CWE-306 · Missing Authentication for Critical Function (page 29)
Page 29 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3899 | Critical | 9.8 | 2019-04-22 | It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only a… |
CVE-2019-10886 | Medium | 5.9 | 2019-04-19 | An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV and other applicable… |
CVE-2019-11321 | Medium | 5.3 | 2019-04-18 | An issue was discovered in Motorola CX2 1.01 and M2 1.01. The router opens TCP port 8010. Users can send hnap requests to this port without authentication to o… |
CVE-2019-1654 | High | 7.8 | 2019-04-17 | A vulnerability in the development shell (devshell) authentication for Cisco Aironet Series Access Points (APs) running the Cisco AP-COS operating system could… |
CVE-2019-9974 | Critical | 9.1 | 2019-04-11 | diag_tool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check, which allows remote attackers to run a ping command via a GET… |
CVE-2019-10946 | High | 7.5 | 2019-04-10 | An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated… |
CVE-2019-3941 | High | 7.5 | 2019-04-09 | Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005 RPC. |
CVE-2019-5514 | High | 8.8 | 2019-04-01 | VMware VMware Fusion (11.x before 11.0.3) contains a security vulnerability due to certain unauthenticated APIs accessible through a web socket. An attacker ma… |
CVE-2019-6542 | High | 7.5 | 2019-03-28 | ENTTEC Datagate MK2, Storm 24, Pixelator all firmware versions prior to (70044,70050,70060)_update_05032019-482 allows an unauthenticated user to initiate a re… |
CVE-2019-7642 | High | 7.5 | 2019-03-25 | D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and… |
CVE-2019-6538 | Critical | 9.3 | 2019-03-25 | The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer… |
CVE-2019-10042 | High | 7.5 | 2019-03-25 | The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an… |
CVE-2019-10041 | Critical | 9.8 | 2019-03-25 | The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an… |
CVE-2019-10040 | Critical | 9.8 | 2019-03-25 | The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use a h… |
CVE-2019-10039 | Critical | 9.8 | 2019-03-25 | The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an… |
CVE-2018-20220 | High | 7.5 | 2019-03-21 | An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted wi… |
CVE-2019-3917 | High | 7.5 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote, unauthenticated attacker to enable telnetd on the router via a craf… |
CVE-2018-19636 | High | 7.3 | 2019-03-05 | Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an… |
CVE-2019-9484 | High | 7.5 | 2019-03-01 | The Glen Dimplex Deutschland GmbH implementation of the Carel pCOWeb configuration tool allows remote attackers to obtain access via an HTTP session on port 10… |
CVE-2019-9201 | Critical | 9.8 | 2019-02-26 | Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrate… |
CVE-2019-9125 | Critical | 9.8 | 2019-02-25 | An issue was discovered on D-Link DIR-878 1.12B01 devices. Because strncpy is misused, there is a stack-based buffer overflow vulnerability that does not requi… |
CVE-2019-9082 | High | 8.8 | 2019-02-24 | ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&fun… |
CVE-2019-8985 | Critical | 9.8 | 2019-02-21 | On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not r… |
CVE-2019-0261 | Critical | 9.8 | 2019-02-15 | Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanc… |
CVE-2019-6543 | Critical | 9.8 | 2019-02-13 | AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. Code is… |
CVE-2019-6533 | Critical | 9.1 | 2019-02-12 | Registers used to store Modbus values can be read and written from the web interface without authentication in the PR100088 Modbus gateway versions prior to Re… |
CVE-2019-7390 | High | 8.6 | 2019-02-05 | An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to hijack… |
CVE-2019-7389 | High | 7.5 | 2019-02-05 | An issue was discovered in /bin/goahead on D-Link DIR-823G devices with the firmware 1.02B03. There is incorrect access control allowing remote attackers to re… |
CVE-2019-6447 | High | 8.1 | 2019-01-16 | The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute applications via TCP por… |
CVE-2018-15466 | Medium | 5.3 | 2019-01-11 | A vulnerability in the Graphite web interface of the Policy and Charging Rules Function (PCRF) of Cisco Policy Suite (CPS) could allow an unauthenticated, remo… |
CVE-2018-0181 | High | 7.3 | 2019-01-10 | A vulnerability in the Redis implementation used by the Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent software could allow an una… |
CVE-2019-0246 | Critical | 9.8 | 2019-01-08 | SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity. |
CVE-2018-18995 | Critical | 9.8 | 2019-01-03 | Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrative telnet or web int… |
CVE-2018-18264 | High | 7.5 | 2019-01-03 | Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. |
CVE-2018-19248 | Critical | 9.1 | 2018-12-24 | The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA devices allows remote attackers to uploa… |
CVE-2018-17924 | High | 8.6 | 2018-12-07 | Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could send a CIP connectio… |
CVE-2018-17906 | High | 8.8 | 2018-11-19 | Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third part… |
CVE-2018-7357 | Medium | 6.5 | 2018-11-14 | ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerability, which may al… |
CVE-2018-19079 | High | 7.5 | 2018-11-07 | An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SystemReboot metho… |
CVE-2018-13114 | Critical | 9.8 | 2018-10-22 | Missing authentication and improper input validation in KERUI Wifi Endoscope Camera (YPC99) allow an attacker to execute arbitrary commands (with a length limi… |
CVE-2018-1745 | High | 7.5 | 2018-10-11 | IBM Security Key Lifecycle Manager 2.7 and 3.0 could allow an unauthenticated user to restart the SKLM server due to missing authentication. IBM X-Force ID: 14… |
CVE-2018-16758 | Medium | 5.9 | 2018-10-10 | Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the encryption of VPN p… |
CVE-2018-17880 | High | 7.5 | 2018-10-03 | On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without authentication to trigger a reboot. |
CVE-2018-5393 | Critical | 9.8 | 2018-09-28 | The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. It utilizes a Java remote method invocation (RMI) serv… |
CVE-2018-14796 | High | 7.5 | 2018-09-20 | Tec4Data SmartCooler, all versions prior to firmware 180806, the device responds to a remote unauthenticated reboot command that may be used to perform a denia… |
CVE-2018-1757 | Medium | 5.3 | 2018-09-07 | IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive information due to missing authentication in IG… |
CVE-2017-12575 | High | 7.5 | 2018-08-24 | An issue was discovered on the NEC Aterm WG2600HP2 1.0.2. The router has a set of web service APIs for access to and setup of the configuration. Some APIs don'… |
CVE-2018-11247 | Critical | 9.8 | 2018-08-15 | The JMX/RMI interface in Nasdaq BWise 5.0 does not require authentication for an SAP BO Component, which allows remote attackers to execute arbitrary code via… |
CVE-2018-10603 | Critical | 9.8 | 2018-07-31 | Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior do not perform authentication of IEC-104 control commands, which may all… |
CVE-2017-2637 | Critical | 9.9 | 2018-07-26 | A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by defaul… |
CVE-2017-3217 | High | 8.1 | 2018-07-24 | CalAmp LMU 3030 series OBD-II CDMA and GSM devices has an SMS (text message) interface that can be deployed where no password is configured for this interface… |
CVE-2017-3209 | High | 8.1 | 2018-07-24 | The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPowe… |
CVE-2018-0377 | Critical | 9.8 | 2018-07-18 | A vulnerability in the Open Systems Gateway initiative (OSGi) interface of Cisco Policy Suite before 18.1.0 could allow an unauthenticated, remote attacker to… |
CVE-2018-0376 | Critical | 9.8 | 2018-07-18 | A vulnerability in the Policy Builder interface of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to access the Policy Builde… |
CVE-2018-0374 | Critical | 9.8 | 2018-07-18 | A vulnerability in the Policy Builder database of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to connect directly to the P… |
CVE-2017-2638 | Medium | 6.5 | 2018-07-16 | It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read o… |
CVE-2016-9496 | Medium | 6.5 | 2018-07-13 | Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, lacks authentication. An unauthenticated user may send an HTTP GET reques… |
CVE-2016-6549 | Medium | 4.3 | 2018-07-13 | The Zizai Tech Nut device allows unauthenticated Bluetooth pairing, which enables unauthenticated connected applications to write data to the device name attri… |
CVE-2016-6544 | High | 7.5 | 2018-07-13 | getgps data in iTrack Easy can be modified without authentication by setting the data using the parametercmd:setothergps. This vulnerability can be exploited t… |
CVE-2018-10635 | Critical | 9.8 | 2018-07-11 | In Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100, ports 30001/TCP to 30003/TCP listen for arbitrary URScript code and execute the cod… |
CVE-2016-6541 | High | 8.8 | 2018-07-06 | TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, v… |
CVE-2016-6540 | Medium | 6.5 | 2018-07-06 | Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tra… |
CVE-2017-0919 | High | 7.5 | 2018-07-03 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resul… |
CVE-2018-7778 | Critical | 9.8 | 2018-07-03 | In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12_v1, the Web Interface has an issue that may allow a remote attacker to gain administr… |
CVE-2018-4854 | High | 8.8 | 2018-07-03 | A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to port 69/udp could modi… |
CVE-2018-4853 | Critical | 9.8 | 2018-07-03 | A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to port 69/udp could modi… |
CVE-2018-8016 | Critical | 9.8 | 2018-06-28 | The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote atta… |
CVE-2011-4190 | Medium | 5.9 | 2018-06-08 | The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is simil… |
CVE-2018-11476 | High | 8.8 | 2018-05-30 | An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The dongle opens an unprotected wireless LAN that cannot be configured with encryption or a… |
CVE-2018-5486 | High | 7.8 | 2018-04-25 | NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauthorized local attack… |
CVE-2018-5339 | Critical | 9.8 | 2018-04-18 | An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions. |
CVE-2018-5338 | Critical | 9.8 | 2018-04-18 | An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: missing authentication/authorization for a database query mechanism. |
CVE-2018-0554 | High | 8.8 | 2018-04-09 | Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectors. |
CVE-2018-9119 | Medium | 6.1 | 2018-04-04 | An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit card numbers, and tam… |
CVE-2018-9162 | Critical | 9.8 | 2018-03-31 | Contec Smart Home 4.15 devices do not require authentication for new_user.php, edit_user.php, delete_user.php, and user.php, as demonstrated by changing the ad… |
CVE-2018-6223 | Critical | 9.8 | 2018-03-15 | A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to manipulate the registr… |
CVE-2018-0521 | High | 8.8 | 2018-03-09 | Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vec… |
CVE-2017-10854 | High | 8.8 | 2018-03-09 | Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to bypass authentication and change the login password via unspecified vectors. |
CVE-2014-7271 | High | 7.8 | 2018-03-08 | Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication. |
CVE-2018-4840 | High | 7.5 | 2018-03-08 | A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC… |
CVE-2018-4838 | High | 7.5 | 2018-03-08 | A vulnerability has been identified in EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module DNP3 variant (All versions < V1.04… |
CVE-2018-2368 | Critical | 9.8 | 2018-03-01 | SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionalities that require use… |
CVE-2018-7301 | Critical | 9.8 | 2018-02-22 | eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sending arbitrary XML-RPC requests to control… |
CVE-2018-1164 | Critical | 9.8 | 2018-02-21 | This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router 1.00(AWG.3)D5. Auth… |
CVE-2017-12720 | High | 8.1 | 2018-02-15 | An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on t… |
CVE-2018-0127 | Critical | 9.8 | 2018-02-08 | A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticate… |
CVE-2018-4834 | Critical | 9.8 | 2018-01-24 | A vulnerability has been identified in Desigo PXC00-E.D V4.10 (All versions < V4.10.111), Desigo PXC00-E.D V5.00 (All versions < V5.0.171), Desigo PXC00-E.D V5… |
CVE-2018-2360 | High | 7.5 | 2018-01-09 | SAP Startup Service, SAP KERNEL 7.45, 7.49, and 7.52, is missing an authentication check for functionalities that require user identity and cause consumption o… |
CVE-2017-18001 | Critical | 9.8 | 2017-12-31 | Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and co… |
CVE-2017-17747 | Medium | 6.5 | 2017-12-20 | Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a d… |
CVE-2017-17746 | Medium | 6.8 | 2017-12-20 | Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the device without ent… |
CVE-2017-3184 | Critical | 9.8 | 2017-12-16 | ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC fail to properly restrict access to the factory reset page. An unau… |
CVE-2017-12155 | Medium | 6.3 | 2017-12-12 | A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local… |
CVE-2017-16241 | High | 7.5 | 2017-12-10 | Incorrect access control in AMAG Symmetry Door Edge Network Controllers (EN-1DBC Boot App 23611 03.60 and STD App 23603 03.60; EN-2DBC Boot App 24451 01.00 and… |
CVE-2017-8156 | Medium | 6.8 | 2017-11-22 | The outdoor unit of Customer Premise Equipment (CPE) product B2338-168 V100R001C00 has a no authentication vulnerability on the serial port. An attacker can ac… |
CVE-2017-8155 | High | 8.4 | 2017-11-22 | The outdoor unit of Customer Premise Equipment (CPE) product B2338-168 V100R001C00 has a no authentication vulnerability on a certain port. After accessing the… |
CVE-2017-2708 | Medium | 4.6 | 2017-11-22 | The 'Find Phone' function in Nice smartphones with software versions earlier before Nice-AL00C00B0135 has an authentication bypass vulnerability. An unauthenti… |
CVE-2017-1523 | High | 7.5 | 2017-10-24 | IBM InfoSphere Master Data Management - Collaborative Edition 11.5 could allow an unauthorized user to download reports without authentication. IBM X-Force ID… |
CVE-2017-10271 | High | 7.5 | 2017-10-19 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6… |
CVE-2017-5637 | High | 7.5 | 2017-10-10 | Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the s… |