CWE-306

High likelihood

Missing Authentication for Critical Function

Parent: CWE-287 - Improper Authentication

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

2,452 vulnerabilities with CWE-306
CVE-2019-15043 HIGH
Grafana 2.x-6.x < 6.3.4 - Unauthenticated Denial of Service via HTTP API
CVSS 7.5
CVE-2019-15858 HIGH
Woody ad snippets < 2.2.5 - Unauthenticated Options Import
CVSS 8.8
CVE-2019-15819 CRITICAL
nd-restaurant-reservations <1.5 - Info Disclosure
CVSS 9.8
CVE-2019-13406 HIGH
Advan VD-1 Firmware < 230 - Unauthenticated Arbitrary APK Installation via ApkUpload.cgi
CVSS 7.5
CVE-2019-13405 CRITICAL
Advan VD-1 Firmware 230 - Unauthenticated ADB Service Enablement via AdbSetting.cgi
CVSS 9.8
CVE-2019-11063 CRITICAL
ASUS SmartHome < 2.0.22 (iOS) & < 3.0.42_190515 (Android) - Unauthenticated Device Control
CVSS 10.0
CVE-2019-11061 CRITICAL
ASUS HG100 Firmware < 4.00.09 - Unauthenticated IoT Device Control via SmartHome DeviceControl Endpoint
CVSS 10.0
CVE-2019-9935 MEDIUM
Lexmark Products - Privilege Escalation
CVSS 5.3
CVE-2019-9934 MEDIUM
Lexmark - Privilege Escalation
CVSS 5.3
CVE-2019-15506 HIGH
Kaseya VSA < 9.4.0.37 - Unauthenticated Sensitive Information Disclosure
CVSS 7.5
CVE-2019-14511 HIGH
Sphinx Technologies Sphinx 3.1.1 - No Auth
CVSS 7.5
CVE-2019-12634 HIGH
Cisco Integrated Management Controlle... - Missing Authentication
CVSS 7.5
CVE-2019-15129 MEDIUM
Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 - Unauthenticated Arbitrary File Access via Recruitment Module
CVSS 5.3
CVE-2019-15106 CRITICAL
ManageEngine OpManager < 12.4.034 - Unauthenticated Remote Command Execution via Default Credential Bypass
CVSS 9.8
CVE-2019-9585 CRITICAL
eQ-3 Homematic CCU2 <2.47.10 & CCU3 <3.47.10 - Info Disclosure
CVSS 9.8
CVE-2019-14984 HIGH
eQ-3 Homematic CCU2 and CCU3 XML-API < 1.2.0 - Unauthenticated Remote Code Execution via exec.cgi
CVSS 8.1
CVE-2019-13101 CRITICAL
D-Link DIR-600M Firmware 3.02-3.06 - Unauthenticated Information Disclosure and Data Modification via wan.htm
CVSS 9.8
CVE-2019-1895 CRITICAL
Cisco Enterprise NFV Infrastructure Software < 3.12.1 - Unauthenticated VNC Console Session Hijacking
CVSS 9.8
CVE-2019-10198 MEDIUM
Foreman-tasks <0.15.7 - Auth Bypass
CVSS 6.5
CVE-2019-5451 MEDIUM
Nextcloud Android App < 3.6.1 - Unauthenticated Lock Protection Bypass
CVSS 4.6
CVE-2019-3948 HIGH
Amcrest IP2M-841B and Dahua Cameras < 2018-05-18 - Unauthenticated Audio Stream Access via /videotalk Endpoint
CVSS 7.5
CVE-2019-1010136 HIGH
ChinaMobile GPN2.4P21-C-CN W2001EN-00 - Unauthenticated RCE
CVSS 7.5
CVE-2019-13983 CRITICAL
Directus 7 <2.2.2 - Info Disclosure
CVSS 9.8
CVE-2019-10915 HIGH
TIA Administrator < V1.0 SP1 Upd1 - Unauthenticated Critical Function Access
CVSS 7.8
CVE-2019-12468 CRITICAL
MediaWiki 1.27.0-1.32.1 - Incorrect Access Control via Special:ChangeEmail
CVSS 9.8
Details
Vulnerabilities 2,452
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits