CWE-306 · Missing Authentication for Critical Function (page 21)
Page 21 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25570 | High | 7.5 | 2023-02-20 | Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservice to the internet… |
CVE-2023-0919 | High | 8.1 | 2023-02-19 | Missing Authentication for Critical Function in GitHub repository kareadita/kavita prior to 0.7.0. |
CVE-2023-0906 | High | 7.3 | 2023-02-18 | A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. Affected by this vulnerability is the function delete_cate… |
CVE-2022-47703 | High | 7.5 | 2023-02-16 | TIANJIE CPE906-3 is vulnerable to password disclosure. This is present on Software Version WEB5.0_LCD_20200513, Firmware Version MV8.003, and Hardware Version… |
CVE-2022-27891 | Medium | 5.3 | 2023-02-16 | Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patc… |
CVE-2023-22804 | Critical | 9.1 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use… |
CVE-2023-22803 | High | 7.5 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the PLC. This could allow an attacker to c… |
CVE-2023-0102 | Critical | 9.1 | 2023-02-15 | LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker to delete arbitrary… |
CVE-2022-48300 | High | 7.5 | 2023-02-09 | The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-48299 | High | 7.5 | 2023-02-09 | The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-48289 | High | 7.5 | 2023-02-09 | The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidenti… |
CVE-2022-48288 | High | 7.5 | 2023-02-09 | The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this vulnerability may affect data confidenti… |
CVE-2022-43761 | Critical | 9.4 | 2023-02-08 | Missing authentication when creating and managing the B&R APROL database in versions < R 4.2-07 allows reading and changing the system configuration. … |
CVE-2022-45190 | Medium | 5.3 | 2023-02-08 | An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can bypass passkey entry in the legacy pairing of the device. |
CVE-2022-24990 | High | 7.5 | 2023-02-07 | TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNa… |
CVE-2022-3229 | Critical | 9.8 | 2023-02-06 | Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker ca… |
CVE-2021-37234 | Medium | 6.5 | 2023-02-03 | Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive inform… |
CVE-2023-25014 | High | 8.6 | 2023-02-02 | An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationContr… |
CVE-2023-25013 | High | 8.6 | 2023-02-02 | An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationContr… |
CVE-2022-42970 | Critical | 9.8 | 2023-02-01 | A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identi… |
CVE-2022-32528 | High | 8.6 | 2023-01-30 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and read specific files in the IGSS project… |
CVE-2023-0463 | Low | 3.3 | 2023-01-26 | The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022.3.30 allows a user… |
CVE-2022-41505 | Medium | 6.4 | 2023-01-23 | An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by connecting to the UART pins, interruptin… |
CVE-2021-43447 | High | 7.5 | 2023-01-23 | ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit docu… |
CVE-2023-0052 | Critical | 9.8 | 2023-01-20 | SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allows the execution of commands without cre… |
CVE-2020-23256 | Critical | 9.8 | 2023-01-20 | An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service. |
CVE-2020-22661 | Medium | 6.5 | 2023-01-20 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199… |
CVE-2022-3738 | Medium | 5.9 | 2023-01-19 | The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like… |
CVE-2023-21856 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Supported versions that are affec… |
CVE-2023-21842 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.3… |
CVE-2023-21839 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2023-21837 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2022-46732 | Critical | 9.8 | 2023-01-18 | Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status. |
CVE-2022-43976 | Critical | 9.8 | 2023-01-17 | An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. Direct access to the API is possible on TCP p… |
CVE-2022-42277 | High | 7.5 | 2023-01-13 | NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may le… |
CVE-2022-42276 | High | 7.5 | 2023-01-13 | NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead… |
CVE-2022-42275 | High | 7.7 | 2023-01-13 | NVIDIA BMC IPMI handler allows an unauthenticated host to write to a host SPI flash bypassing secureboot protections. This may lead to a loss of integrity and… |
CVE-2022-46463 | High | 7.5 | 2023-01-13 | An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's… |
CVE-2023-21743 | Medium | 5.3 | 2023-01-10 | Microsoft SharePoint Server Security Feature Bypass Vulnerability |
CVE-2022-45433 | Low | 3.7 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated traceroute host from remote DSS Server. After bypassing the firewall access control policy… |
CVE-2022-45432 | Medium | 5.3 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated search for devices. After bypassing the firewall access control policy, by sending a speci… |
CVE-2022-45424 | Medium | 5.3 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain the AES crypto key by sending a specific… |
CVE-2022-45423 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending… |
CVE-2022-44013 | Critical | 9.1 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can make various API calls without authentication because the password in a Crede… |
CVE-2022-3188 | Medium | 5.3 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where unauthenticated users could open PHP index pages without authentication an… |
CVE-2022-47377 | Critical | 9.8 | 2022-12-16 | Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the… |
CVE-2022-31701 | Medium | 5.3 | 2022-12-14 | VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this issue to be in the Mo… |
CVE-2022-41272 | Critical | 9.9 | 2022-12-13 | An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Int… |
CVE-2022-41271 | Critical | 9.4 | 2022-12-13 | An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50… |
CVE-2022-45504 | High | 7.5 | 2022-12-08 | An issue in the component tpi_systool_handle(0) (/goform/SysToolRestoreSet) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to arbitrarily reboot… |
CVE-2022-45498 | High | 7.5 | 2022-12-08 | An issue in the component tpi_systool_handle(0) (/goform/SysToolReboot) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to arbitrarily reboot the… |
CVE-2022-45481 | Critical | 9.8 | 2022-12-05 | The default configuration of Lazy Mouse does not require a password, allowing remote unauthenticated users to execute arbitrary code with no prior authorizatio… |
CVE-2022-45479 | Critical | 9.8 | 2022-12-05 | PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authenticati… |
CVE-2022-45477 | Critical | 9.8 | 2022-12-05 | Telepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authentication… |
CVE-2022-46414 | Critical | 9.8 | 2022-12-04 | An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Unauthenticated remote command execution can occur vi… |
CVE-2022-46145 | High | 8.1 | 2022-12-02 | authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account tak… |
CVE-2022-4229 | High | 7.3 | 2022-11-30 | A vulnerability classified as critical was found in SourceCodester Book Store Management System 1.0. This vulnerability affects unknown code of the file /bsms_… |
CVE-2022-4228 | Medium | 5.3 | 2022-11-30 | A vulnerability classified as problematic has been found in SourceCodester Book Store Management System 1.0. This affects an unknown part of the file /bsms_ci/… |
CVE-2022-24190 | High | 7.5 | 2022-11-28 | The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The user_token header is not implemented or p… |
CVE-2022-45933 | Critical | 9.8 | 2022-11-27 | KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieve… |
CVE-2022-44784 | High | 8.8 | 2022-11-21 | An issue was discovered in Appalti & Contratti 9.12.2. The target web applications LFS and DL229 expose a set of services provided by the Axis 1.4 instance, em… |
CVE-2022-44001 | Critical | 9.8 | 2022-11-17 | An issue was discovered in BACKCLICK Professional 5.9.63. User authentication for accessing the CORBA back-end services can be bypassed. |
CVE-2022-42982 | High | 7.5 | 2022-11-17 | BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP sourcetable is typically quite long (te… |
CVE-2022-44000 | Critical | 9.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system comma… |
CVE-2022-43999 | Critical | 9.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to exposed CORBA management services, arbitrary system commands can be executed on the server. |
CVE-2022-4018 | Medium | 4.3 | 2022-11-16 | Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6. |
CVE-2022-42785 | Critical | 9.8 | 2022-11-15 | Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the pas… |
CVE-2022-45378 | Critical | 9.8 | 2022-11-14 | In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods… |
CVE-2021-46852 | High | 7.5 | 2022-11-09 | The memory management module has the logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-30515 | Medium | 5.3 | 2022-11-08 | ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration. |
CVE-2022-38168 | Critical | 9.1 | 2022-11-03 | Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the l… |
CVE-2022-3675 | Low | 2.6 | 2022-11-03 | Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB comm… |
CVE-2022-42473 | Medium | 5.3 | 2022-11-02 | A missing authentication for a critical function vulnerability in Fortinet FortiSOAR 6.4.0 - 6.4.4 and 7.0.0 - 7.0.3 and 7.2.0 allows an attacker to disclose i… |
CVE-2022-43990 | High | 7.3 | 2022-11-01 | Password recovery vulnerability in SICK SIM1012 Partnumber 1098146 with firmware version <2.2.0 allows an unprivileged remote attacker to gain access to the us… |
CVE-2022-43989 | High | 7.3 | 2022-11-01 | Password recovery vulnerability in SICK SIM2x00 (ARM) Partnumber 1092673 and 1081902 with firmware version < 1.2.0 allows an unprivileged remote attacker to ga… |
CVE-2022-27586 | Critical | 9.8 | 2022-11-01 | Password recovery vulnerability in SICK SIM1004 Partnumber 1098148 with firmware version <2.0.0 allows an unprivileged remote attacker to gain access to the us… |
CVE-2022-27585 | Critical | 9.8 | 2022-11-01 | Password recovery vulnerability in SICK SIM1000 FX Partnumber 1097816 and 1097817 with firmware version <1.6.0 allows an unprivileged remote attacker to gain a… |
CVE-2022-27584 | Critical | 9.8 | 2022-11-01 | Password recovery vulnerability in SICK SIM2000ST Partnumber 1080579 allows an unprivileged remote attacker to gain access to the userlevel defined as Recovera… |
CVE-2022-27582 | Critical | 9.8 | 2022-11-01 | Password recovery vulnerability in SICK SIM4000 (PPC) Partnumber 1078787 allows an unprivileged remote attacker to gain access to the userlevel defined as Reco… |
CVE-2022-3312 | Medium | 4.6 | 2022-11-01 | Insufficient validation of untrusted input in VPN in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a local attacker to bypass managed device restric… |
CVE-2022-41776 | High | 7.5 | 2022-10-31 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration method, which could allo… |
CVE-2022-41688 | Critical | 9.8 | 2022-10-31 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lack proper authentication for functions that create and modify user groups. An attack… |
CVE-2022-41644 | High | 8.8 | 2022-10-31 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that changes group privileges. An attacker could… |
CVE-2022-41629 | High | 7.5 | 2022-10-31 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprunning endpoint, which could allow an att… |
CVE-2022-40202 | Critical | 9.8 | 2022-10-31 | The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide… |
CVE-2022-2474 | Critical | 9.8 | 2022-10-28 | Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allows any user on the s… |
CVE-2022-3674 | High | 7.3 | 2022-10-26 | A vulnerability has been found in SourceCodester Sanitization Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2022-38870 | High | 7.5 | 2022-10-25 | Free5gc v3.2.1 is vulnerable to Information disclosure. |
CVE-2022-27623 | High | 7.4 | 2022-10-25 | Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remo… |
CVE-2022-1070 | High | 8.2 | 2022-10-21 | Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. |
CVE-2022-3327 | Critical | 9.8 | 2022-10-20 | Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6. |
CVE-2020-23648 | High | 7.5 | 2022-10-19 | Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. Through system.asp / start_apply.htm, an attacker can change the administrator… |
CVE-2022-39426 | High | 8.1 | 2022-10-18 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Difficu… |
CVE-2022-39425 | High | 8.1 | 2022-10-18 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Difficu… |
CVE-2022-39412 | High | 7.5 | 2022-10-18 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Admin Console). The supported version that is affected is 12.2.1.4.0… |
CVE-2022-21587 | Critical | 9.8 | 2022-10-18 | Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected ar… |
CVE-2022-35136 | Medium | 6.5 | 2022-10-13 | Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests. |
CVE-2022-20830 | Medium | 5.3 | 2022-10-10 | A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticat… |
CVE-2022-38817 | High | 7.5 | 2022-10-03 | Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data. |
CVE-2022-22526 | Critical | 9.8 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a missing authentication allows for full access via API. |