CWE-306 · Missing Authentication for Critical Function (page 24)
Page 24 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-37843 | Critical | 9.8 | 2021-08-02 | The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known (i.e., no other authenti… |
CVE-2020-36239 | Critical | 9.8 | 2021-07-29 | Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Ji… |
CVE-2021-32794 | Medium | 6.8 | 2021-07-26 | ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code `POST /Api/ASF` A… |
CVE-2020-7389 | Medium | 5.5 | 2021-07-22 | Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web app… |
CVE-2021-22784 | Medium | 5.7 | 2021-07-21 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that could allow an attacker to use a crafted w… |
CVE-2021-22772 | Critical | 9.8 | 2021-07-21 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Easergy T200 ((IEC104)… |
CVE-2020-21936 | Medium | 5.3 | 2021-07-21 | An issue in HNAP1/GetMultipleHNAPs of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to access the components GetStationSettings, GetW… |
CVE-2020-21934 | High | 7.5 | 2021-07-21 | An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where authentication to download the Syslog could be bypassed. |
CVE-2021-36124 | Critical | 9.8 | 2021-07-13 | An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, le… |
CVE-2021-28809 | Critical | 9.8 | 2021-07-08 | An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability allows attackers to com… |
CVE-2021-20474 | High | 7.5 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does not perform any authentication for functionality that requires a provable user identity or consumes… |
CVE-2021-33221 | Critical | 9.8 | 2021-07-07 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Unauthenticated API Endpoints. |
CVE-2021-34621 | Critical | 9.8 | 2021-07-07 | A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible f… |
CVE-2021-20107 | Medium | 5.4 | 2021-06-30 | There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS. The vuln… |
CVE-2021-35941 | High | 7.5 | 2021-06-29 | Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrator API that can perform a system factory restore with… |
CVE-2021-31337 | Critical | 9.8 | 2021-06-28 | The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow a remote attacker t… |
CVE-2021-32709 | Medium | 4.9 | 2021-06-24 | Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current… |
CVE-2021-33346 | Critical | 9.8 | 2021-06-24 | There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this vulnerability to modify the password o… |
CVE-2021-32700 | Critical | 9.1 | 2021-06-22 | Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up to alpha 3 have a… |
CVE-2020-20472 | Medium | 5.3 | 2021-06-21 | White Shark System (WSS) 1.3.2 has a sensitive information disclosure vulnerability. The if_get_addbook.php file does not have an authentication operation. Rem… |
CVE-2021-32659 | Medium | 6.5 | 2021-06-16 | Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier, if a bridge has ro… |
CVE-2021-32930 | Critical | 9.8 | 2021-06-11 | The affected product’s configuration is vulnerable due to missing authentication, which may allow an attacker to change configurations and execute arbitrary co… |
CVE-2021-23847 | Critical | 9.8 | 2021-06-09 | A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings… |
CVE-2021-26928 | Medium | 6.8 | 2021-06-04 | BIRD through 2.0.7 does not provide functionality for password authentication of BGP peers. Because of this, products that use BIRD (which may, for example, in… |
CVE-2021-22322 | High | 7.5 | 2021-06-03 | There is a Missing Authentication for Critical Function vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may impair data confi… |
CVE-2021-22316 | Medium | 6.8 | 2021-06-03 | There is a Missing Authentication for Critical Function vulnerability in Huawei Smartphone. Attackers with physical access to the device can thereby exploit th… |
CVE-2020-25634 | Medium | 5.4 | 2021-05-26 | A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitive information or mo… |
CVE-2021-21986 | Critical | 9.8 | 2021-05-26 | The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Ma… |
CVE-2020-25697 | High | 7.0 | 2021-05-26 | A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of a… |
CVE-2021-30190 | Critical | 9.8 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control. |
CVE-2021-32453 | Medium | 6.5 | 2021-05-17 | SITEL CAP/PRX firmware version 5.2.01 allows an attacker with access to the local network, to access via HTTP to the internal configuration database of the dev… |
CVE-2020-4670 | Critical | 9.1 | 2021-05-17 | IBM Planning Analytics Local 2.0 connects to a Redis server. The Redis server, an in-memory data structure store, running on the remote host is not protected b… |
CVE-2021-20998 | Critical | 10.0 | 2021-05-13 | In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users. |
CVE-2021-27571 | Medium | 5.3 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can retrieve recently used and running applications, their icons, and their file paths… |
CVE-2021-27570 | Medium | 5.3 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 3.015. Attackers can close any running process by sending the process name in a specially crafted packet… |
CVE-2021-27569 | Medium | 5.3 | 2021-05-07 | An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can maximize or minimize the window of a running process by sending the process name i… |
CVE-2020-36125 | High | 7.1 | 2021-05-07 | Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control where password revalidation in sensitive operations can be bypa… |
CVE-2021-29203 | Critical | 9.8 | 2021-05-06 | A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior t… |
CVE-2021-31793 | High | 7.5 | 2021-05-06 | An issue exists on NightOwl WDB-20-V2 WDB-20-V2_20190314 devices that allows an unauthenticated user to gain access to snapshots and video streams from the doo… |
CVE-2021-1499 | Medium | 5.3 | 2021-05-06 | A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an… |
CVE-2020-36333 | Critical | 9.1 | 2021-05-05 | themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard_actions hook. |
CVE-2020-35758 | Critical | 9.8 | 2021-05-03 | An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a Authentication Bypass in the Web Interface. This interface does not properly rest… |
CVE-2020-35757 | Critical | 9.8 | 2021-05-03 | An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is Unauthenticated Root ADB Access Over TCP. The LS9 web interface provides functional… |
CVE-2020-35756 | High | 7.5 | 2021-05-03 | An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a luci_service GETPASS Configuration Password Information Leak. The luci_service da… |
CVE-2020-35755 | High | 7.5 | 2021-05-03 | An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a luci_service Read_ NVRAM Direct Access Information Leak. The luci_service deamon… |
CVE-2021-21535 | High | 7.4 | 2021-04-30 | Dell Hybrid Client versions prior to 1.5 contain a missing authentication for a critical function vulnerability. A local unauthenticated attacker may exploit t… |
CVE-2020-21997 | High | 7.5 | 2021-04-29 | Smartwares HOME easy <=1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. An attacker could disclose… |
CVE-2020-21996 | High | 7.5 | 2021-04-28 | AVE DOMINAplus <=1.10.x suffers from an unauthenticated reboot command execution. Attackers can exploit this issue to cause a denial of service scenario. |
CVE-2021-30167 | Critical | 9.8 | 2021-04-28 | The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and further amend user’s inf… |
CVE-2021-29442 | High | 8.6 | 2021-04-27 | Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController let… |
CVE-2020-17517 | High | 7.5 | 2021-04-27 | The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access… |
CVE-2020-15078 | High | 7.5 | 2021-04-26 | OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authe… |
CVE-2021-20697 | Critical | 9.8 | 2021-04-26 | Missing authentication for critical function in DAP-1880AC firmware version 1.21 and earlier allows a remote attacker to login to the device as an authenticate… |
CVE-2021-20990 | High | 7.5 | 2021-04-19 | In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints… |
CVE-2021-24219 | Medium | 5.3 | 2021-04-12 | The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7… |
CVE-2021-30462 | High | 7.2 | 2021-04-08 | VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vest… |
CVE-2021-28124 | Medium | 5.9 | 2021-04-02 | A man-in-the-middle vulnerability in Cohesity DataPlatform support channel in version 6.3 up to 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. Missing serv… |
CVE-2021-22997 | High | 7.5 | 2021-03-31 | On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport servic… |
CVE-2021-22995 | High | 7.5 | 2021-03-31 | On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ high availability (HA) when using a Quorum device for automatic failover does not implement any form of au… |
CVE-2020-25218 | Critical | 9.8 | 2021-03-29 | Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allow Authentication Bypass in its administrative web interface. |
CVE-2021-28148 | High | 7.5 | 2021-03-22 | One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authen… |
CVE-2020-28899 | Critical | 9.1 | 2021-03-16 | The Web CGI Script on ZyXEL LTE4506-M606 V1.00(ABDO.2)C0 devices does not require authentication, which allows remote unauthenticated attackers (via crafted JS… |
CVE-2020-35226 | High | 7.1 | 2021-03-10 | NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allow unauthenticated users to modify the switch DHCP configuration by sending the corresponding write request comm… |
CVE-2020-19419 | High | 7.5 | 2021-03-10 | Incorrect Access Control in Emerson Smart Wireless Gateway 1420 4.6.59 allows remote attackers to obtain sensitive device information from the administrator co… |
CVE-2021-28122 | Critical | 9.8 | 2021-03-10 | A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP… |
CVE-2020-27225 | High | 7.8 | 2021-03-09 | In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an u… |
CVE-2021-20262 | Medium | 6.8 | 2021-03-09 | A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account if… |
CVE-2021-27255 | High | 8.8 | 2021-03-05 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentication is no… |
CVE-2021-26705 | Critical | 9.1 | 2021-03-05 | An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without authentication, the… |
CVE-2021-27963 | High | 8.2 | 2021-03-05 | SonLogger before 6.4.1 is affected by user creation with any user permissions profile (e.g., SuperAdmin). An anonymous user can send a POST request to /User/sa… |
CVE-2021-27215 | Critical | 9.8 | 2021-03-03 | An issue was discovered in genua genugate before 9.0 Z p19, 9.1.x through 9.6.x before 9.6 p7, and 10.x before 10.1 p4. The Web Interfaces (Admin, Userweb, Sid… |
CVE-2019-25020 | High | 7.5 | 2021-02-27 | An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker can retrieve the administrative configurat… |
CVE-2019-11684 | Critical | 9.9 | 2021-02-26 | Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset… |
CVE-2021-1396 | Critical | 9.8 | 2021-02-24 | Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operation… |
CVE-2021-1393 | Critical | 9.8 | 2021-02-24 | Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operation… |
CVE-2021-20662 | High | 7.5 | 2021-02-24 | Missing authentication for critical function in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to alter the setting information without the… |
CVE-2021-20198 | High | 8.1 | 2021-02-23 | A flaw was found in the OpenShift Installer before version v0.9.0-master.0.20210125200451-95101da940b0. During installation of OpenShift Container Platform 4 c… |
CVE-2020-36245 | High | 8.8 | 2021-02-17 | GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP… |
CVE-2021-26697 | Medium | 5.3 | 2021-02-17 | The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that en… |
CVE-2021-20067 | Medium | 5.3 | 2021-02-16 | Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to view sensitive syslog events without authentication. |
CVE-2021-22652 | Critical | 9.8 | 2021-02-11 | Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the c… |
CVE-2020-26192 | High | 7.8 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.2.0 - 9.1.0 contain a privilege escalation vulnerability. A non-admin user with either ISI_PRIV_LOGIN_CONSOLE or ISI_PRIV_… |
CVE-2021-21472 | High | 8.8 | 2021-02-09 | SAP Software Provisioning Manager 1.0 (SAP NetWeaver Master Data Management Server 7.1) does not have an option to set password during its installation, this a… |
CVE-2020-15798 | Critical | 9.8 | 2021-02-09 | A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All ve… |
CVE-2020-10537 | High | 7.8 | 2021-02-05 | An issue was discovered in Epikur before 20.1.1. A Glassfish 4.1 server with a default configuration is running on TCP port 4848. No password is required to ac… |
CVE-2020-14245 | Critical | 9.8 | 2021-02-04 | HCL OneTest UI V9.5, V10.0, and V10.1 does not perform authentication for functionality that either requires a provable user identity or consumes a significant… |
CVE-2020-29165 | Critical | 9.8 | 2021-02-03 | PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by incorrect access control, which can result in remotely gaining administrator privileges. |
CVE-2020-15834 | High | 7.5 | 2021-02-01 | An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The wireless network password is exposed in a QR encoded picture that an unauthenti… |
CVE-2020-13856 | High | 7.5 | 2021-02-01 | An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. Authentication is not required to download the support file that contains sensitive… |
CVE-2021-25312 | High | 8.8 | 2021-01-27 | HTCondor before 8.9.11 allows a user to submit a job as another user on the system, because of a flaw in the IDTOKENS authentication method. |
CVE-2021-22159 | High | 7.8 | 2021-01-26 | Insider Threat Management Windows Agent Local Privilege Escalation Vulnerability The Proofpoint Insider Threat Management (formerly ObserveIT) Agent for Window… |
CVE-2020-23448 | Critical | 9.8 | 2021-01-26 | newbee-mall all versions are affected by incorrect access control to remotely gain privileges through AdminLoginInterceptor.java. The authentication logic of t… |
CVE-2020-4958 | Critical | 9.8 | 2021-01-21 | IBM Security Identity Governance and Intelligence 5.2.6 does not perform any authentication for functionality that requires a provable user identity or consume… |
CVE-2021-22850 | Medium | 5.3 | 2021-01-19 | HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions. |
CVE-2021-1246 | Medium | 6.5 | 2021-01-13 | Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability A vulnerability in the w… |
CVE-2020-9143 | Medium | 5.3 | 2021-01-13 | There is a missing authentication vulnerability in some Huawei smartphone.Successful exploitation of this vulnerability may lead to low-sensitive information e… |
CVE-2020-15799 | Medium | 6.5 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl… |
CVE-2020-5022 | Medium | 5.3 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining infor… |
CVE-2020-27285 | Critical | 9.1 | 2021-01-06 | The default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read and modify the database without authentication. |
CVE-2020-35951 | Critical | 9.9 | 2021-01-01 | An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file… |