CWE-306: Missing Authentication for Critical Functionality, page 76
Filter
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
What the weakness is: CWE-306 at MITRE
Ask an AI about CWE-306
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-306: Missing Authentication for Critical Functionality and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/306.html and https://cve.bz/cve/cwe/306?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- –CVE-2007-0956EPSS 30%
The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882.
- 7.8CVE-2004-0213ExploitEPSS 20%
Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Ma…
- 7.5CVE-2002-1810EPSS 1.7%
D-Link DWL-900AP+ Access Point 2.1 and 2.2 allows remote attackers to access the TFTP server without authentication and read the config.img file, which contains sensitive information such as the administrative password, the WEP encryption …