CWE-306: Missing Authentication for Critical Functionality, page 49
Filter
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
What the weakness is: CWE-306 at MITRE
Ask an AI about CWE-306
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-306: Missing Authentication for Critical Functionality and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/306.html and https://cve.bz/cve/cwe/306?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.3CVE-2024-33616EPSS 0.9%
Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states the telnet feature is implemented on older models only, and is planning to prov…
- 1.0CVE-2020-12492EPSS 0.2%
Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information.
- 4.8CVE-2020-12491EPSS 0.2%
Improper control of framework service permissions with possibility of some sensitive device information leakage.
- 9.3CVE-2024-47138EPSS 0.8%
The administrative interface listens by default on all interfaces on a TCP port and does not require authentication when being accessed.
- 8.1CVE-2024-5721ExploitEPSS 6.0%
Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication i…
- 8.1CVE-2024-5718EPSS 1.5%
Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication i…
- 9.3CVE-2024-38643EPSS 0.9%
A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to gain access to and execute certain functions. We have already fixed …
- 9.8CVE-2024-21855EPSS 2.0%
A lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger this vul…
- 8.8CVE-2024-52438EPSS 0.5%
Missing Authentication for Critical Function vulnerability in deco.agency de:branding debranding allows Privilege Escalation.This issue affects de:branding: from n/a through <= 1.0.2.
- 8.8CVE-2024-52437EPSS 0.5%
Missing Authentication for Critical Function vulnerability in Saul Morales Pacheco Banner System banner-system allows Privilege Escalation.This issue affects Banner System: from n/a through <= 1.0.0.
- 5.3CVE-2024-47865EPSS 0.4%
Missing authentication for critical function vulnerability exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote unauthenticated attacker may update or downgrade the firmware on the d…
- 9.3CVE-2024-0012KEVExploitEPSS 99.7%
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with t…
- 8.8CVE-2024-41969EPSS 0.5%
A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full system access and/or DoS.
- 5.4CVE-2024-41968EPSS 0.3%
A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.
- 8.1CVE-2024-41967EPSS 0.4%
A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denial-of-service attack.
- 9.8CVE-2024-10924ExploitEPSS 82%
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with…
- 10.0CVE-2024-48966EPSS 0.7%
The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the tes…
- 5.3CVE-2024-39707EPSS 0.2%
Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could lead to a possible roll-back attack in certain platforms. This is fixed in: kernel 5.2, version 05.29…
- 7.3CVE-2024-40408EPSS 0.3%
Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section. This vulnerability allows attackers to create arbitrary user profiles with elevated privileges.
- 8.1CVE-2024-40405EPSS 0.5%
Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request.
- 9.8CVE-2024-40404EPSS 0.5%
Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are established.
- 7.8CVE-2024-47574EPSS 0.5%
A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0, and 6.4.10 through 6.4.0 allows low privilege attacker to execute arbitra…
- 7.0CVE-2024-7516EPSS 0.3%
A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle attackers to conduct remote Service Session Hijacking that may arise from the attacker's ability to forge an SSH key while the Brocade Fabric OS Switc…
- 9.8CVE-2024-26011EPSS 0.6%
A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11, FortiManager 6.4.0 through 6.4.14, FortiOS 7.4.0 through 7.4.3,…
- 9.3CVE-2024-8074EPSS 0.4%
Missing Authentication for Critical Function, Missing Authorization vulnerability in Nomysoft Informatics Nomysem allows Collect Data as Provided by Users. This issue affects Nomysem: before 13.10.2024.
- 9.8CVE-2024-10284EPSS 0.4%
The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded encryption key in the 'ce21_authentication_phrase' function. This makes it possible for unauthenti…
- 7.5CVE-2024-50589EPSS 0.6%
An unauthenticated attacker with access to the local network of the medical office can query an unprotected Fast Healthcare Interoperability Resources (FHIR) API to get access to sensitive electronic health records (EHR).
- 7.5CVE-2024-48953EPSS 0.3%
An issue was discovered in Logpoint before 7.5.0. Endpoints for creating, editing, or deleting third-party authentication modules lacked proper authorization checks. This allowed unauthenticated users to register their own authentication p…
- 6.4CVE-2024-48952EPSS 0.3%
An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authentication. This static key vulnerability enables attackers to create custom JWT sec…
- 7.5CVE-2024-48950EPSS 0.3%
An issue was discovered in Logpoint before 7.5.0. An endpoint used by Distributed Logpoint Setup was exposed, allowing unauthenticated attackers to bypass CSRF protections and authentication.
- 6.5CVE-2024-51493EPSS 0.3%
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim's Octo…
- 6.5CVE-2024-51362EPSS 0.3%
The LSC Smart Connect Indoor IP Camera V7.6.32 is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized use…
- 5.3CVE-2024-9430EPSS 0.4%
The Get Quote For Woocommerce – Request A Quote For Woocommerce plugin for WordPress is vulnerable to unauthorized access of Quote data due to a missing capability check on the ct_tepfw_wp_loaded function in all versions up to, and includi…
- 9.8CVE-2024-51567KEVExploitEPSS 84%
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is …
- 8.8CVE-2024-50488EPSS 0.9%
Authentication Bypass Using an Alternate Path or Channel vulnerability in yespbs Token Login token-login allows Authentication Bypass.This issue affects Token Login: from n/a through <= 1.0.3.
- 9.8CVE-2024-50489EPSS 0.5%
Authentication Bypass Using an Alternate Path or Channel vulnerability in realtyworkstation Realty Workstation realty-workstation allows Authentication Bypass.This issue affects Realty Workstation: from n/a through <= 1.0.45.
- 9.8CVE-2024-50487EPSS 0.5%
Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo MaanStore API maanstore-api allows Authentication Bypass.This issue affects MaanStore API: from n/a through <= 1.0.1.
- 9.8CVE-2024-50486EPSS 0.5%
Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo Acnoo Flutter API acnoo-flutter-api allows Authentication Bypass.This issue affects Acnoo Flutter API: from n/a through <= 1.0.5.
- 9.8CVE-2024-50477ExploitEPSS 8.1%
Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypass.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
- 9.3CVE-2024-10386EPSS 19%
CVE-2024-10386 IMPACT An authentication vulnerability exists in the affected product. The vulnerability could allow a threat actor with network access to send crafted messages to the device, potentially resulting in database manipulatio…
- 9.8CVE-2024-47406EPSS 0.6%
Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability.
- 6.5CVE-2024-48442EPSS 0.3%
Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 allows attackers to access the SSH protocol without authentication.
- 6.9CVE-2024-47902EPSS 0.5%
A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The…
- 9.8CVE-2024-47575KEVExploitEPSS 95%
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.…
- 9.0CVE-2024-26519EPSS 0.3%
An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the /www/cgi-bin/nas.cgi component.
- 7.8CVE-2022-23862EPSS 0.5%
A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Au…
- 8.8CVE-2024-10002EPSS 0.6%
The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insufficient validation and capability check on the 'rover_idx_refresh_social_callback' function. This m…
- 5.3CVE-2024-40091EPSS 0.4%
Vilo 5 Mesh WiFi System <= 5.16.1.33 lacks authentication in the Boa webserver, which allows remote, unauthenticated attackers to retrieve logs with sensitive system.
- 9.6CVE-2024-40087EPSS 0.4%
Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the router.
- 8.2CVE-2024-47912EPSS 0.4%
A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to perform unauthorized data-access attacks due to missing authentication m…