cve.bz

CWE-306: Missing Authentication for Critical Functionality, page 50

Filter

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

What the weakness is: CWE-306 at MITRE

Ask an AI about CWE-306

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-306: Missing Authentication for Critical Functionality and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/306.html and https://cve.bz/cve/cwe/306?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2024-49604EPSS 0.5%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in N-Media Simple User Registration wp-registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through <= 6.7.

  2. 9.8CVE-2024-49328EPSS 1.5%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Authentication Bypass.This issue affects WP REST API FNS: from n/a through <= 1.0.0.

  3. 8.7CVE-2024-49399EPSS 0.4%

    The affected product is vulnerable to an attacker being able to use commands without providing a password which may allow an attacker to leak information.

  4. 9.1CVE-2024-48920EPSS 0.5%

    PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unauthorized access, enabling users to perform admin-level operations, potentially co…

  5. 8.1CVE-2024-9861EPSS 0.6%

    The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through t…

  6. 8.6CVE-2024-45844EPSS 11%

    BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  7. 8.7CVE-2023-22650EPSS 0.6%

    A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher wil…

  8. 7.5CVE-2024-21272EPSS 0.5%

    Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access v…

  9. 7.5CVE-2024-5749EPSS 1.2%

    Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials.

  10. 7.5CVE-2024-45276EPSS 0.6%

    An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication.

  11. 9.8CVE-2024-45274EPSS 1.5%

    An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.

  12. 9.8CVE-2024-9984EPSS 0.6%

    Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated remote attackers to use this functionality to obtain any user's session cookie.

  13. 7.5CVE-2024-48791EPSS 0.5%

    An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive information via the firmware update process

  14. 8.8CVE-2024-9137EPSS 0.5%

    The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of c…

  15. 7.5CVE-2024-48777EPSS 0.4%

    LEDVANCE com.ledvance.smartplus.eu 2.1.10 allows a remote attacker to obtain sensitive information via the firmware update process.

  16. 7.5CVE-2024-48776EPSS 0.4%

    An issue in Shelly com.home.shelly 1.0.4 allows a remote attacker to obtain sensitive information via the firmware update process

  17. 7.5CVE-2024-48775EPSS 0.4%

    An issue in Plug n Play Camera com.ezset.delaney 1.2.0 allows a remote attacker to obtain sensitive information via the firmware update process.

  18. 7.5CVE-2024-48774EPSS 0.4%

    An issue in Fermax Asia Pacific Pte Ltd com.fermax.vida 2.4.6 allows a remote attacker to obtain sensitve information via the firmware update process.

  19. 7.5CVE-2024-48773EPSS 0.4%

    An issue in WoFit v.7.2.3 allows a remote attacker to obtain sensitive information via the firmware update process

  20. 7.5CVE-2024-48771EPSS 0.4%

    An issue in almando GmbH Almando Play APP (com.almando.play) 1.8.2 allows a remote attacker to obtain sensitive information via the firmware update process

  21. 7.5CVE-2024-48768EPSS 0.5%

    An issue in almaodo GmbH appinventor.ai_google.almando_control 2.3.1 allows a remote attacker to obtain sensitive information via the firmware update process

  22. 5.9CVE-2024-8530EPSS 0.5%

    CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generated “logcaptures” archive is accessed directly by HTTPS.

  23. 8.8CVE-2024-9164EPSS 1.0%

    An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.

  24. 8.8CVE-2024-9522EPSS 0.5%

    The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to incorrect authentication and capability checking in the 'ajax_masq_login' function. This makes it p…

  25. 9.8CVE-2024-43488EPSS 1.2%

    Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.

  26. 9.8CVE-2024-8943ExploitEPSS 3.1%

    The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insufficient verification on the user being supplied during the booking customer step. This makes it possib…

  27. 8.3CVE-2024-47555EPSS 0.2%

    Missing Authentication - User & System Configuration

  28. 9.3CVE-2024-41988EPSS 0.6%

    TEM Opera Plus FM Family Transmitter allows access to an unprotected endpoint that allows MPFS File System binary image upload without authentication. This file system serves as the basis for the HTTP2 web server module but is also used by…

  29. 6.5CVE-2024-35294EPSS 0.5%

    An unauthenticated remote attacker may use the devices traffic capture without authentication to grab plaintext administrative credentials.

  30. 9.1CVE-2024-35293EPSS 0.6%

    An unauthenticated remote attacker may use a missing authentication for critical function vulnerability to reboot or erase the affected devices resulting in data loss and/or a DoS.

  31. 9.8CVE-2024-9289EPSS 0.6%

    The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is due to the rtwwwap_login_request_callback() function not properly validating a u…

  32. 10.0CVE-2024-42017EPSS 0.5%

    An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenario, if the application is remotely accessible, it allows an attacker to execute arbitrary commands …

  33. 9.8CVE-2024-46293EPSS 0.4%

    Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Incorrect Access Control. There is a lack of authorization checks for admin operations. Specifically, an attacker can perform admin-level actions without possessing a vali…

  34. 9.8CVE-2024-8456EPSS 0.6%

    Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining …

  35. 7.0CVE-2024-39364EPSS 0.2%

    Advantech ADAM-5630 has built-in commands that can be executed without authenticating the user. These commands allow for restarting the operating system, rebooting the hardware, and stopping the execution. The commands can be sent to a…

  36. 9.8CVE-2024-8310EPSS 0.7%

    OPW Fuel Management Systems SiteSentinel could allow an attacker to bypass authentication to the server and obtain full admin privileges.

  37. 9.3CVE-2024-6981EPSS 0.6%

    OMNTEC Proteus Tank Monitoring OEL8000III Series could allow an attacker to perform administrative actions without proper authentication.

  38. 8.7CVE-2024-47130EPSS 0.2%

    The goTenna Pro App allows unauthenticated attackers to remotely update the local public keys used for P2P and group messages. It is advised to update your app to the current release for enhanced encryption protocols.

  39. 9.8CVE-2024-7781EPSS 1.0%

    The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5. This is due to improper authentication via the Social Login widget. This makes it possible for unauthenticated atta…

  40. 5.5CVE-2023-52949EPSS 0.2%

    Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors.

  41. 3.3CVE-2023-52947EPSS 0.2%

    Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local users to logout the client via unspecified vectors. The backup functionality wil…

  42. 9.3CVE-2024-6592EPSS 1.2%

    An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker wit…

  43. 6.6CVE-2024-45229EPSS 0.5%

    The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registration, do not require authentication. However, it was discovered that for Directors …

  44. 7.5CVE-2022-25770EPSS 0.3%

    Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a…

  45. 8.5CVE-2024-6406EPSS 0.4%

    Missing Authentication for Critical Function, Missing Authorization vulnerability in Yordam Information Technology Mobile Library Application allows Retrieve Embedded Sensitive Data. This issue affects Mobile Library Application: before 5…

  46. 9.1CVE-2024-8956KEVEPSS 59%

    PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header.…

  47. 4.3CVE-2024-6582EPSS 0.4%

    A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Identity Provider (IDP) settings and view the SSO metadata of another organization…

  48. 7.5CVE-2024-8751EPSS 0.9%

    A vulnerability allows a remote unauthenticated attacker to modify the prod uct’s IP address over the Sopas ET interface. This can lead to a Denial of Service attack.

  49. 9.8CVE-2024-8277EPSS 1.6%

    The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due to the plugin not properly validating what user transient is being used in the lo…

  50. 8.6CVE-2024-8321EPSS 1.8%

    Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to isolate managed devices from the network.