CWE-306 · Missing Authentication for Critical Function (page 27)
Page 27 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12126 | Critical | 9.8 | 2020-03-19 | In ONAP DCAE through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full acc… |
CVE-2019-12125 | Critical | 9.8 | 2020-03-19 | In ONAP Logging through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full… |
CVE-2019-12130 | Critical | 9.8 | 2020-03-19 | In ONAP CLI through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full acce… |
CVE-2019-12129 | Critical | 9.8 | 2020-03-19 | In ONAP MSB through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full acce… |
CVE-2019-12128 | Critical | 9.8 | 2020-03-19 | In ONAP SO through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full acces… |
CVE-2019-20529 | High | 7.5 | 2020-03-18 | In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authent… |
CVE-2019-12120 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP VNFSDK through Dublin. By accessing port 8000 of demo-vnfsdk-vnfsdk, an unauthenticated attacker (who already has access to pod… |
CVE-2019-12119 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDC through Dublin. By accessing port 7000 of demo-sdc-sdc-wfd-fe pod, an unauthenticated attacker (who already has access to p… |
CVE-2019-12118 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDC through Dublin. By accessing port 7001 of demo-sdc-sdc-wfd-be pod, an unauthenticated attacker (who already has access to p… |
CVE-2019-12117 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDC through Dublin. By accessing port 4001 of demo-sdc-sdc-onboarding-be pod, an unauthenticated attacker (who already has acce… |
CVE-2019-12116 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDC through Dublin. By accessing port 6000 of demo-sdc-sdc-fe pod, an unauthenticated attacker (who already has access to pod-t… |
CVE-2019-12115 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDC through Dublin. By accessing port 4000 of demo-sdc-sdc-be pod, an unauthenticated attacker (who already has access to pod-t… |
CVE-2019-12114 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP HOLMES before Dublin. By accessing port 9202 of dep-holmes-engine-mgmt pod, an unauthenticated attacker (who already has access… |
CVE-2020-9325 | High | 7.5 | 2020-03-18 | Aquaforest TIFF Server 4.0 allows Unauthenticated Arbitrary File Download. |
CVE-2020-8598 | Critical | 9.8 | 2020-03-18 | Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow a r… |
CVE-2019-20105 | Medium | 4.9 | 2020-03-17 | The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 b… |
CVE-2019-13194 | High | 7.5 | 2020-03-13 | Some Brother printers (such as the HL-L8360CDW v1.20) were affected by different information disclosure vulnerabilities that provided sensitive information to… |
CVE-2019-13205 | High | 7.5 | 2020-03-13 | All configuration parameters of certain Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were accessible by unauthenticated users. This informat… |
CVE-2020-10079 | Medium | 5.3 | 2020-03-13 | GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required to configure two-factor authentication… |
CVE-2019-19799 | Medium | 5.3 | 2020-03-13 | Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servl… |
CVE-2020-6207 | Critical | 9.8 | 2020-03-10 | SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resultin… |
CVE-2020-6198 | Critical | 9.8 | 2020-03-10 | SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all remo… |
CVE-2020-0052 | Medium | 4.3 | 2020-03-10 | In smsSelected of AnswerFragment.java, there is a way to send an SMS from the lock screen due to a permissions bypass. This could lead to local escalation of p… |
CVE-2020-5328 | Critical | 9.8 | 2020-03-06 | Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licens… |
CVE-2020-9544 | High | 7.5 | 2020-03-05 | An issue was discovered on D-Link DSL-2640B E1 EU_1.01 devices. The administrative interface doesn't perform authentication checks for a firmware-update POST r… |
CVE-2019-19226 | High | 7.5 | 2020-03-04 | A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to enable or disable MAC addres… |
CVE-2019-19225 | High | 7.5 | 2020-03-04 | A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to change DNS servers without b… |
CVE-2019-19224 | High | 7.5 | 2020-03-04 | A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to download the configuration (… |
CVE-2015-5201 | High | 7.5 | 2020-02-25 | VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Re… |
CVE-2020-9330 | High | 8.8 | 2020-02-21 | Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connecto… |
CVE-2020-5326 | Medium | 6.1 | 2020-02-21 | Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (… |
CVE-2020-6186 | High | 7.5 | 2020-02-12 | SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the SAP Host Agent, le… |
CVE-2020-6769 | Critical | 10.0 | 2020-02-07 | Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary… |
CVE-2020-8636 | Critical | 9.8 | 2020-02-06 | An issue was discovered in OpServices OpMon 9.3.2 that allows Remote Code Execution . |
CVE-2020-7954 | High | 7.8 | 2020-02-06 | An issue was discovered in OpServices OpMon 9.3.2. Starting from the apache user account, it is possible to perform privilege escalation through the lack of co… |
CVE-2020-7953 | High | 7.5 | 2020-02-06 | An issue was discovered in OpServices OpMon 9.3.2. Without authentication, it is possible to read server files (e.g., /etc/passwd) due to the use of the nmap -… |
CVE-2019-19800 | Medium | 5.3 | 2020-02-06 | Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet. |
CVE-2019-4551 | Medium | 5.3 | 2020-02-04 | IBM Security Directory Server 6.4.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protec… |
CVE-2019-16893 | High | 7.5 | 2020-02-03 | The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181120 devices allows an unauthenticated attacker to reboot the device via a reboot.cgi request. |
CVE-2019-19143 | Medium | 6.1 | 2020-01-27 | TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cgi/softup URI. |
CVE-2019-19822 | High | 7.5 | 2020-01-27 | A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, includ… |
CVE-2020-3142 | High | 7.5 | 2020-01-26 | A vulnerability in Cisco Webex Meetings Suite sites and Cisco Webex Meetings Online sites could allow an unauthenticated, remote attendee to join a password-pr… |
CVE-2019-16003 | Medium | 5.3 | 2020-01-26 | A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to download system log files from a… |
CVE-2020-7964 | Medium | 5.3 | 2020-01-24 | An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their c… |
CVE-2020-6964 | High | 8.6 | 2020-01-24 | In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE… |
CVE-2011-4322 | High | 7.5 | 2020-01-21 | websitebaker prior to and including 2.8.1 has an authentication error in backup module. |
CVE-2019-19142 | High | 7.5 | 2020-01-17 | Intelbras WRN240 devices do not require authentication to replace the firmware via a POST request to the incoming/Firmware.cfg URI. |
CVE-2020-7048 | Critical | 9.1 | 2020-01-16 | The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial Wo… |
CVE-2019-13933 | High | 8.6 | 2020-01-16 | A vulnerability has been identified in SCALANCE X204RNA (HSR), SCALANCE X204RNA (PRP), SCALANCE X204RNA EEC (HSR), SCALANCE X204RNA EEC (PRP), SCALANCE X204RNA… |
CVE-2019-20143 | Medium | 5.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. It has Incorrect Access Control. |
CVE-2014-3449 | Critical | 9.8 | 2020-01-09 | BSS Continuity CMS 4.2.22640.0 has an Authentication Bypass vulnerability |
CVE-2020-6170 | Critical | 9.8 | 2020-01-08 | An authentication bypass vulnerability on Genexis Platinum-4410 v2.1 P4410-V2 1.28 devices allows attackers to obtain cleartext credentials from the HTML sourc… |
CVE-2019-17146 | Critical | 9.8 | 2020-01-07 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link DCS-960L v1.07.102. Authentication is not required to… |
CVE-2019-16271 | Medium | 5.3 | 2020-01-06 | DTEN D5 and D7 before 1.3.2 devices allows remote attackers to read saved whiteboard image PDF documents via storage/emulated/0/Notes/PDF on TCP port 8080 with… |
CVE-2018-20507 | Medium | 5.3 | 2019-12-30 | An issue was discovered in GitLab Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Acc… |
CVE-2012-2736 | Medium | 4.4 | 2019-12-26 | In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network. |
CVE-2019-5080 | Critical | 9.1 | 2019-12-18 | An exploitable denial-of-service vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200 Firmware versions 03.01.07(13) and 03.0… |
CVE-2019-5078 | Critical | 9.1 | 2019-12-18 | An exploitable denial of service vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00… |
CVE-2019-18572 | Critical | 9.8 | 2019-12-18 | The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain an Improper Authentication vulnerability. A… |
CVE-2019-5077 | Critical | 9.1 | 2019-12-18 | An exploitable denial-of-service vulnerability exists in the iocheckd service ‘’I/O-Chec’’ functionality of WAGO PFC 200 Firmware versions 03.01.07(13) and 03… |
CVE-2019-8682 | Low | 2.4 | 2019-12-18 | The issue was addressed with improved UI handling. This issue is fixed in iOS 12.4, watchOS 5.3. A user may inadvertently complete an in-app purchase while on… |
CVE-2019-8522 | Medium | 5.5 | 2019-12-18 | A logic issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.4. An encrypted volume may be unmounted and remounted by… |
CVE-2019-5152 | High | 7.4 | 2019-12-18 | An exploitable information disclosure vulnerability exists in the network packet handling functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cip… |
CVE-2019-16731 | High | 7.5 | 2019-12-13 | The udpServerSys service in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to initiate firmware upgrades and alter device set… |
CVE-2019-18339 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The HTTP service (default port 5401/tcp) of the SiVMS/SiNVR Video Serv… |
CVE-2019-18311 | High | 7.5 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a… |
CVE-2019-18284 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The AdminService is available without authenticati… |
CVE-2019-15932 | Critical | 9.8 | 2019-12-12 | Intesync Solismed 3.3sp has Incorrect Access Control. |
CVE-2019-4244 | Critical | 9.1 | 2019-12-10 | IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to gain unauthorized information and unrestricted control over Zookeeper installatio… |
CVE-2013-1793 | High | 7.5 | 2019-12-10 | openstack-utils openstack-db has insecure password creation |
CVE-2019-5164 | High | 7.8 | 2019-12-03 | An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager ca… |
CVE-2019-5163 | High | 7.5 | 2019-12-03 | An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_addr… |
CVE-2019-12503 | Critical | 9.8 | 2019-12-02 | Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection attacks. Thus, an attac… |
CVE-2019-12392 | Critical | 9.8 | 2019-12-02 | Anviz access control devices allow remote attackers to issue commands without a password. |
CVE-2019-12390 | Medium | 5.3 | 2019-12-02 | Anviz access control devices expose private Information (pin code and name) by allowing remote attackers to query this information without credentials via port… |
CVE-2019-12389 | High | 7.5 | 2019-12-02 | Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this information without credentials via port tcp/5… |
CVE-2011-2187 | High | 7.8 | 2019-11-27 | xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which allows local attacke… |
CVE-2019-16243 | Medium | 6.1 | 2019-11-26 | On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an undocumented web API that allows unprivileged JavaScript, including JavaScript running within the K… |
CVE-2019-15511 | High | 7.8 | 2019-11-21 | An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due to Improper Access Control, an attacker… |
CVE-2019-18980 | High | 7.5 | 2019-11-14 | On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone ca… |
CVE-2019-18939 | Critical | 9.8 | 2019-11-14 | eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated attackers with acces… |
CVE-2019-18938 | Critical | 9.8 | 2019-11-14 | eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with acce… |
CVE-2019-18937 | Critical | 9.8 | 2019-11-14 | eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with a… |
CVE-2019-18925 | Critical | 9.8 | 2019-11-12 | Systematic IRIS WebForms 5.4 and its functionalities can be accessed and used without any form of authentication. |
CVE-2019-17235 | Medium | 5.3 | 2019-11-12 | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure. |
CVE-2019-17234 | High | 7.5 | 2019-11-12 | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion. |
CVE-2019-5644 | Critical | 10.0 | 2019-11-06 | Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access… |
CVE-2019-5643 | Medium | 5.3 | 2019-11-06 | Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access… |
CVE-2019-5617 | Critical | 10.0 | 2019-11-06 | Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access… |
CVE-2006-0062 | Critical | 9.8 | 2019-11-06 | xlockmore 5.13 allows potential xlock bypass when FVWM switches to the same virtual desktop as a new Gaim window. |
CVE-2006-0061 | Critical | 9.8 | 2019-11-06 | xlockmore 5.13 and 5.22 segfaults when using libpam-opensc and returns the underlying xsession. This allows unauthorized users access to the X session. |
CVE-2019-18230 | High | 7.5 | 2019-10-31 | Honeywell equIP and Performance series IP cameras, multiple versions, A vulnerability exists where the affected product allows unauthenticated access to audio… |
CVE-2019-16907 | Medium | 5.3 | 2019-10-31 | An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. It is possible to obtain a list of all valid Jira usernames w… |
CVE-2019-16906 | High | 7.5 | 2019-10-31 | An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. By using plugins/servlet/nfj/PushNotification?username= with… |
CVE-2019-13547 | Critical | 9.8 | 2019-10-31 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecured function that allows anyone who can access the IP address to use the function without… |
CVE-2019-18465 | Critical | 9.8 | 2019-10-31 | In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH (SF… |
CVE-2019-3978 | High | 7.5 | 2019-10-29 | RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. The queries are sent… |
CVE-2019-14927 | High | 7.5 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote configura… |
CVE-2019-13549 | High | 7.5 | 2019-10-25 | Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems does not prov… |
CVE-2019-13525 | Medium | 5.3 | 2019-10-25 | In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to obtain web configur… |