CWE-306 · Missing Authentication for Critical Function (page 22)
Page 22 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36780 | Medium | 4.9 | 2022-09-13 | Avdor CIS - crystal quality Credentials Management Errors. The product is phone call recorder, you can hear all the recorded calls without authenticate to the… |
CVE-2022-35572 | High | 7.5 | 2022-09-12 | On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /SysInfo.htm URI does n… |
CVE-2022-26394 | Medium | 5.5 | 2022-09-09 | The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack t… |
CVE-2022-1368 | Critical | 9.8 | 2022-09-06 | The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, whic… |
CVE-2022-31176 | High | 8.3 | 2022-09-02 | Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An interna… |
CVE-2022-36604 | High | 7.5 | 2022-09-01 | An access control issue in Canaan Avalon ASIC Miner 2020.3.30 and below allows unauthenticated attackers to arbitrarily change user passwords via a crafted POS… |
CVE-2022-36619 | High | 7.5 | 2022-08-31 | In D-link DIR-816 A2_v1.10CNB04.img,the network can be reset without authentication via /goform/setMAC. |
CVE-2022-30317 | Critical | 9.1 | 2022-08-31 | Honeywell Experion LX through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0055, there is a Honeywell Experion LX Cont… |
CVE-2022-37680 | High | 7.5 | 2022-08-29 | An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring system (Camera, Decoder and Encoder) and bel… |
CVE-2022-36521 | High | 7.5 | 2022-08-26 | Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts. |
CVE-2022-35733 | Critical | 9.8 | 2022-08-23 | Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders (UDR-JA1004/JA1008/JA1016 firmware versions v1.0.20.13 a… |
CVE-2022-34858 | Critical | 9.8 | 2022-08-22 | Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress. |
CVE-2022-2552 | Medium | 5.3 | 2022-08-22 | The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software… |
CVE-2022-37062 | High | 7.5 | 2022-08-18 | All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are affected by an insecure design vulnerability due to an improper directory access re… |
CVE-2022-35122 | Critical | 9.1 | 2022-08-17 | An access control issue in Ecowitt GW1100 Series Weather Stations <=GW1100B_v2.1.5 allows unauthenticated attackers to access sensitive information including d… |
CVE-2022-2765 | Medium | 6.3 | 2022-08-11 | A vulnerability was found in SourceCodester Company Website CMS 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2022-2242 | Critical | 9.8 | 2022-08-10 | The KUKA SystemSoftware V/KSS in versions prior to 8.6.5 is prone to improper access control as an unauthorized attacker can directly read and write robot conf… |
CVE-2022-35865 | Critical | 9.8 | 2022-08-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109. Authentication is not required to… |
CVE-2022-30313 | High | 7.5 | 2022-07-28 | Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0051, there is a Honeywell… |
CVE-2022-36884 | Medium | 5.3 | 2022-07-27 | The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an at… |
CVE-2022-36129 | Critical | 9.1 | 2022-07-26 | HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abuse… |
CVE-2022-30276 | High | 7.5 | 2022-07-26 | The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 omit an authentication requirement. They feature IP Gateway modules which allow for interfacing bet… |
CVE-2022-29957 | High | 7.8 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety… |
CVE-2022-29952 | Critical | 9.1 | 2022-07-26 | Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP… |
CVE-2022-29951 | Critical | 9.1 | 2022-07-26 | JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol (configurable on ports 1024-65534 on either TCP or UDP) f… |
CVE-2022-35871 | High | 7.8 | 2022-07-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentic… |
CVE-2022-2138 | High | 8.2 | 2022-07-22 | The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute arbitrary code, resu… |
CVE-2021-36200 | Medium | 5.3 | 2022-07-22 | Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 1… |
CVE-2022-34767 | Medium | 5.9 | 2022-07-21 | Web page which "wizardpwd.asp" ALLNET Router model WR0500AC is prone to Authorization bypass vulnerability – the password, located at "admin" allows changing t… |
CVE-2022-20861 | Critical | 9.8 | 2022-07-21 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image… |
CVE-2022-20858 | Critical | 9.8 | 2022-07-21 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image… |
CVE-2022-20857 | Critical | 9.8 | 2022-07-21 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image… |
CVE-2022-2141 | Critical | 9.8 | 2022-07-20 | SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication. |
CVE-2022-28809 | High | 7.8 | 2022-07-17 | An issue was discovered in Open Design Alliance Drawings SDK before 2023.3. An Out-of-Bounds Read vulnerability exists when reading a DWG file with an invalid… |
CVE-2022-31260 | Medium | 6.5 | 2022-07-17 | In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a non-NULL k value. |
CVE-2021-34538 | High | 7.5 | 2022-07-16 | Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found tha… |
CVE-2022-28771 | High | 7.5 | 2022-07-12 | Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send malicious http requests ove… |
CVE-2022-33138 | High | 7.5 | 2022-07-12 | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIM… |
CVE-2021-44222 | Critical | 9.1 | 2022-07-12 | A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The underlying MQTT service of affected systems does not perform aut… |
CVE-2022-23719 | High | 7.2 | 2022-06-30 | PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the abi… |
CVE-2022-31266 | Medium | 4.3 | 2022-06-29 | In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounts. |
CVE-2022-29270 | Medium | 4.3 | 2022-06-29 | In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address. |
CVE-2022-1521 | Critical | 9.1 | 2022-06-24 | LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data. |
CVE-2021-26637 | High | 8.8 | 2022-06-23 | There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unauthorized users can… |
CVE-2022-21952 | High | 7.5 | 2022-06-22 | A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to e… |
CVE-2022-24562 | Critical | 9.8 | 2022-06-16 | In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-s… |
CVE-2021-41418 | Critical | 9.8 | 2022-06-15 | AriaNg v0.1.0~v1.2.2 is affected by an incorrect access control vulnerability through not authenticating visitors' access rights. |
CVE-2022-32157 | High | 7.5 | 2022-06-15 | Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the depl… |
CVE-2022-32557 | High | 7.5 | 2022-06-14 | An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers. |
CVE-2022-32251 | High | 8.8 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). There is a missing authentication verification for a resource used t… |
CVE-2022-30230 | Critical | 9.8 | 2022-06-14 | A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does not require authenticated access for pri… |
CVE-2022-30229 | High | 7.2 | 2022-06-14 | A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does not require authenticated access for pri… |
CVE-2022-29226 | Critical | 10.0 | 2022-06-09 | Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access… |
CVE-2022-1598 | Medium | 5.3 | 2022-06-08 | The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticate… |
CVE-2021-42893 | High | 7.5 | 2022-06-03 | In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization through getSysStatusCfg. |
CVE-2021-42891 | High | 7.5 | 2022-06-03 | In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization. |
CVE-2021-42889 | High | 7.5 | 2022-06-03 | In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, wifiname, etc.) without authorization. |
CVE-2022-31461 | High | 7.4 | 2022-06-02 | Owl Labs Meeting Owl 5.2.0.15 allows attackers to deactivate the passcode protection mechanism via a certain c 11 message. |
CVE-2022-26971 | Medium | 5.3 | 2022-06-02 | Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. This upload can be… |
CVE-2022-31022 | Medium | 6.2 | 2022-06-01 | Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pa… |
CVE-2022-22576 | High | 8.1 | 2022-05-26 | An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properl… |
CVE-2022-27169 | High | 7.5 | 2022-05-25 | An information disclosure vulnerability exists in the OAS Engine SecureBrowseFile functionality of Open Automation Software OAS Platform V16.00.0112. A special… |
CVE-2022-26833 | Critical | 9.4 | 2022-05-25 | An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series… |
CVE-2022-26303 | High | 7.5 | 2022-05-25 | An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Software OAS Platform V16.00.0112. A specially… |
CVE-2022-26082 | Critical | 9.1 | 2022-05-25 | A file write vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted… |
CVE-2022-26067 | Medium | 4.9 | 2022-05-25 | An information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A spec… |
CVE-2022-26043 | High | 7.5 | 2022-05-25 | An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Software OAS Platform V16.00.0112. A speci… |
CVE-2022-26026 | High | 7.5 | 2022-05-25 | A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software OAS Platform V16.00.0112. A specially-c… |
CVE-2022-29402 | Medium | 6.8 | 2022-05-25 | TP-Link TL-WR840N EU v6.20 was discovered to contain insecure protections for its UART console. This vulnerability allows attackers to connect to the UART port… |
CVE-2022-22309 | Medium | 6.8 | 2022-05-24 | The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more critical if the serial port… |
CVE-2022-28660 | Critical | 9.8 | 2022-05-20 | The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1… |
CVE-2022-29883 | Medium | 5.3 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not restrict unauthenticated access to certain pages of the web inter… |
CVE-2022-29881 | Medium | 5.3 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access pro… |
CVE-2022-29879 | Medium | 4.3 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access pro… |
CVE-2022-29877 | Medium | 6.5 | 2022-05-20 | A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All… |
CVE-2022-26925 | High | 8.1 | 2022-05-10 | Windows LSA Spoofing Vulnerability |
CVE-2022-0424 | Medium | 5.3 | 2022-05-09 | The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers… |
CVE-2022-27495 | Medium | 6.5 | 2022-05-05 | On all versions 1.3.x (fixed in 1.4.0) NGINX Service Mesh control plane endpoints are exposed to the cluster overlay network. Note: Software versions which hav… |
CVE-2022-1388 | Critical | 9.8 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all… |
CVE-2022-1300 | Critical | 9.8 | 2022-05-02 | Multiple Version of TRUMPF TruTops products expose a service function without necessary authentication. Execution of this function may result in unauthorized a… |
CVE-2022-29934 | High | 7.8 | 2022-04-29 | USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE: this is not an Or… |
CVE-2022-24935 | High | 7.5 | 2022-04-28 | Lexmark products through 2022-02-10 have Incorrect Access Control. |
CVE-2022-28719 | Critical | 9.8 | 2022-04-28 | Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker with some knowledge on the system config… |
CVE-2022-27332 | Critical | 9.1 | 2022-04-27 | An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication. This vulnerability can allow attackers… |
CVE-2021-25094 | High | 8.1 | 2022-04-25 | The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under… |
CVE-2022-0993 | High | 8.1 | 2022-04-19 | The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to… |
CVE-2022-0992 | Critical | 9.8 | 2022-04-19 | The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to… |
CVE-2022-0878 | Medium | 4.6 | 2022-04-12 | Electric Vehicle (EV) commonly utilises the Combined Charging System (CCS) for DC rapid charging. To exchange important messages such as the State of Charge (S… |
CVE-2022-0140 | Medium | 5.3 | 2022-04-12 | The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entr… |
CVE-2022-24829 | High | 8.1 | 2022-04-11 | Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In som… |
CVE-2022-24820 | Medium | 5.3 | 2022-04-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wi… |
CVE-2021-43483 | High | 8.0 | 2022-04-08 | An Access Control vulnerability exists in CLARO KAON CG3000 1.00.67 in the router configuration, which could allow a malicious user to read or update the confi… |
CVE-2020-27376 | High | 8.8 | 2022-04-07 | Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Missing Authentication. |
CVE-2022-1248 | High | 7.3 | 2022-04-06 | A vulnerability was found in SAP Information System 1.0 which has been rated as critical. Affected by this issue is the file /SAP_Information_System/controller… |
CVE-2022-25245 | Medium | 5.3 | 2022-04-05 | Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name. |
CVE-2021-33008 | High | 8.8 | 2022-04-04 | AVEVA System Platform versions 2017 through 2020 R2 P01 does not perform any authentication for functionality that requires a provable user identity. |
CVE-2022-0922 | Medium | 6.5 | 2022-04-01 | The software does not perform any authentication for critical system functionality. |
CVE-2021-20238 | Low | 3.7 | 2022-04-01 | It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without auth… |
CVE-2020-14479 | Medium | 5.3 | 2022-04-01 | Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the s… |
CVE-2022-25008 | High | 8.8 | 2022-03-30 | totolink EX300_v2 V4.0.3c.140_B20210429 and EX1200T V4.1.2cu.5230_B20210706 does not contain an authentication mechanism. |