CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- tp-link systems inc tapo c120 v1, tp-link systems inc. tapo c200 v5 +1 moreUnauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C2007.1 High
- tp-link systems inc tapo c120 v1, tp-link systems inc. tapo c200 v5 +1 moreUnauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C2005.3 Medium
- redhat satellite, theforeman foreman, red hat satellite 6 +5 more +7 moreForeman: unauthenticated information disclosure via provisioning token validation flaw7.5 High
- elastic endpoint securityWatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access9.3 Critical
- apache http serverApache HTTP Server: mod_auth_digest reauthentication attack7.5 High
- sgoudelis ground-stationground-station before 0.8.0 Authentication Bypass via setup.restore9.3 Critical
- red hat assisted installer for red hat openshift container platform 2, openshift container platform 4.18, openshift container platform 4.19 +4 more +6 moreOc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled7.1 High
- comelit group s.p.a. 1456b multi-user gatewayComelit 1456B gateway exposes remote configuration password via unauthenticated management interface7.5 High
- zongxr supermarketZongXR SuperMarket Instant Buy InstantBuyController.java startBuy missing authentication5.3 Medium
- hitachi industrial equipment systems coding software suiteMissing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed9.3 Critical
- genians, inc genian nac 5.0.75 lts release, genian nac 5.0.85 release stable, genian nac 5.0.86 release +3 more +5 moreGenians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface9.3 Critical
- zongxr supermarketZongXR SuperMarket Order Deletion Endpoint OrderController.java OrderController.deleteOrder missing authentication6.9 Medium
- zongxr supermarketZongXR Supermarket save Endpoint OrderController.java OrderController.addOrder missing authentication6.9 Medium
- accellion kiteworks, kiteworks core +1 moreMissing authentication on a Kiteworks appliance setup function5.9 Medium
- accellion kiteworks, kiteworks secure data forms +1 moreKiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor8.6 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Missing Authentication for Critical Function6.5 Medium
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type7.5 High
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway Uncontrolled Resource Consumption5.3 Medium
- accellion kiteworks, kiteworks secure data forms +1 moreKiteworks Secure Data Forms Missing Authentication for Critical Function7.2 High
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway Improper Access Control9.4 Critical
- taskclusterTaskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)8.7 High
- embysupport securitySoft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private network8.3 High
- ptzoptics link 4k 12x, link 4k 20x, link 4k 30x +21 more +23 morePTZOptics Missing Authentication in Firmware Upload9.1 Critical
- modeltc lightllmLightLLM through 1.2.0 Missing Authentication on RL Control Routes8.7 High
- trex digital smart manufacturing systems inc. mesMissing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MES8.8 High
- digiwin easyflow .netDigiWin｜EasyFlow .NET - Missing Authentication9.3 Critical
- basercms user community basercmsA missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information.6.9 Medium
- beenuar aisocAiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints5.3 Medium
- beenuar aisocAiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API5.3 Medium
- finsys dockhandDockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints9.2 Critical
- rochacbruno marmiteMarmite through 0.4.2 Unauthenticated API Access via Development Server8.7 High
- apache dolphinschedulerApache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource6.5 Medium
- hitachi energy asset suiteAsset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet,...5.1 Medium
- hitachi energy asset suiteAsset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used...8.5 High
- hitachi energy rtu500 series cmu firmwareAn authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500...9.1 Critical
- progress software progress® telerik® fiddler® everywhereMissing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere7.7 High
- modsetter surfsenseMODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication6.9 Medium
- gz-yami mall4jmall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number6.3 Medium
- gz-yami mall4jmall4j through 4.0 Missing Authentication in Product Review Deletion6.9 Medium
- gz-yami mall4jmall4j through 4.0 Missing Authentication in Password Update Endpoint9.3 Critical
- dannymcc bluehoodBluehood: Missing authentication on Bluehood API routes when web auth is enabled9.1 Critical
- marcoscamara01 ecommerce templateMissing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service6.9 Medium
- netcore nr289-geNetcore NR289-GE boa_temp process_request missing authentication10.0 Critical
- suse rancher, rancher fleet +1 moreUnauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver5.4 Medium
- kaon ar2140Missing authentication for backup functionality in Kaon AR2140X7.1 High
- f&f filipowski mh-developerMissing Authentication in mH-DEVELOPER6.4 Medium
- apache software foundation rollerApache Roller: Anonymous setup action allows frontpage configuration tampering8.2 High
- notionnext-org notionnextnotionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication6.9 Medium
- ооо нпо ритм georitmООО НПО Ритм GEOritm REST API obj-groups missing authentication6.9 Medium
- obot-platform obotObot Quickstart Docker Deployment Unauthenticated Admin Access9.3 Critical
- Show moreLoading…