CWE-306 · Missing Authentication for Critical Function (page 26)
Page 26 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-3461 | Medium | 5.3 | 2020-07-31 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to obtain con… |
CVE-2020-3376 | High | 7.3 | 2020-07-31 | A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authent… |
CVE-2020-2076 | Critical | 9.8 | 2020-07-29 | SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An at… |
CVE-2020-15391 | Critical | 9.8 | 2020-07-23 | The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. T… |
CVE-2020-10921 | Critical | 9.8 | 2020-07-23 | This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authenticat… |
CVE-2020-10920 | Critical | 9.8 | 2020-07-23 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Aut… |
CVE-2020-15894 | High | 7.5 | 2020-07-22 | An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used t… |
CVE-2020-12028 | High | 7.3 | 2020-07-20 | In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpo… |
CVE-2020-10605 | High | 7.5 | 2020-07-17 | Grundfos CIM 500 before v06.16.00 responds to unauthenticated requests for password storage files. |
CVE-2020-13405 | High | 7.5 | 2020-07-16 | userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POS… |
CVE-2020-14501 | Critical | 9.8 | 2020-07-15 | Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of this vulnerability ma… |
CVE-2020-5373 | Medium | 6.5 | 2020-07-14 | Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an improper authentication vulnerabili… |
CVE-2020-10044 | High | 7.5 | 2020-07-14 | A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attacker with access to t… |
CVE-2020-10038 | Critical | 9.8 | 2020-07-14 | A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attacker with access to t… |
CVE-2020-6287 | Critical | 10.0 | 2020-07-14 | SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without p… |
CVE-2020-10282 | Critical | 9.8 | 2020-07-03 | The Micro Air Vehicle Link (MAVLink) protocol presents no authentication mechanism on its version 1.0 (nor authorization) whichs leads to a variety of attacks… |
CVE-2020-5910 | High | 7.5 | 2020-07-02 | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require… |
CVE-2020-3402 | High | 7.5 | 2020-07-02 | A vulnerability in the Java Remote Method Invocation (RMI) interface of Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attack… |
CVE-2020-13382 | Critical | 9.1 | 2020-07-01 | openSIS through 7.4 has Incorrect Access Control. |
CVE-2020-15336 | High | 7.5 | 2020-06-26 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /cnr requests. |
CVE-2020-15335 | High | 7.5 | 2020-06-26 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /registerCpe requests. |
CVE-2020-11961 | High | 7.5 | 2020-06-24 | Xiaomi router R3600 ROM before 1.0.50 is affected by a sensitive information leakage caused by an insecure interface get_config_result without authentication |
CVE-2020-10272 | Critical | 9.8 | 2020-06-24 | MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication… |
CVE-2020-9480 | Critical | 9.8 | 2020-06-23 | In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret… |
CVE-2020-11969 | Critical | 9.8 | 2020-06-15 | If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099… |
CVE-2020-13150 | High | 7.8 | 2020-06-15 | D-link DSL-2750U ISL2750UEME3.V1E devices allow approximately 90 seconds of access to the control panel, after a restart, before MAC address filtering rules be… |
CVE-2020-1813 | Medium | 6.8 | 2020-06-15 | HUAWEI P30 smart phone with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. Due to improper authentication of spe… |
CVE-2020-4471 | Medium | 6.5 | 2020-06-15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions by send a specially… |
CVE-2020-14048 | High | 7.5 | 2020-06-12 | Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents. |
CVE-2020-7589 | Critical | 9.1 | 2020-06-10 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions). The vulnerability could lead to an attacker reading and modifying the… |
CVE-2020-6263 | Critical | 9.8 | 2020-06-10 | Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CO… |
CVE-2020-12004 | High | 7.5 | 2020-06-09 | The affected product lacks proper authentication required to query the server on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (vers… |
CVE-2020-5589 | High | 8.8 | 2020-06-09 | SONY Wireless Headphones WF-1000X, WF-SP700N, WH-1000XM2, WH-1000XM3, WH-CH700N, WH-H900N, WH-XB700, WH-XB900N, WI-1000X, WI-C600N and WI-SP600N with firmware… |
CVE-2020-10754 | Medium | 4.3 | 2020-06-08 | It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when creating a new profi… |
CVE-2020-13838 | Low | 3.5 | 2020-06-04 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. The DeX Lockscreen feature does not block access to Quick Panel and notific… |
CVE-2020-13837 | Low | 3.5 | 2020-06-04 | An issue was discovered on Samsung mobile devices with Q(10.0) software. The Lockscreen feature does not block Quick Panel access to Music Share. The Samsung I… |
CVE-2020-3335 | Medium | 5.5 | 2020-06-03 | A vulnerability in the key store of Cisco Application Services Engine Software could allow an authenticated, local attacker to read sensitive information of ot… |
CVE-2020-3333 | Medium | 5.3 | 2020-06-03 | A vulnerability in the API of Cisco Application Services Engine Software could allow an unauthenticated, remote attacker to update event policies on an affecte… |
CVE-2020-7115 | Critical | 9.8 | 2020-06-03 | The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an attacker could then ex… |
CVE-2020-12017 | Critical | 9.8 | 2020-06-02 | GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allo… |
CVE-2020-13695 | High | 7.2 | 2020-06-01 | In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a passwo… |
CVE-2020-1955 | Critical | 9.8 | 2020-05-20 | CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_… |
CVE-2019-18666 | Critical | 9.8 | 2020-05-15 | An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP reque… |
CVE-2020-12877 | High | 7.5 | 2020-05-14 | Veritas APTARE versions prior to 10.4 allowed sensitive information to be accessible without authentication. |
CVE-2020-6242 | Critical | 9.8 | 2020-05-12 | SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Managemen… |
CVE-2020-9315 | High | 7.5 | 2020-05-10 | ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console… |
CVE-2020-12720 | Critical | 9.8 | 2020-05-08 | vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control. |
CVE-2020-10974 | High | 7.5 | 2020-05-07 | An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the adm… |
CVE-2020-10973 | High | 7.5 | 2020-05-07 | An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST… |
CVE-2020-10972 | High | 7.5 | 2020-05-07 | An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is r… |
CVE-2020-12117 | Medium | 5.3 | 2020-05-01 | Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration values via a crafted packet to UDP port 48… |
CVE-2020-11028 | Medium | 5.8 | 2020-04-30 | In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of condition… |
CVE-2019-5620 | Critical | 9.8 | 2020-04-29 | ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function. |
CVE-2020-12478 | High | 7.5 | 2020-04-29 | TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files. |
CVE-2020-10641 | High | 7.5 | 2020-04-28 | An unprotected logging route may allow an attacker to write endless log statements into the database without space limits or authentication. This results in co… |
CVE-2020-12266 | High | 7.5 | 2020-04-27 | An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for i… |
CVE-2020-5870 | High | 8.1 | 2020-04-24 | In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization mechanisms do not use any form of authentication for connecting to the peer. |
CVE-2018-21132 | Critical | 9.8 | 2020-04-23 | Certain NETGEAR devices are affected by authentication bypass. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17. |
CVE-2020-11649 | Medium | 6.5 | 2020-04-22 | An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted. |
CVE-2019-19104 | Critical | 9.1 | 2020-04-22 | The web server in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows access to different endpoints of the application without authe… |
CVE-2020-11539 | High | 8.1 | 2020-04-22 | An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security leve… |
CVE-2020-9278 | Critical | 9.1 | 2020-04-20 | An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. The device can be reset to its default configuration by accessing an unauthenticated URL. |
CVE-2020-9275 | Critical | 9.8 | 2020-04-20 | An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A cfm UDP service listening on port 65002 allows remote, unauthenticated exfiltration of admin… |
CVE-2020-11946 | High | 7.5 | 2020-04-20 | Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call. |
CVE-2020-7114 | Critical | 9.8 | 2020-04-16 | A vulnerability exists allowing attackers, when present in the same network segment as ClearPass' management interface, to make changes to certain databases in… |
CVE-2019-12524 | Critical | 9.8 | 2020-04-15 | An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by defaul… |
CVE-2020-6235 | High | 8.6 | 2020-04-14 | SAP Solution Manager (Diagnostics Agent), version 7.2, does not perform the authentication check for the functionalities of the Collector Simulator, leading to… |
CVE-2019-16879 | Critical | 9.8 | 2020-04-14 | The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has a Missing Authentication for Critical Function (CWE-306) vu… |
CVE-2020-9004 | High | 8.8 | 2020-04-14 | A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the admini… |
CVE-2020-11673 | Critical | 9.8 | 2020-04-13 | An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., delete, clone, or view… |
CVE-2020-3952 | Critical | 9.8 | 2020-04-10 | Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctl… |
CVE-2020-10625 | Critical | 9.8 | 2020-04-09 | WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account. |
CVE-2020-10263 | Medium | 6.8 | 2020-04-08 | An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.52.4. Attackers can get root shell by accessing the UART interface and then they can (i) read Wi-Fi… |
CVE-2018-21041 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.x) software. Access to Gallery in the Secure Folder can occur without authentication. The Samsung ID… |
CVE-2020-11599 | High | 7.5 | 2020-04-06 | An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401. GetDistributedPOP3 allows attackers to obtain the username and password of the SMTP user. |
CVE-2020-11598 | Critical | 9.8 | 2020-04-06 | An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. Upload.ashx allows remote attackers to execute arbitrary code by uploading and executing an… |
CVE-2020-9473 | Medium | 6.6 | 2020-04-06 | The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 has a passwordless ftp ssh user. By using an exploit chain, an attacker with access to the network c… |
CVE-2020-10265 | Critical | 9.4 | 2020-04-06 | Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards expose a service cal… |
CVE-2020-10264 | High | 8.8 | 2020-04-06 | CB3 SW Version 3.3 and upwards, e-series SW Version 5.0 and upwards allow authenticated access to the RTDE (Real-Time Data Exchange) interface on port 30004 wh… |
CVE-2020-11547 | Medium | 5.3 | 2020-04-05 | PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, me… |
CVE-2019-19092 | Low | 3.5 | 2020-04-02 | ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code (MAC). Alterations to Viewstate might thus not be noticed. |
CVE-2020-9349 | High | 7.5 | 2020-04-02 | The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password. |
CVE-2020-8509 | High | 7.5 | 2020-03-30 | Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive information disclosure. |
CVE-2020-3920 | High | 8.1 | 2020-03-27 | UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileg… |
CVE-2020-10965 | High | 8.1 | 2020-03-25 | Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the default admin accoun… |
CVE-2019-20624 | Medium | 5.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. S-Voice leaks keyboard learned words via the lock screen. The Samsung ID is… |
CVE-2019-20598 | Low | 2.4 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x) software. Bixby leaks the keyboard's learned words, and the clipboard contents, via the lock scre… |
CVE-2019-20595 | Low | 2.4 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. Quick Panel allows enabling or disabling the Bluetooth stack without authentication. Th… |
CVE-2019-20579 | Low | 2.4 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. Gallery allows attackers to enable Location information sharing fro… |
CVE-2019-20559 | Low | 2.4 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. Gallery allows viewing of photos on the lock screen. The Samsung ID is SVE-2019-15055 (… |
CVE-2019-20550 | Medium | 5.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x) (released in China and India) software. The S Secure app can access the content of a locked app w… |
CVE-2020-10833 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with Q(10.0) software. The DeX Lockscreen allows attackers to access the quick panel and notifications. The S… |
CVE-2019-20532 | Medium | 5.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can access the Developer options without authentication… |
CVE-2020-10874 | High | 7.5 | 2020-03-23 | Motorola FX9500 devices allow remote attackers to read database files. |
CVE-2020-7479 | High | 7.8 | 2020-03-23 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a… |
CVE-2020-8497 | Medium | 5.3 | 2020-03-23 | In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, pri… |
CVE-2019-16258 | Medium | 6.8 | 2020-03-20 | The bootloader of the homee Brain Cube V2 through 2.23.0 allows attackers with physical access to gain root access by manipulating the U-Boot environment via t… |
CVE-2019-15655 | High | 7.5 | 2020-03-19 | D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request… |
CVE-2019-15654 | High | 7.5 | 2020-03-19 | Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management ser… |
CVE-2019-12127 | Critical | 9.8 | 2020-03-19 | In ONAP OOM through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full acce… |