CWE-306
Missing Authentication for Critical Function
Description
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-12 · CAPEC-166 · CAPEC-216 · CAPEC-36 · CAPEC-62
CVEs mapped to this weakness (3,337)
page 100 of 167| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-15894 | Hig | 0.49 | 7.5 | 0.02 | Jul 22, 2020 | An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin… | ||
| CVE-2020-10605 | Hig | 0.49 | 7.5 | 0.01 | Jul 17, 2020 | Grundfos CIM 500 before v06.16.00 responds to unauthenticated requests for password storage files. | ||
| CVE-2020-10044 | Hig | 0.49 | 7.5 | 0.01 | Jul 14, 2020 | A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attacker with access to the network could be able to install specially crafted firmware to the device. | ||
| CVE-2020-5910 | Hig | 0.49 | 7.5 | 0.01 | Jul 2, 2020 | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized. | ||
| CVE-2020-3402 | Hig | 0.49 | 7.5 | 0.02 | Jul 2, 2020 | A vulnerability in the Java Remote Method Invocation (RMI) interface of Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because certain RMI listeners are not… | ||
| CVE-2020-15336 | Hig | 0.49 | 7.5 | 0.01 | Jun 26, 2020 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /cnr requests. | ||
| CVE-2020-15335 | Hig | 0.49 | 7.5 | 0.01 | Jun 26, 2020 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /registerCpe requests. | ||
| CVE-2020-11961 | Hig | 0.49 | 7.5 | 0.01 | Jun 24, 2020 | Xiaomi router R3600 ROM before 1.0.50 is affected by a sensitive information leakage caused by an insecure interface get_config_result without authentication | ||
| CVE-2020-14048 | Hig | 0.49 | 7.5 | 0.05 | Jun 12, 2020 | Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents. | ||
| CVE-2020-12877 | Hig | 0.49 | 7.5 | 0.01 | May 14, 2020 | Veritas APTARE versions prior to 10.4 allowed sensitive information to be accessible without authentication. | ||
| CVE-2020-10974 | Hig | 0.49 | 7.5 | 0.02 | May 7, 2020 | An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6,… | ||
| CVE-2020-10973 | Hig | 0.49 | 7.5 | 0.08 | May 7, 2020 | An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is… | ||
| CVE-2020-10972 | Hig | 0.49 | 7.5 | 0.02 | May 7, 2020 | An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page (a certain live_?.shtml page with the variable syspasswd). Affected Devices: Wavlink… | ||
| CVE-2020-12478 | Hig | 0.49 | 7.5 | 0.09 | Apr 29, 2020 | TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files. | ||
| CVE-2020-10641 | Hig | 0.49 | 7.5 | 0.01 | Apr 28, 2020 | An unprotected logging route may allow an attacker to write endless log statements into the database without space limits or authentication. This results in consuming the entire available hard-disk space on the Ignition 8 Gateway (versions prior to 8.0.10), causing a… | ||
| CVE-2020-12266 | Hig | 0.49 | 7.5 | 0.02 | Apr 27, 2020 | An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can… | ||
| CVE-2018-21041 | Hig | 0.49 | 7.5 | 0.00 | Apr 8, 2020 | An issue was discovered on Samsung mobile devices with O(8.x) software. Access to Gallery in the Secure Folder can occur without authentication. The Samsung ID is SVE-2018-13057 (December 2018). | ||
| CVE-2020-11599 | Hig | 0.49 | 7.5 | 0.01 | Apr 6, 2020 | An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401. GetDistributedPOP3 allows attackers to obtain the username and password of the SMTP user. | ||
| CVE-2020-9349 | Hig | 0.49 | 7.5 | 0.01 | Apr 2, 2020 | The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password. | ||
| CVE-2020-10833 | Hig | 0.49 | 7.5 | 0.00 | Mar 24, 2020 | An issue was discovered on Samsung mobile devices with Q(10.0) software. The DeX Lockscreen allows attackers to access the quick panel and notifications. The Samsung ID is SVE-2019-16532 (March 2020). |
- risk 0.49cvss 7.5epss 0.02
An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin…
- risk 0.49cvss 7.5epss 0.01
Grundfos CIM 500 before v06.16.00 responds to unauthenticated requests for password storage files.
- risk 0.49cvss 7.5epss 0.01
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attacker with access to the network could be able to install specially crafted firmware to the device.
- risk 0.49cvss 7.5epss 0.01
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
- risk 0.49cvss 7.5epss 0.02
A vulnerability in the Java Remote Method Invocation (RMI) interface of Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because certain RMI listeners are not…
- risk 0.49cvss 7.5epss 0.01
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /cnr requests.
- risk 0.49cvss 7.5epss 0.01
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /registerCpe requests.
- risk 0.49cvss 7.5epss 0.01
Xiaomi router R3600 ROM before 1.0.50 is affected by a sensitive information leakage caused by an insecure interface get_config_result without authentication
- risk 0.49cvss 7.5epss 0.05
Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents.
- risk 0.49cvss 7.5epss 0.01
Veritas APTARE versions prior to 10.4 allowed sensitive information to be accessible without authentication.
- risk 0.49cvss 7.5epss 0.02
An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6,…
- risk 0.49cvss 7.5epss 0.08
An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is…
- risk 0.49cvss 7.5epss 0.02
An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page (a certain live_?.shtml page with the variable syspasswd). Affected Devices: Wavlink…
- risk 0.49cvss 7.5epss 0.09
TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files.
- risk 0.49cvss 7.5epss 0.01
An unprotected logging route may allow an attacker to write endless log statements into the database without space limits or authentication. This results in consuming the entire available hard-disk space on the Ignition 8 Gateway (versions prior to 8.0.10), causing a…
- risk 0.49cvss 7.5epss 0.02
An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can…
- risk 0.49cvss 7.5epss 0.00
An issue was discovered on Samsung mobile devices with O(8.x) software. Access to Gallery in the Secure Folder can occur without authentication. The Samsung ID is SVE-2018-13057 (December 2018).
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401. GetDistributedPOP3 allows attackers to obtain the username and password of the SMTP user.
- risk 0.49cvss 7.5epss 0.01
The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password.
- risk 0.49cvss 7.5epss 0.00
An issue was discovered on Samsung mobile devices with Q(10.0) software. The DeX Lockscreen allows attackers to access the quick panel and notifications. The Samsung ID is SVE-2019-16532 (March 2020).