CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +14 more +16 moreWindows Modern Device Management (MDM) Tampering Vulnerability4.7 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 moreWindows SmartScreen Tampering Vulnerability5.5 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 moreWindows Push Notifications Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Remote Access Connection Manager Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability8.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 moreWindows Notification Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Error Reporting Tampering Vulnerability7.1 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +14 more +16 moreWindows Modern Device Management (MDM) Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 moreWindows Credential Guard Spoofing Vulnerability8.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows Health and Optimized Experiences Service Information Disclosure Vulnerability5.5 Medium
- microsoft dynamics nav 2018Dynamics Business Central Information Disclosure Vulnerability7.5 High
- swann communications swifi-se2kicMissing authentication for critical function in Swann Communications SWIFI-SE2KIC6.9 Medium
- swann communications swifi-se2kicMissing authentication for critical function in Swann Communications SWIFI-SE2KIC6.9 Medium
- swann communications swifi-se2kicMissing authentication for critical function in Swann Communications SWIFI-SE2KIC5.9 Medium
- fushengqian fuintfuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail8.7 High
- fj-oms oms-erpoms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints6.9 Medium
- zarestia-dev rclone-managerRClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page9.6 Critical
- ivanti xtractionA Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version...7.5 High
- esri portal for arcgisBUG-000187331 Portal for ArcGIS has a security vulnerability9.8 Critical
- commvault cloud, grid(hsx) cvfs +1 moreCVFS Missing Authentication7.7 High
- nvidia nvsentinelNVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors component, where...6.0 Medium
- nvidia aistore frameworkNVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation...9.1 Critical
- jtl sw gmbh jtl-wmsMissing Authentication Vulnerability in JTL-WMS10.0 Critical
- rapid7 metasploit frameworkMetasploit Framework Web Service REST API Missing Authentication on Credential Endpoints9.8 Critical
- fire-boltt bsw013Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE2.3 Low
- fire-boltt bsw013Fire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection5.3 Medium
- 0xjacky nginx-uiNginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover8.8 High
- haproxy data plane api ce, data plane api ee +1 moreIn HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases),...9.8 Critical
- kusalkasilva learning-management-systemKusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication6.9 Medium
- zitadelZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V18.8 High
- surrealdbSurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method5.3 Medium
- neo4j @neo4j/graphql@neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields9.3 Critical
- progress sharefile storage zones controllerUnauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller6.5 Medium
- agnoagno-agi agno auth.py get_authentication_dependency missing authentication6.9 Medium
- katanemo planoKatanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface8.7 High
- nexting pinclawNexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/send7.1 High
- openagents-org openagentsOpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces8.7 High
- chenhg5 cc-connectcc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing9.2 Critical
- iflytek astron-agentAstron Agent: Unsandboxed code-node leads to cross-tenant RCE9.9 Critical
- duty1g x64dbg-mcp-serverx64dbg-MCP Server exposes debugger operations to unauthenticated network clients9.3 Critical
- pyloadpyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo5.3 Medium
- red lion controls 700 seriesRed Lion Controls N-Tron 700 Series Missing Authentication for Critical Function9.3 Critical
- grid protection alliance openhistorian, openpdc, openpdc (docker image) +2 moreGrid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function6.9 Medium
- grid protection alliance openhistorian, openpdc, openpdc (docker image) +2 moreGrid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function8.7 High
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a...7.5 High
- microsoft azure app service for linuxAzure App Service Remote Code Execution Vulnerability9.8 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by vulnerability9.8 Critical
- zuler technology deskinDeskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer8.5 High
- dromara skyeyeDromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE9.3 Critical
- tvu networks receiver / transceiverTVU Networks Receiver/Transceiver Missing Authentication via REST API9.3 Critical
- Show moreLoading…