CWE-306 · Missing Authentication for Critical Function (page 23)
Page 23 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-46009 | Critical | 9.8 | 2022-03-30 | In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without c… |
CVE-2021-46006 | Medium | 6.5 | 2022-03-30 | In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple se… |
CVE-2021-3589 | High | 8.0 | 2022-03-23 | An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through… |
CVE-2022-23345 | High | 7.5 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control. |
CVE-2021-45878 | Critical | 9.1 | 2022-03-21 | Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by incorrect access control. Lack of access control on the web manger pages allows any user to view… |
CVE-2022-26267 | High | 7.5 | 2022-03-18 | Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php. |
CVE-2022-22652 | Medium | 6.1 | 2022-03-18 | The GSMA authentication panel could be presented on the lock screen. The issue was resolved by requiring device unlock to interact with the GSMA authentication… |
CVE-2022-26501 | Critical | 9.8 | 2022-03-17 | Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). |
CVE-2021-44262 | High | 7.5 | 2022-03-17 | A vulnerability is in the 'MNU_top.htm' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this page without any a… |
CVE-2021-44261 | Medium | 5.3 | 2022-03-17 | A vulnerability is in the 'BRS_top.html' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this page without any… |
CVE-2021-44260 | High | 7.5 | 2022-03-17 | A vulnerability is in the 'live_mfg.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this pa… |
CVE-2021-44259 | Critical | 9.8 | 2022-03-17 | A vulnerability is in the 'wx.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this page wit… |
CVE-2022-25251 | Critical | 9.8 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML mess… |
CVE-2022-25250 | High | 7.5 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain comman… |
CVE-2022-25247 | Critical | 9.8 | 2022-03-16 | Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authen… |
CVE-2021-33658 | High | 7.8 | 2022-03-11 | atune before 0.3-0.8 log in as a local user and run the curl command to access the local atune url interface to escalate the local privilege or modify any file… |
CVE-2022-25508 | High | 7.5 | 2022-03-11 | An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via… |
CVE-2022-26143 | Critical | 9.8 | 2022-03-10 | The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive i… |
CVE-2022-25922 | Medium | 6.1 | 2022-03-10 | Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is… |
CVE-2022-24396 | High | 7.8 | 2022-03-10 | The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localho… |
CVE-2022-20060 | Medium | 6.6 | 2022-03-10 | In preloader (usb), there is a possible permission bypass due to a missing proper image authentication. This could lead to local escalation of privilege, for a… |
CVE-2021-46384 | Critical | 9.8 | 2022-03-04 | https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template… |
CVE-2022-25359 | Critical | 9.1 | 2022-02-26 | On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, delete, or create files. |
CVE-2020-10640 | Critical | 10.0 | 2022-02-24 | Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a… |
CVE-2021-46371 | High | 7.5 | 2022-02-14 | antd-admin 5.5.0 is affected by an incorrect access control vulnerability. Unauthorized access to some interfaces in the foreground leads to leakage of sensiti… |
CVE-2021-45420 | Critical | 9.8 | 2022-02-14 | Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_u… |
CVE-2022-0188 | Medium | 5.3 | 2022-02-14 | The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout. |
CVE-2021-22823 | Critical | 9.1 | 2022-02-11 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IG… |
CVE-2021-22805 | Critical | 9.1 | 2022-02-11 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IG… |
CVE-2021-31814 | Medium | 6.1 | 2022-02-10 | In Stormshield 1.1.0, and 2.1.0 through 2.9.0, an attacker can block a client from accessing the VPN and can obtain sensitive information through the SN VPN SS… |
CVE-2022-24111 | Medium | 5.3 | 2022-02-10 | In Mahara 21.04 before 21.04.3 and 21.10 before 21.10.1, portfolios created in groups that have not been shared with non-group members and portfolios created o… |
CVE-2022-22809 | Medium | 5.3 | 2022-02-09 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized mann… |
CVE-2022-21816 | Medium | 5.5 | 2022-02-07 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can cause a GPU interrupt storm on the hyper… |
CVE-2021-21964 | High | 7.4 | 2022-02-04 | A denial of service vulnerability exists in the Modbus configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network… |
CVE-2021-44255 | High | 7.2 | 2022-01-31 | Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containi… |
CVE-2021-26264 | Medium | 6.1 | 2022-01-28 | A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-service condition. |
CVE-2021-34870 | Medium | 6.5 | 2022-01-25 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 1.0.0.52_1.0.38 routers. Aut… |
CVE-2022-23945 | High | 7.5 | 2022-01-25 | Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1. |
CVE-2022-23944 | Critical | 9.1 | 2022-01-25 | User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1. |
CVE-2021-33843 | Medium | 5.3 | 2022-01-21 | Fresenius Kabi Agilia SP MC WiFi vD25 and prior has a default configuration page accessible without authentication. An attacker may use this functionality to c… |
CVE-2022-23220 | High | 7.8 | 2022-01-21 | USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_an… |
CVE-2021-23843 | High | 8.8 | 2022-01-19 | The Bosch software tools AccessIPConfig.exe and AmcIpConfig.exe are used to configure certains settings in AMC2 devices. The tool allows putting a password pro… |
CVE-2021-35587 | Critical | 9.8 | 2022-01-19 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0… |
CVE-2022-21691 | Medium | 4.3 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2021-28506 | Critical | 9.1 | 2022-01-14 | An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a f… |
CVE-2022-23227 | Critical | 9.8 | 2022-01-14 | NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lac… |
CVE-2021-43974 | Medium | 5.3 | 2022-01-11 | An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side se… |
CVE-2021-43832 | Critical | 10.0 | 2022-01-04 | Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an… |
CVE-2021-43333 | Medium | 6.5 | 2022-01-01 | The Datalogic DXU service on (for example) DL-Axist devices does not require authentication for configuration changes or disclosure of configuration settings. |
CVE-2021-20161 | Medium | 6.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. A malicious actor with physical access to the devic… |
CVE-2021-20158 | Critical | 9.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauthenticated, malicous actor to force the… |
CVE-2021-20152 | Medium | 6.5 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 lacks proper authentication to the bittorrent functionality. If enabled, anyone is able to visit and modify settings… |
CVE-2021-20150 | Medium | 5.3 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. Authentication can be bypassed and a user ma… |
CVE-2021-45232 | Critical | 9.8 | 2021-12-27 | In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and… |
CVE-2021-36780 | High | 8.1 | 2021-12-17 | A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance gra… |
CVE-2021-36779 | Critical | 9.6 | 2021-12-17 | A Missing Authentication for Critical Function vulnerability in SUSE Longhorn allows any workload in the cluster to execute any binary present in the image on… |
CVE-2021-36888 | Critical | 9.8 | 2021-12-15 | Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPr… |
CVE-2021-22279 | Critical | 9.8 | 2021-12-13 | A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and modify files on the robot controller if th… |
CVE-2021-44152 | Critical | 9.8 | 2021-12-13 | An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user c… |
CVE-2021-34543 | High | 7.5 | 2021-12-07 | The web administration server in Solar-Log 500 before 2.8.2 Build 52 does not require authentication, which allows remote attackers to gain administrative priv… |
CVE-2021-38283 | High | 7.5 | 2021-11-29 | Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read application log files containing sensitive information via a predictable /… |
CVE-2021-38147 | High | 7.5 | 2021-11-29 | Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information, bec… |
CVE-2021-44077 | Critical | 9.8 | 2021-11-29 | Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remot… |
CVE-2021-42783 | Critical | 9.8 | 2021-11-23 | Missing Authentication for Critical Function vulnerability in debug_post_set.cgi of D-Link DWR-932C E1 firmware allows an unauthenticated attacker to execute a… |
CVE-2021-39233 | Critical | 9.1 | 2021-11-19 | In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client. |
CVE-2021-41266 | High | 8.6 | 2021-11-15 | Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to… |
CVE-2021-20136 | Critical | 9.8 | 2021-11-01 | ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An unauthenticated remote… |
CVE-2021-33259 | Medium | 5.3 | 2021-10-31 | Several web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access, allowing for attackers to obtain users' DNS query history. |
CVE-2021-41157 | Medium | 5.3 | 2021-10-26 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2021-37624 | High | 7.5 | 2021-10-25 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2021-42539 | High | 8.0 | 2021-10-22 | The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to account take over and unapproved settings c… |
CVE-2021-38457 | Critical | 9.8 | 2021-10-22 | The server permits communication without any authentication procedure, allowing the attacker to initiate a session with the server without providing any form o… |
CVE-2021-27395 | High | 8.1 | 2021-10-12 | A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6)… |
CVE-2021-41976 | Medium | 5.3 | 2021-10-08 | Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folder names in the book li… |
CVE-2021-41975 | High | 7.5 | 2021-10-08 | TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files in the system witho… |
CVE-2021-41974 | Critical | 9.1 | 2021-10-08 | Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books wi… |
CVE-2021-41568 | Medium | 5.3 | 2021-10-08 | Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and… |
CVE-2021-35979 | High | 8.1 | 2021-10-08 | An issue was discovered in Digi RealPort through 4.8.488.0. The 'encrypted' mode is vulnerable to man-in-the-middle attacks and does not perform authentication. |
CVE-2021-23858 | High | 8.6 | 2021-10-04 | Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accesse… |
CVE-2021-39879 | Low | 2.2 | 2021-10-04 | Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authenti… |
CVE-2021-3825 | Critical | 9.6 | 2021-10-01 | On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the confi… |
CVE-2021-41104 | High | 7.5 | 2021-09-28 | ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to a… |
CVE-2021-22012 | High | 7.5 | 2021-09-23 | The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor with network access t… |
CVE-2021-37420 | Medium | 6.5 | 2021-09-21 | Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing. |
CVE-2021-38412 | Critical | 9.6 | 2021-09-17 | Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication… |
CVE-2019-10941 | Medium | 5.3 | 2021-09-14 | A vulnerability has been identified in SINEMA Server (All versions < V14 SP3). Missing authentication for functionality that requires administrative user ident… |
CVE-2021-33543 | Critical | 9.8 | 2021-09-13 | Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authenticati… |
CVE-2021-28913 | Critical | 9.8 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /webif/SecurityModule to validate the so called and hard coded un… |
CVE-2021-38540 | Critical | 9.8 | 2021-09-09 | The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/mod… |
CVE-2021-32800 | High | 8.1 | 2021-09-07 | Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus… |
CVE-2021-37415 | Critical | 9.8 | 2021-09-01 | Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. |
CVE-2021-27668 | Medium | 5.3 | 2021-08-31 | HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3. |
CVE-2021-33882 | Medium | 6.8 | 2021-08-25 | A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from… |
CVE-2021-39144 | High | 8.5 | 2021-08-23 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient righ… |
CVE-2021-31868 | Medium | 4.3 | 2021-08-19 | Rapid7 Nexpose version 6.6.95 and earlier allows authenticated users of the Security Console to view and edit any ticket in the legacy ticketing feature, regar… |
CVE-2021-35936 | Medium | 5.3 | 2021-08-16 | If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is li… |
CVE-2021-37697 | High | 7.1 | 2021-08-11 | tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user to access sensitive… |
CVE-2021-37696 | High | 7.1 | 2021-08-11 | tmerc-cogs are a collection of open source plugins for the Red Discord bot. A vulnerability has been found in the code that allows any user to access sensitive… |
CVE-2020-25566 | Critical | 9.8 | 2021-08-11 | In SapphireIMS 5.0, it is possible to take over an account by sending a request to the Save_Password form as shown in POC. Notice that we do not require a JSES… |
CVE-2020-25563 | Critical | 9.8 | 2021-08-11 | In SapphireIMS 5.0, it is possible to create local administrator on any client without requiring any credentials by directly accessing RemoteMgmtTaskSave (Auto… |