 6.6 | 2024-02-01 | Dell PowerScale OneFS versions 9.0.0.x through 9.6.0.x contains a missing authentication for critical function vulnerability. A low privileged local malicious… |
CVE-2023-6942 | High | 7.5 | 2024-01-30 | Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) ver… |
CVE-2024-23618 | Critical | 9.6 | 2024-01-26 | An arbitrary code execution vulnerability exists in Arris SURFboard SGB6950AC2 devices. An unauthenticated attacker can exploit this vulnerability to achieve c… |
CVE-2024-21619 | Medium | 5.3 | 2024-01-25 | A Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message Containing Sensitive Information vulnerability in J-We… |
CVE-2023-51947 | Critical | 9.1 | 2024-01-19 | Improper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types of data without aut… |
CVE-2023-5716 | Critical | 9.8 | 2024-01-19 | ASUS Armoury Crate has a vulnerability in arbitrary file write and allows remote attackers to access or modify arbitrary files by sending specific HTTP request… |
CVE-2024-22415 | High | 7.3 | 2024-01-18 | jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol… |
CVE-2024-22212 | Critical | 9.6 | 2024-01-18 | Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the pa… |
CVE-2023-5253 | Medium | 5.3 | 2024-01-15 | A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthentica… |
CVE-2023-51062 | Medium | 5.3 | 2024-01-13 | An unauthenticated log file read in the component log-smblog-save of QStar Archive Solutions RELEASE_3-0 Build 7 Patch 0 allows attackers to disclose the SMB L… |
CVE-2024-21654 | Medium | 4.8 | 2024-01-12 | Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of… |
CVE-2023-31033 | Medium | 6.8 | 2024-01-12 | NVIDIA DGX A100 BMC contains a vulnerability where a user may cause a missing authentication issue for a critical function by an adjacent network . A successfu… |
CVE-2023-49255 | Critical | 9.8 | 2024-01-12 | The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the configuration, the sessi… |
CVE-2023-51987 | Critical | 9.8 | 2024-01-11 | D-Link DIR-822+ V1.0.2 contains a login bypass in the HNAP1 interface, which allows attackers to log in to administrator accounts with empty passwords. |
CVE-2022-45794 | High | 8.6 | 2024-01-10 | An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and write files on the PLC… |
CVE-2023-40393 | High | 7.5 | 2024-01-10 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. Photos in the Hidden Photos… |
CVE-2024-21306 | Medium | 5.7 | 2024-01-09 | Microsoft Bluetooth Driver Spoofing Vulnerability |
CVE-2023-5376 | High | 8.6 | 2024-01-09 | An Improper Authentication vulnerability in Korenix JetNet TFTP allows abuse of this service. This issue affects JetNet devices older than firmware version 202… |
CVE-2023-5881 | High | 8.2 | 2024-01-03 | Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect (Retrofit-Kit Model ALDCM) "Garage Door Control Module Setup" and modi… |
CVE-2023-29485 | Critical | 9.8 | 2023-12-21 | An issue was discovered in Heimdal Thor agent versions 3.4.2 and before on Windows and 2.6.9 and before on macOS, allows attackers to bypass network filtering… |
CVE-2023-6595 | High | 7.5 | 2023-12-14 | In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated att… |
CVE-2023-6368 | Medium | 5.9 | 2023-12-14 | In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated att… |
CVE-2023-6718 | Critical | 9.4 | 2023-12-13 | An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to the lack of any aut… |
CVE-2023-50263 | Low | 3.7 | 2023-12-12 | Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL da… |
CVE-2023-32460 | High | 8.8 | 2023-12-08 | Dell PowerEdge BIOS contains an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnera… |
CVE-2023-49693 | Critical | 9.8 | 2023-11-29 | NETGEAR ProSAFE Network Management System has Java Debug Wire Protocol (JDWP) listening on port 11611 and it is remotely accessible by unauthenticated users… |
CVE-2023-29063 | Low | 2.4 | 2023-11-28 | The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for… |
CVE-2023-29061 | Medium | 5.2 | 2023-11-28 | There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this vulnerability to a… |
CVE-2023-29060 | Medium | 5.4 | 2023-11-28 | The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access t… |
CVE-2023-3104 | Medium | 5.7 | 2023-11-22 | Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of auth… |
CVE-2023-42770 | Critical | 10.0 | 2023-11-21 | Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP… |
CVE-2023-47674 | Critical | 9.8 | 2023-11-16 | Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the config… |
CVE-2023-34060 | Critical | 9.8 | 2023-11-14 | VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from an older vers… |
CVE-2023-46096 | Medium | 6.5 | 2023-11-14 | A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). The PUD Manager of affected products does not properly authenticate users in the… |
CVE-2023-45140 | Medium | 4.8 | 2023-11-08 | The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Estab… |
CVE-2023-46819 | Medium | 5.3 | 2023-11-07 | Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are rec… |
CVE-2023-4699 | Critical | 10.0 | 2023-11-06 | Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R seri… |
CVE-2023-46381 | High | 8.2 | 2023-11-04 | LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication for the preinstalled v… |
CVE-2022-43555 | High | 7.8 | 2023-11-03 | Ivanti Avalanche Printer Device Service Missing Authentication Local Privilege Escalation Vulnerability |
CVE-2022-43554 | High | 7.8 | 2023-11-03 | Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability |
CVE-2023-41351 | Critical | 9.8 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mech… |
CVE-2023-46249 | Critical | 9.6 | 2023-10-31 | authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possib… |
CVE-2023-46978 | High | 7.5 | 2023-10-31 | TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset login password & WIFI passwords without authentication. |
CVE-2023-46747 | Critical | 9.8 | 2023-10-26 | Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port… |
CVE-2023-42845 | Medium | 5.3 | 2023-10-25 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. Photos in the Hidden… |
CVE-2023-40401 | High | 7.5 | 2023-10-25 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Ventura 13.6.1. An attacker may be able to access passkeys without aut… |
CVE-2023-45851 | High | 8.8 | 2023-10-25 | The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication. This issue all… |
CVE-2023-45220 | High | 8.8 | 2023-10-25 | The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol to retrieve sensiti… |
CVE-2023-41255 | High | 8.8 | 2023-10-25 | The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of au… |
CVE-2023-39930 | High | 7.5 | 2023-10-25 | A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a malicio… |
CVE-2023-39231 | High | 7.3 | 2023-10-25 | PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered devi… |
CVE-2023-27377 | High | 7.5 | 2023-10-25 | Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction o… |
CVE-2023-27376 | High | 7.5 | 2023-10-25 | Missing authentication in the StudentPopupDetails_StudentDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitiv… |
CVE-2023-27375 | High | 7.5 | 2023-10-25 | Missing authentication in the StudentPopupDetails_ContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitiv… |
CVE-2023-27261 | Medium | 5.3 | 2023-10-25 | Missing authentication in the DeleteAssignments method in IDAttend’s IDWeb application 3.1.052 and earlier allows deletion of data by unauthenticated a… |
CVE-2023-27259 | High | 7.5 | 2023-10-25 | Missing authentication in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student and teac… |
CVE-2023-27258 | High | 7.5 | 2023-10-25 | Missing authentication in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student and teacher da… |
CVE-2023-27257 | High | 7.5 | 2023-10-25 | Missing authentication in the GetActiveToiletPasses method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student information by un… |
CVE-2023-27256 | Medium | 5.8 | 2023-10-25 | Missing authentication in the GetLogFiles method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of sensitive log files by unauthenticat… |
CVE-2023-26580 | High | 7.5 | 2023-10-25 | Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated a… |
CVE-2023-26579 | Medium | 5.3 | 2023-10-25 | Missing authentication in the DeleteStaff method in IDAttend’s IDWeb application 3.1.013 allows deletion of staff information by unauthenticated attackers. |
CVE-2023-26576 | High | 7.5 | 2023-10-25 | Missing authentication in the SearchStudentsRFID method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unaut… |
CVE-2023-26575 | High | 7.5 | 2023-10-25 | Missing authentication in the SearchStudentsStaff method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student and teacher d… |
CVE-2023-26574 | High | 7.5 | 2023-10-25 | Missing authentication in the SearchStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthentic… |
CVE-2023-26573 | High | 8.2 | 2023-10-25 | Missing authentication in the SetDB method in IDAttend’s IDWeb application 3.1.052 and earlier allows denial of service or theft of database login credentials. |
CVE-2023-26571 | High | 7.5 | 2023-10-25 | Missing authentication in the SetStudentNotes method in IDAttend’s IDWeb application 3.1.052 and earlier allows modification of student data by unauthenticate… |
CVE-2023-26570 | High | 7.5 | 2023-10-25 | Missing authentication in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data… |
CVE-2023-43045 | Medium | 5.9 | 2023-10-23 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM… |
CVE-2023-22101 | High | 8.1 | 2023-10-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2023-22087 | High | 8.8 | 2023-10-17 | Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). The supported version that is affec… |
CVE-2023-22072 | Critical | 9.8 | 2023-10-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.3.0. Easi… |
CVE-2023-22069 | Critical | 9.8 | 2023-10-17 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2023-44116 | Critical | 9.8 | 2023-10-11 | Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may cause some apps to ru… |
CVE-2023-43271 | Critical | 9.1 | 2023-10-09 | Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other p… |
CVE-2023-4884 | Medium | 6.5 | 2023-10-03 | An attacker could send an HTTP request to an Open5GS endpoint and retrieve the information stored on the device due to the lack of Authentication. |
CVE-2023-4506 | Low | 2.2 | 2023-09-27 | The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due t… |
CVE-2023-4505 | Low | 2.2 | 2023-09-27 | The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This… |
CVE-2023-44152 | Critical | 9.1 | 2023-09-27 | Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Linux, macOS… |
CVE-2023-41333 | Medium | 6.9 | 2023-09-27 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to create or modify CiliumNetworkPolicy… |
CVE-2023-36851 | Medium | 5.3 | 2023-09-27 | A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to ca… |
CVE-2023-43644 | Critical | 9.1 | 2023-09-25 | Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This a… |
CVE-2023-42793 | Critical | 9.8 | 2023-09-19 | In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible |
CVE-2023-4702 | Critical | 9.8 | 2023-09-14 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Yepas Digital Yepas allows Authentication Bypass. This issue affects Digital Yepas… |
CVE-2023-4516 | High | 7.8 | 2023-09-14 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update Service that could allow a local attacker to change update sou… |
CVE-2023-41367 | Medium | 5.3 | 2023-09-12 | Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided Procedures) - version 7.50, can gain access to admi… |
CVE-2023-4815 | High | 8.8 | 2023-09-07 | Missing Authentication for Critical Function in GitHub repository answerdev/answer prior to v1.1.3. |
CVE-2023-31132 | High | 7.8 | 2023-09-05 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulnerability. A low-pri… |
CVE-2023-39981 | High | 7.5 | 2023-09-02 | A vulnerability that allows for unauthorized access has been discovered in MXsecurity versions prior to v1.0.1. This vulnerability arises from inadequate authe… |
CVE-2023-34392 | High | 8.2 | 2023-08-31 | A Missing Authentication for Critical Function vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker… |
CVE-2023-40598 | High | 8.5 | 2023-08-30 | In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can… |
CVE-2023-40170 | Medium | 4.6 | 2023-08-28 | jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file conten… |
CVE-2023-38030 | High | 7.5 | 2023-08-28 | Saho’s attendance devices ADM100 and ADM-100FP have a vulnerability of missing authentication for critical functions. An unauthenticated remote attacker can e… |
CVE-2023-38028 | Critical | 9.1 | 2023-08-28 | Saho’s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass a… |
CVE-2023-40585 | High | 7.3 | 2023-08-25 | ironic-image is a container image to run OpenStack Ironic as part of Metal³. Prior to version capm3-v1.4.3, if Ironic is not deployed with TLS and it does not… |
CVE-2023-38422 | High | 7.5 | 2023-08-23 | Walchem Intuition 9 firmware versions prior to v4.21 are missing authentication for some of the API routes of the management web server. This could allow an at… |
CVE-2023-36847 | Medium | 5.3 | 2023-08-17 | A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cau… |
CVE-2023-36846 | Medium | 5.3 | 2023-08-17 | A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to ca… |