CWE-306 · Missing Authentication for Critical Function (page 30)
Page 30 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12822 | Critical | 9.9 | 2017-10-04 | Remote enabling and disabling admin interface in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to ne… |
CVE-2017-13997 | Critical | 9.8 | 2017-10-03 | A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8… |
CVE-2017-14350 | Critical | 9.8 | 2017-09-30 | A potential security vulnerability has been identified in HPE Application Performance Management (BSM) Platform versions 9.26, 9.30, 9.40. The vulnerability co… |
CVE-2017-1483 | High | 8.6 | 2017-09-28 | IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users a… |
CVE-2017-14417 | Critical | 9.8 | 2017-09-13 | register_send.php on D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices does not require authentication, which can result in unintended enrollme… |
CVE-2017-12733 | Critical | 9.8 | 2017-09-09 | A Missing Authentication for Critical Function issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and Site… |
CVE-2017-12440 | High | 7.5 | 2017-08-18 | Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs be… |
CVE-2017-6873 | High | 7.4 | 2017-08-08 | A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker to read and manipulate data in TLS sessi… |
CVE-2017-6872 | Medium | 6.5 | 2017-08-08 | A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker with access to port 21/tcp to access or… |
CVE-2017-4919 | Critical | 9.0 | 2017-07-28 | VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without… |
CVE-2017-4055 | High | 7.5 | 2017-07-12 | Exploitation of Authentication vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated use… |
CVE-2017-4052 | Critical | 9.8 | 2017-07-12 | Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remo… |
CVE-2017-10804 | Critical | 9.8 | 2017-07-04 | In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstan… |
CVE-2017-7315 | Critical | 9.8 | 2017-07-04 | An issue was discovered on Humax Digital HG100R 2.0.6 devices. To download the backup file it's not necessary to use credentials, and the router credentials ar… |
CVE-2017-6044 | Critical | 9.8 | 2017-06-30 | An Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4… |
CVE-2017-3216 | Critical | 9.8 | 2017-06-20 | WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated a… |
CVE-2016-10364 | Medium | 6.5 | 2017-06-16 | With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authentica… |
CVE-2015-9030 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, the Hypervisor API could be misused to bypass authentication. |
CVE-2016-7830 | High | 8.8 | 2017-06-09 | Sony PCS-XG100, PCS-XG100S, PCS-XG100C, PCS-XG77, PCS-XG77S, PCS-XG77C devices with firmware versions prior to Ver.1.51 and PCS-XC1 devices with firmware versi… |
CVE-2016-5053 | Critical | 9.8 | 2017-04-10 | OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 allows remote attackers to execute arbitrary commands via TCP port 4000. |
CVE-2015-2888 | Critical | 9.8 | 2017-04-10 | Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to bypass authentication, related to the MySnapCam web service. |
CVE-2017-3819 | High | 8.8 | 2017-03-15 | A privilege escalation vulnerability in the Secure Shell (SSH) subsystem in the StarOS operating system for Cisco ASR 5000 Series, ASR 5500 Series, ASR 5700 Se… |
CVE-2017-6409 | Critical | 9.8 | 2017-03-02 | An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. Unauthenticated CORBA interfaces permit inappropriate acc… |
CVE-2016-8355 | Critical | 9.9 | 2017-02-13 | An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. CADD-Solis Medication Safety Software grants a… |
CVE-2017-5162 | Critical | 9.8 | 2017-02-13 | An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Lack of authentication for remote service gives access to application… |
CVE-2016-9369 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2010-5326 | Critical | 10.0 | 2016-05-13 | The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to… |
CVE-2016-2004 | Critical | 9.8 | 2016-04-21 | HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to la… |
CVE-2014-9197 | | 2015-01-27 | The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, whic… | |
CVE-2014-9195 | | 2015-01-17 | Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffi… | |
CVE-2014-4872 | | 2014-10-10 | BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or… | |
CVE-2014-2590 | | 2014-04-01 | The web management interface in Siemens RuggedCom ROS before 3.11, ROS 3.11 before 3.11.5 for RS950G, ROS 3.12, and ROS 4.0 for RSG2488 allows remote attackers… | |
CVE-2011-3055 | | 2012-03-22 | The browser native UI in Google Chrome before 17.0.963.83 does not require user confirmation before an unpacked extension installation, which allows user-assis… | |
CVE-2008-6827 | High | 7.8 | 2009-06-08 | The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privilege… |
CVE-2009-1780 | | 2009-05-22 | admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain adm… | |
CVE-2007-0956 | | 2007-04-06 | The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-… | |
CVE-2004-0213 | High | 7.8 | 2004-08-06 | Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileg… |
CVE-2002-1810 | High | 7.5 | 2002-12-31 | D-Link DWL-900AP+ Access Point 2.1 and 2.2 allows remote attackers to access the TFTP server without authentication and read the config.img file, which contain… |