CWE-306 · Missing Authentication for Critical Function (page 28)
Page 28 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-15064 | Critical | 9.8 | 2019-10-17 | HiNet GPON firmware version < I040GWR190731 allows an attacker login to device without any authentication. |
CVE-2019-17512 | Critical | 9.1 | 2019-10-16 | There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clea… |
CVE-2019-15282 | Medium | 5.3 | 2019-10-16 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker read tcp… |
CVE-2019-17511 | High | 7.5 | 2019-10-14 | There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can get the router's log file via log_get.ph… |
CVE-2019-17532 | High | 7.5 | 2019-10-12 | An issue was discovered on Belkin Wemo Switch 28B WW_2.00.11057.PVT-OWRT-SNS devices. They allow remote attackers to cause a denial of service (persistent rule… |
CVE-2019-17506 | Critical | 9.8 | 2019-10-11 | There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's us… |
CVE-2019-17505 | High | 7.5 | 2019-10-11 | D-Link DAP-1320 A2-V1.21 routers have some web interfaces without authentication requirements, as demonstrated by uplink_info.xml. An attacker can remotely obt… |
CVE-2019-9529 | Medium | 5.5 | 2019-10-10 | The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local atta… |
CVE-2019-15018 | High | 7.5 | 2019-10-09 | A security vulnerability exists in the Zingbox Inspector versions 1.280 and earlier, where authentication is not required when binding the Inspector instance t… |
CVE-2019-17354 | Critical | 9.4 | 2019-10-09 | wan.htm page on Zyxel NBG-418N v2 with firmware version V1.00(AARP.9)C0 can be accessed directly without authentication, which can lead to disclosure of inform… |
CVE-2019-17353 | High | 8.2 | 2019-10-09 | An issue discovered on D-Link DIR-615 devices with firmware version 20.05 and 20.07. wan.htm can be accessed directly without authentication, which can lead to… |
CVE-2019-0379 | Medium | 5.3 | 2019-10-08 | SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is c… |
CVE-2019-17186 | High | 8.8 | 2019-10-08 | /var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication remote code execution. |
CVE-2019-17232 | High | 7.5 | 2019-10-07 | Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import. |
CVE-2019-17219 | High | 8.8 | 2019-10-06 | An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the device does not enforce any authentication… |
CVE-2019-8292 | Medium | 5.3 | 2019-10-01 | Online Store System v1.0 delete_product.php doesn't check to see if a user authtenticated or has administrative rights allowing arbitrary product deletion. |
CVE-2019-15940 | Critical | 9.8 | 2019-10-01 | Victure PC530 devices allow unauthenticated TELNET access as root. |
CVE-2019-13523 | Medium | 5.3 | 2019-09-26 | In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configur… |
CVE-2019-15068 | Critical | 9.8 | 2019-09-25 | A broken access control vulnerability in Smart Battery A4, a multifunctional portable charger, firmware version ?<= r1.7.9 allows an attacker to get/reset admi… |
CVE-2019-6652 | Medium | 6.5 | 2019-09-25 | In BIG-IQ 6.0.0-6.1.0, services for stats do not require authentication nor do they implement any form of Transport Layer Security (TLS). |
CVE-2019-5504 | Critical | 9.8 | 2019-09-24 | ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated remote attackers to p… |
CVE-2019-14253 | Medium | 6.5 | 2019-09-18 | An issue was discovered in servletcontroller in the secure portal in Publisure 2.1.2. One can bypass authentication and perform a query on PHP forms within the… |
CVE-2019-16199 | Critical | 9.8 | 2019-09-17 | eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTT… |
CVE-2019-8449 | Medium | 5.3 | 2019-09-11 | The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnera… |
CVE-2019-11496 | Critical | 9.1 | 2019-09-10 | In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. As par… |
CVE-2019-11466 | Medium | 5.3 | 2019-09-10 | In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port ea… |
CVE-2019-12105 | High | 8.2 | 2019-09-10 | In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_… |
CVE-2019-15896 | Critical | 9.8 | 2019-09-10 | An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to… |
CVE-2019-15895 | High | 7.5 | 2019-09-09 | search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes. |
CVE-2019-10668 | Critical | 9.1 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. S… |
CVE-2019-15102 | Critical | 9.8 | 2019-09-06 | An issue was discovered in Tyto Sahi Pro 6.x through 8.0.0. TestRunner_Non_distributed (and distributed end points) does not have any authentication mechanism… |
CVE-2019-15043 | High | 7.5 | 2019-09-03 | In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the… |
CVE-2019-15858 | High | 8.8 | 2019-09-03 | admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by… |
CVE-2019-15819 | Critical | 9.8 | 2019-08-30 | The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication. |
CVE-2019-13406 | High | 7.5 | 2019-08-29 | A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install a… |
CVE-2019-13405 | Critical | 9.8 | 2019-08-29 | A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/Adb… |
CVE-2019-11063 | Critical | 10.0 | 2019-08-29 | A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42_190515, ios versions up to 2.0.22) allows an attacker in the same local a… |
CVE-2019-11061 | Critical | 10.0 | 2019-08-29 | A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that co… |
CVE-2019-9935 | Medium | 5.3 | 2019-08-28 | Various Lexmark products have Incorrect Access Control (issue 2 of 2). |
CVE-2019-9934 | Medium | 5.3 | 2019-08-28 | Various Lexmark products have Incorrect Access Control (issue 1 of 2). |
CVE-2019-15506 | High | 7.5 | 2019-08-26 | An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticat… |
CVE-2019-14511 | High | 7.5 | 2019-08-22 | Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or r… |
CVE-2019-12634 | High | 7.5 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Ex… |
CVE-2019-15129 | Medium | 5.3 | 2019-08-18 | The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to access all candidates' files in the photo folder on… |
CVE-2019-15106 | Critical | 9.8 | 2019-08-16 | An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server… |
CVE-2019-9585 | Critical | 9.8 | 2019-08-14 | eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.***Metadata related operations, resulting in… |
CVE-2019-14984 | High | 8.1 | 2019-08-13 | eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web int… |
CVE-2019-13101 | Critical | 9.8 | 2019-08-08 | An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to discl… |
CVE-2019-1895 | Critical | 9.8 | 2019-08-07 | A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenti… |
CVE-2015-7559 | Low | 2.7 | 2019-08-01 | It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a comprom… |
CVE-2019-10198 | Medium | 6.5 | 2019-07-31 | An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which perfo… |
CVE-2019-5451 | Medium | 4.6 | 2019-07-30 | Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very sho… |
CVE-2019-3948 | High | 7.5 | 2019-07-29 | The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX883X and DH-IPC-HX86… |
CVE-2019-1010136 | High | 7.5 | 2019-07-19 | ChinaMobile GPN2.4P21-C-CN W2001EN-00 is affected by: Incorrect Access Control - Unauthenticated Remote Reboot. The impact is: PLC Wireless Router's are vulner… |
CVE-2019-13983 | Critical | 9.8 | 2019-07-19 | Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth… |
CVE-2019-10915 | High | 7.8 | 2019-07-11 | A vulnerability has been identified in TIA Administrator (All versions < V1.0 SP1 Upd1). The integrated configuration web application (TIA Administrator) allow… |
CVE-2019-12468 | Critical | 9.8 | 2019-07-10 | An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypas… |
CVE-2019-10121 | Critical | 9.8 | 2019-07-10 | eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks. An attacker can obt… |
CVE-2019-10119 | Critical | 9.8 | 2019-07-10 | eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. An attacker can obt… |
CVE-2019-13338 | High | 7.5 | 2019-07-09 | In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page meta… |
CVE-2019-11020 | High | 7.5 | 2019-07-09 | Lack of authentication in file-viewing components in DDRT Dashcom Live 2019-05-09 allows anyone to remotely access all claim details by visiting easily guessab… |
CVE-2019-11019 | High | 7.5 | 2019-07-09 | Lack of authentication in case-exporting components in DDRT Dashcom Live through 2019-05-08 allows anyone to remotely access all claim details by visiting easi… |
CVE-2019-12174 | High | 7.8 | 2019-07-08 | hide.me before 2.4.4 on macOS suffers from a privilege escalation vulnerability in the connectWithExecutablePath:configFilePath:configFileName method of the me… |
CVE-2019-13344 | Medium | 5.3 | 2019-07-05 | An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. Th… |
CVE-2019-13131 | Critical | 9.8 | 2019-07-01 | Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE. |
CVE-2019-4337 | Medium | 5.3 | 2019-07-01 | IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite node… |
CVE-2019-12919 | Medium | 5.5 | 2019-06-20 | On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the local network has unauthenticated access to the internal SD card via… |
CVE-2019-1897 | Medium | 5.3 | 2019-06-20 | A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to disconnect… |
CVE-2019-1876 | Medium | 4.0 | 2019-06-20 | A vulnerability in the HTTPS proxy feature of Cisco Wide Area Application Services (WAAS) Software could allow an unauthenticated, remote attacker to use the C… |
CVE-2019-1631 | Medium | 5.3 | 2019-06-20 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to access… |
CVE-2019-1629 | Medium | 5.3 | 2019-06-20 | A vulnerability in the configuration import utility of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to have wri… |
CVE-2019-12890 | Critical | 9.8 | 2019-06-19 | RedwoodHQ 2.5.5 does not require any authentication for database operations, which allows remote attackers to create admin users via a con.automationframework… |
CVE-2019-0312 | Medium | 5.3 | 2019-06-12 | Several web pages provided SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL: 7.10 to 7.11, 7.3… |
CVE-2017-15123 | Medium | 5.3 | 2019-06-12 | A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An atta… |
CVE-2019-3411 | High | 7.5 | 2019-06-11 | All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by information leak vulnerability. Due to some interfaces can obtain the WebUI login password… |
CVE-2019-9881 | Medium | 5.3 | 2019-06-10 | The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment'… |
CVE-2019-9880 | Critical | 9.1 | 2019-06-10 | An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to ret… |
CVE-2019-9879 | Critical | 9.8 | 2019-06-10 | The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. Thi… |
CVE-2019-12506 | High | 8.8 | 2019-06-07 | Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote R-R0010 is prone to keystroke injecti… |
CVE-2019-12505 | High | 8.8 | 2019-06-07 | Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP1001 v1.3C is prone to keystroke injection attacks. Thus, an attack… |
CVE-2019-11523 | Critical | 9.8 | 2019-06-06 | Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers can fully interact w… |
CVE-2019-6451 | High | 7.5 | 2019-06-06 | On SOYAL AR-727H and AR-829Ev5 devices, all CGI programs allow unauthenticated POST access. |
CVE-2019-9105 | High | 7.5 | 2019-05-31 | The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to make several types of API calls wi… |
CVE-2019-10046 | Medium | 5.3 | 2019-05-31 | An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libraries, and license information. |
CVE-2019-9871 | Critical | 9.8 | 2019-05-31 | Jector Smart TV FM-K75 devices allow remote code execution because there is an adb open port with root permission. |
CVE-2019-12500 | Medium | 6.5 | 2019-05-31 | The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy commands have no se… |
CVE-2019-6958 | Critical | 9.1 | 2019-05-29 | A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Confi… |
CVE-2019-12289 | Critical | 9.8 | 2019-05-23 | An issue was discovered in upgrade_firmware.cgi on VStarcam 100T (C7824WIP) CH-sys-48.53.75.119~123 and 200V (C38S) CH-sys-48.53.203.119~123 devices. A remote… |
CVE-2019-12288 | Critical | 9.8 | 2019-05-23 | An issue was discovered in upgrade_htmls.cgi on VStarcam 100T (C7824WIP) KR75.8.53.20 and 200V (C38S) KR203.18.1.20 devices. The web service, network, and acco… |
CVE-2019-6808 | Critical | 9.8 | 2019-05-22 | A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cau… |
CVE-2019-6820 | High | 8.2 | 2019-05-22 | A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network m… |
CVE-2019-10922 | Critical | 9.8 | 2019-05-14 | A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All versions), SIMATIC WinCC V7.2 and earli… |
CVE-2019-10919 | Critical | 9.4 | 2019-05-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Attackers with access to port 10005/tcp could perform device r… |
CVE-2019-9727 | High | 7.5 | 2019-05-13 | Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GU… |
CVE-2019-7404 | High | 7.5 | 2019-05-13 | An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file via an HTTP request containing its full… |
CVE-2019-5014 | Medium | 6.5 | 2019-05-08 | An exploitable improper access control vulnerability exists in the bluetooth low energy functionality of Winco Fireworks FireFly FW-1007 V2.0. An attacker can… |
CVE-2019-7564 | Critical | 9.8 | 2019-05-07 | An issue was discovered on Shenzhen Coship WM3300 WiFi Router 5.0.0.55 devices. The password reset functionality of the Wireless SSID doesn't require any type… |
CVE-2019-10950 | Critical | 9.8 | 2019-04-30 | Fujifilm FCR Capsula X/ Carbon X/ FCR XC-2, model versions CR-IR 357 FCR Carbon X, CR-IR 357 FCR XC-2, FCR-IR 357 FCR Capsula X provide insecure telnet service… |
CVE-2019-8993 | Critical | 9.8 | 2019-04-24 | The administrative web server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO Act… |
CVE-2019-7727 | Critical | 9.8 | 2019-04-23 | In NICE Engage through 6.5, the default configuration binds an unauthenticated JMX/RMI interface to all network interfaces, without restricting registration of… |