CWE-306 · Missing Authentication for Critical Function (page 20)
Page 20 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4335 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux |
CVE-2023-4334 | High | 7.5 | 2023-08-15 | Broadcom RAID Controller Web server (nginx) is serving private files without any authentication |
CVE-2023-39380 | High | 7.5 | 2023-08-13 | Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause audio devices to perform abnormally. |
CVE-2023-38186 | High | 8.8 | 2023-08-08 | Windows Mobile Device Management Elevation of Privilege Vulnerability |
CVE-2023-37373 | Medium | 5.3 | 2023-08-08 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications accept unauthenticated file write messages. An unaut… |
CVE-2023-39436 | Medium | 5.8 | 2023-08-08 | SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM… |
CVE-2023-37483 | Critical | 9.8 | 2023-08-08 | SAP PowerDesigner - version 16.7, has improper access control which might allow an unauthenticated attacker to run arbitrary queries against the back-end datab… |
CVE-2023-36926 | Low | 3.7 | 2023-08-08 | Due to missing authentication check in SAP Host Agent - version 7.22, an unauthenticated attacker can set an undocumented parameter to a particular compatibili… |
CVE-2023-38523 | Medium | 5.3 | 2023-07-20 | The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the /tmp/ directory, without authentication, exposing sensitive… |
CVE-2023-22047 | High | 7.5 | 2023-07-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.59 and 8… |
CVE-2023-36669 | Critical | 9.8 | 2023-07-18 | Missing Authentication for a Critical Function within the Kratos NGC Indoor Unit (IDU) before 11.4 allows remote attackers to obtain arbitrary control of the I… |
CVE-2023-34329 | Critical | 9.1 | 2023-07-18 | AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vul… |
CVE-2023-37265 | Critical | 9.8 | 2023-07-17 | CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root`… |
CVE-2023-38379 | High | 7.5 | 2023-07-16 | The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to change the admin password via a zero-length… |
CVE-2023-35874 | Medium | 6.0 | 2023-07-11 | SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7… |
CVE-2023-35873 | Medium | 6.5 | 2023-07-11 | The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities… |
CVE-2023-35872 | Medium | 6.5 | 2023-07-11 | The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities… |
CVE-2023-30643 | High | 7.7 | 2023-07-06 | Missing authentication vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows local attackers to delete arbitrary non-preloaded applicat… |
CVE-2023-22906 | High | 8.8 | 2023-07-04 | Hero Qubo HCD01_02_V1.38_20220125 devices allow TELNET access with root privileges by default, without a password. |
CVE-2023-36347 | High | 7.5 | 2023-06-30 | A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data. |
CVE-2023-2834 | Critical | 9.8 | 2023-06-30 | The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the… |
CVE-2023-35830 | Critical | 9.8 | 2023-06-29 | STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TCG-4lite Connectivit… |
CVE-2023-34761 | Medium | 6.5 | 2023-06-28 | An unauthenticated attacker within BLE proximity can remotely connect to a 7-Eleven LED Message Cup, Hello Cup 1.3.1 for Android, and bypass the application's… |
CVE-2023-35854 | Critical | 9.8 | 2023-06-20 | Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity… |
CVE-2022-48496 | High | 7.5 | 2023-06-19 | Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to bec… |
CVE-2022-48494 | High | 7.5 | 2023-06-19 | Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to bec… |
CVE-2023-31411 | Critical | 9.8 | 2023-06-19 | A remote unprivileged attacker can modify and access configuration settings on the EventCam App due to the absence of API authentication. The lack of authentic… |
CVE-2023-27396 | Critical | 9.8 | 2023-06-19 | FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) networks, and is u… |
CVE-2023-31196 | High | 7.5 | 2023-06-13 | Missing authentication for critical function in Wi-Fi AP UNIT allows a remote unauthenticated attacker to obtain sensitive information of the affected products… |
CVE-2023-30762 | Critical | 9.8 | 2023-06-13 | Improper authentication vulnerability exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed o… |
CVE-2023-2827 | High | 7.9 | 2023-06-13 | SAP Plant Connectivity - version 15.5 (PCo) or the Production Connector for SAP Digital Manufacturing - version 1.0, do not validate the signature of the JSON… |
CVE-2023-34335 | High | 7.7 | 2023-06-12 | AMI BMC contains a vulnerability in the IPMI handler, where an unauthenticated host is allowed to write to a host SPI flash, bypassing secure boot protections… |
CVE-2023-33553 | Critical | 9.8 | 2023-06-07 | An issue in Planet Technologies WDRT-1800AX v1.01-CP21 allows attackers to bypass authentication and escalate privileges to root via manipulation of the LoginS… |
CVE-2023-2187 | Medium | 5.3 | 2023-06-07 | On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send broadcast events to any user via the WebMonitor.An unauthe… |
CVE-2020-36724 | Critical | 9.8 | 2023-06-07 | The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied has… |
CVE-2020-36713 | Critical | 9.8 | 2023-06-07 | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestricted access to the '… |
CVE-2023-2781 | High | 8.1 | 2023-06-03 | The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up to, and i… |
CVE-2023-34094 | High | 7.5 | 2023-06-02 | ChuanhuChatGPT is a graphical user interface for ChatGPT and many large language models. A vulnerability in versions 20230526 and prior allows unauthorized acc… |
CVE-2023-30604 | Critical | 9.8 | 2023-06-02 | It is identified a vulnerability of insufficient authentication in the system configuration interface of Hitron Technologies CODA-5310. An unauthorized remote… |
CVE-2023-25780 | Medium | 5.7 | 2023-06-02 | It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A LAN attacker with normal user privilege… |
CVE-2022-36249 | Medium | 5.4 | 2023-05-30 | Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are direc… |
CVE-2022-4240 | Medium | 6.5 | 2023-05-30 | Missing Authentication for Critical Function vulnerability in Honeywell OneWireless allows Authentication Bypass. This issue affects OneWireless version 322.1 |
CVE-2023-33247 | High | 7.5 | 2023-05-26 | Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the ser… |
CVE-2023-31227 | High | 7.5 | 2023-05-26 | The hwPartsDFR module has a vulnerability in API calling verification. Successful exploitation of this vulnerability may affect device confidentiality. |
CVE-2023-0116 | High | 7.5 | 2023-05-26 | The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerability may affect availability. |
CVE-2023-31594 | High | 7.5 | 2023-05-25 | IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via an exposed HTTP channel using VLC network. |
CVE-2023-1837 | High | 8.5 | 2023-05-23 | Missing Authentication for critical function vulnerability in HYPR Server allows Authentication Bypass when using Legacy APIs.This issue affects HYPR Server: b… |
CVE-2023-23545 | Medium | 5.3 | 2023-05-23 | Missing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may allow a remote unauthenticated attac… |
CVE-2023-2704 | Critical | 9.8 | 2023-05-19 | The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insufficient verificati… |
CVE-2023-32680 | Medium | 5.8 | 2023-05-18 | Metabase is an open source business analytics engine. To edit SQL Snippets, Metabase should have required people to be in at least one group with native query… |
CVE-2023-20003 | Medium | 4.7 | 2023-05-18 | A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adj… |
CVE-2023-1096 | Critical | 9.8 | 2023-05-12 | SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to gain ac… |
CVE-2023-23444 | High | 7.5 | 2023-05-12 | Missing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 1044072, 1044073, 104407… |
CVE-2023-23906 | High | 7.5 | 2023-05-10 | Missing authentication for critical function exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker… |
CVE-2023-22441 | High | 8.6 | 2023-05-10 | Missing authentication for critical function exists in Seiko Solutions SkyBridge series, which may allow a remote attacker to obtain or alter the setting infor… |
CVE-2023-31143 | Medium | 5.9 | 2023-05-09 | mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user… |
CVE-2023-30744 | High | 8.2 | 2023-05-09 | In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker can attach to an open interface and make use… |
CVE-2023-20126 | Critical | 9.8 | 2023-05-04 | A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an unauthenticated, remote attacker to execute arbitrar… |
CVE-2023-31444 | High | 7.5 | 2023-04-28 | In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of the microservice. T… |
CVE-2023-28697 | Critical | 9.8 | 2023-04-27 | Moxa MiiNePort E1 has a vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to perform arbitrary system… |
CVE-2022-40725 | High | 7.3 | 2023-04-25 | PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before th… |
CVE-2023-2231 | Critical | 9.8 | 2023-04-21 | A vulnerability, which was classified as critical, was found in MAXTECH MAX-G866ac 0.4.1_TBRO_20160314. This affects an unknown part of the component Remote Ma… |
CVE-2023-23451 | Critical | 9.8 | 2023-04-19 | The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN1 FLEXI ETHERN… |
CVE-2023-30612 | Medium | 4.0 | 2023-04-19 | Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors in the Cloud Hyperv… |
CVE-2023-29413 | High | 7.5 | 2023-04-18 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when accessed by an unauthenticated user on th… |
CVE-2023-29411 | Critical | 9.8 | 2023-04-18 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leading to potential remo… |
CVE-2023-21979 | High | 7.5 | 2023-04-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2023-21931 | High | 7.5 | 2023-04-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2023-27571 | Medium | 5.3 | 2023-04-15 | An issue was discovered in DG3450 Cable Gateway AR01.02.056.18_041520_711.NCS.10. The troubleshooting_logs_download.php log file download functionality does no… |
CVE-2023-24934 | Medium | 6.2 | 2023-04-14 | Microsoft Defender Security Feature Bypass Vulnerability |
CVE-2023-27747 | High | 7.5 | 2023-04-13 | BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authentication in its web server. This vulnerability allows attackers to access sensitive information… |
CVE-2022-41331 | Critical | 9.8 | 2023-04-11 | A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthentic… |
CVE-2023-28761 | Medium | 6.5 | 2023-04-11 | In SAP NetWeaver Enterprise Portal - version 7.50, an unauthenticated attacker can attach to an open interface and make use of an open API to access a service… |
CVE-2023-27497 | Critical | 10.0 | 2023-04-11 | Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute… |
CVE-2023-27267 | Critical | 9.0 | 2023-04-11 | Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep know… |
CVE-2023-24527 | Medium | 5.3 | 2023-04-11 | SAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user identity enabling an u… |
CVE-2020-14140 | High | 7.5 | 2023-03-29 | When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerability. This vulnerability is caused by th… |
CVE-2022-36983 | Critical | 9.8 | 2023-03-29 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit th… |
CVE-2022-27645 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 routers. Authentication is not requi… |
CVE-2023-28326 | Critical | 9.8 | 2023-03-28 | Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in a… |
CVE-2022-48291 | Medium | 6.5 | 2023-03-27 | The Bluetooth module has an authentication bypass vulnerability in the pairing process. Successful exploitation of this vulnerability may affect confidentialit… |
CVE-2023-1140 | Critical | 9.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability that could allow an attacker to achieve unauthenticated remote code… |
CVE-2023-24838 | Critical | 9.8 | 2023-03-27 | HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulnerability to obtain the administrator's… |
CVE-2023-28470 | Medium | 5.3 | 2023-03-23 | In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication. |
CVE-2023-27060 | Critical | 9.8 | 2023-03-22 | LightCMS v1.3.7 was discovered to contain a remote code execution (RCE) vulnerability via the image:make function. |
CVE-2023-25589 | Critical | 9.8 | 2023-03-22 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to create arbitrary users on t… |
CVE-2023-27983 | Medium | 6.5 | 2023-03-21 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of reports from the IGS… |
CVE-2023-27980 | High | 8.8 | 2023-03-21 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation of a malicious repo… |
CVE-2023-28461 | Critical | 9.8 | 2023-03-15 | Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using… |
CVE-2023-24526 | Medium | 5.3 | 2023-03-14 | SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user id… |
CVE-2023-27532 | High | 7.5 | 2023-03-10 | Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gainin… |
CVE-2023-27290 | Critical | 9.1 | 2023-03-03 | Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentic… |
CVE-2022-45551 | Critical | 9.8 | 2023-03-03 | An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command to the Network Diagn… |
CVE-2023-20857 | Medium | 6.8 | 2023-02-28 | VMware Workspace ONE Content contains a passcode bypass vulnerability. A malicious actor, with access to a users rooted device, may be able to bypass the VMwar… |
CVE-2022-45140 | Critical | 9.8 | 2023-02-27 | The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remot… |
CVE-2022-45138 | Critical | 9.8 | 2023-02-27 | The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. Th… |
CVE-2022-34908 | High | 8.2 | 2023-02-27 | An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It possesses an authentication mechanism; however, some features do not requ… |
CVE-2023-23453 | Critical | 9.8 | 2023-02-20 | Missing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary r… |
CVE-2023-23452 | Critical | 9.8 | 2023-02-20 | Missing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to achieve arbitrary r… |
CVE-2022-44216 | High | 7.5 | 2023-02-20 | Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password of all users without knowing victim's original password. |