CWE-306: Missing Authentication for Critical Functionality, page 48
Filter
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
What the weakness is: CWE-306 at MITRE
Ask an AI about CWE-306
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-306: Missing Authentication for Critical Functionality and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/306.html and https://cve.bz/cve/cwe/306?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.5CVE-2024-54176EPSS 0.3%
IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 and IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14 and 7.3 through 7.3.2 could allow an authenticated user to obtain sensitive informat…
- 9.8CVE-2024-36555EPSS 0.4%
Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b allows malicious users to change …
- 9.8CVE-2024-9644EPSS 0.7%
The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is not enforced on some administrative functionality when using the "bapply.cgi" en…
- 7.6CVE-2024-12511EPSS 0.6%
With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access.
- 8.4CVE-2024-12957EPSS 0.2%
A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion. Refer to the '01/23/2025 Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
- 9.8CVE-2024-12857EPSS 0.8%
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly verifying a user's identity prior to logging them in as that user. This makes it po…
- 5.5CVE-2025-21559EPSS 0.7%
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attack…
- 9.8CVE-2025-21535EPSS 0.8%
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with …
- 9.8CVE-2025-21524EPSS 0.8%
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticat…
- 8.8CVE-2025-21515EPSS 0.7%
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with…
- 8.8CVE-2025-24456EPSS 0.3%
In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping
- 8.8CVE-2024-12757EPSS 0.5%
Nedap Librix Ecoreader is missing authentication for critical functions that could allow an unauthenticated attacker to potentially execute malicious code.
- 9.8CVE-2025-0456EPSS 0.8%
The airPASS from NetVision Information has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access the specific administrative functionality to retrieve * all accounts and passwords.
- 7.5CVE-2025-0355EPSS 0.5%
Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and e…
- 5.3CVE-2024-39773EPSS 0.8%
An information disclosure vulnerability exists in the testsave.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request …
- 9.8CVE-2024-39608EPSS 1.5%
A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary firmware update. An attacker can send an unauthenticated message to trigger …
- 8.1CVE-2024-39273EPSS 1.1%
A firmware update vulnerability exists in the fw_check.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary firmware update. An attacker can perform a man-in-the-middle attack to tri…
- 7.5CVE-2024-35277EPSS 0.7%
A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to access to the…
- 9.8CVE-2024-12847ExploitEPSS 30%
NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpo…
- 6.3CVE-2024-13186EPSS 0.4%
The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage.
- 6.3CVE-2024-13185EPSS 0.4%
The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage.
- 6.3CVE-2024-13173EPSS 0.4%
The health module has insufficient restrictions on loading URLs, which may lead to some information leakage.
- 7.5CVE-2025-21623EPSS 1.2%
ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allows unauthenticated attackers to change the template directory via a directory traversal, which results in a denial of service.
- 4.0CVE-2024-55538EPSS 0.2%
Sensitive information disclosure due to missing authentication. The following products are affected: Acronis True Image (macOS) before build 41725, Acronis True Image (Windows) before build 41736, Acronis True Image OEM (macOS) before buil…
- 7.5CVE-2024-12106EPSS 9.5%
In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings.
- 10.0CVE-2024-56799EPSS 0.5%
Simofa is a tool to help automate static website building and deployment. Prior to version 0.2.7, due to a design mistake in the RouteLoader class, some API routes may be publicly accessible when they should require authentication. This vu…
- 5.7CVE-2024-7726EPSS 0.4%
There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that the 2 main CPU cores of the SoC can be accessed via an open JTAG debug port tha…
- 9.8CVE-2024-54984EPSS 0.5%
An issue in Quectel BG96 BG96MAR02A08M1G allows attackers to bypass authentication via a crafted NAS message. NOTE: this is disputed by the supplier.
- 9.8CVE-2024-54983EPSS 0.5%
An issue in Quectel BC95-CNV V100R001C00SPC051 allows attackers to bypass authentication via a crafted NAS message.
- 9.3CVE-2024-12371EPSS 0.5%
A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that…
- 7.9CVE-2021-26280EPSS 0.2%
Locally installed application can bypass the permission check and perform system operations that require permission.
- 6.3CVE-2021-26278EPSS 0.2%
The wifi module exposes the interface and has improper permission control, leaking sensitive information about the device.
- 6.4CVE-2020-12484EPSS 0.2%
When using special mode to connect to enterprise wifi, certain options are not properly configured and attackers can pretend to be enterprise wifi through a carefully constructed wifi with the same name, which can lead to man-in-the-middle…
- 9.4CVE-2024-10205EPSS 0.8%
Authentication Bypass vulnerability in Hitachi Ops Center Analyzer on Linux, 64 bit (Hitachi Ops Center Analyzer detail view component), Hitachi Infrastructure Analytics Advisor on Linux, 64 bit (Hitachi Data Center Analytics component …
- 9.8CVE-2024-11639EPSS 4.9%
An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access
- 8.2CVE-2024-10776EPSS 0.5%
Lua apps can be deployed, removed, started, reloaded or stopped without authorization via AppManager. This allows an attacker to remove legitimate apps creating a DoS attack, read and write files or load apps that use all features of the p…
- 7.3CVE-2024-10774EPSS 0.5%
Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication.
- 5.3CVE-2024-54155EPSS 0.4%
In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication
- 6.5CVE-2024-54153EPSS 0.4%
In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter
- 8.8CVE-2024-42456EPSS 0.4%
A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuration settings, such as modifying the trusted client certificate used for authentica…
- 8.1CVE-2024-42455EPSS 16%
A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. This exploit allows the attacker to delete a…
- 8.8CVE-2024-40717EPSS 0.8%
A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located…
- 5.3CVE-2024-37303EPSS 0.4%
Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such…
- 8.8CVE-2024-50381EPSS 0.5%
A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim and unclaim devices. The attacker only needs to provide the MAC address of the targeted device and can make a request t…
- 7.5CVE-2024-53623EPSS 0.4%
Incorrect access control in the component l_0_0.xml of TP-Link ARCHER-C7 v5 allows attackers to access sensitive information.
- 3.1CVE-2024-53701EPSS 0.2%
Multiple FCNT Android devices provide the original security features such as "privacy mode" where arbitrary applications can be set not to be displayed, etc. Under certain conditions, and when an attacker can directly operate the device w…
- 8.6CVE-2024-11980EPSS 0.5%
Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID,…
- 9.8CVE-2024-49052EPSS 0.7%
Missing authentication for critical function in Microsoft Azure PolicyWatch allows an unauthorized attacker to elevate privileges over a network.
- 9.8CVE-2024-50375EPSS 1.0%
A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can …
- 9.8CVE-2024-11680KEVExploitEPSS 92%
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of th…