Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

CVEs (2,617)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-27256 1Idattend 1Idweb Jun 17, 2026 Oct 25, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Missing authentication in the GetLogFiles method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of sensitive log files by unauthenticated attackers.
CVE-2023-26580 1Idattend 1Idweb Jun 17, 2026 Oct 25, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated attackers.
CVE-2023-26579 1Idattend 1Idweb Jun 17, 2026 Oct 25, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Missing authentication in the DeleteStaff method in IDAttend’s IDWeb application 3.1.013 allows deletion of staff information by unauthenticated attackers.
CVE-2023-26576 1Idattend 1Idweb Jun 17, 2026 Oct 25, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Missing authentication in the SearchStudentsRFID method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers.
CVE-2023-26575 1Idattend 1Idweb Jun 17, 2026 Oct 25, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Missing authentication in the SearchStudentsStaff method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student and teacher data by unauthenticated attackers.
CVE-2023-26574 1Idattend 1Idweb Jun 17, 2026 Oct 25, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Missing authentication in the SearchStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers.
CVE-2023-26573 1Idattend 1Idweb Jun 17, 2026 Oct 25, 2023 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Missing authentication in the SetDB method in IDAttend’s IDWeb application 3.1.052 and earlier allows denial of service or theft of database login credentials.
CVE-2023-26571 1Idattend 1Idweb Jun 17, 2026 Oct 25, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Missing authentication in the SetStudentNotes method in IDAttend’s IDWeb application 3.1.052 and earlier allows modification of student data by unauthenticated attackers.
CVE-2023-26570 1Idattend 1Idweb Jun 17, 2026 Oct 25, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Missing authentication in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers.
CVE-2023-43045 1Ibm 1Sterling Partner Engagement Manager Jun 17, 2026 Oct 23, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM X-Force ID: 266896.
CVE-2023-22101 1Oracle 1Weblogic Server Jun 17, 2026 Oct 17, 2023 N/A· v4 8.1 HIGH· v3 N/A· v2 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthent...Show more Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).Show less
CVE-2023-22087 1Oracle 1Hospitality Opera 5 Property Services Jun 17, 2026 Oct 17, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). The supported version that is affected is 5.6. Easily exploitable vulnerability allows low privi...Show more Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). The supported version that is affected is 5.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in takeover of Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).Show less
CVE-2023-22072 1Oracle 1Weblogic Server Jun 17, 2026 Oct 17, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker...Show more Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).Show less
CVE-2023-22069 1Oracle 1Weblogic Server Jun 17, 2026 Oct 17, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthentic...Show more Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).Show less
CVE-2023-44116 1Huawei 2Emui Harmonyos Jun 17, 2026 Oct 11, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may cause some apps to run without being authorized.
CVE-2023-43271 170mai 1A500s Firmware Jun 17, 2026 Oct 9, 2023 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other protocols.
CVE-2023-4884 1Open5gs 1Open5gs Jun 17, 2026 Oct 3, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 An attacker could send an HTTP request to an Open5GS endpoint and retrieve the information stored on the device due to the lack of Authentication.
CVE-2023-4506 1Miniorange 1Active Directory Integration / Ldap Integration Jun 17, 2026 Sep 27, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This...Show more The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.Show less
CVE-2023-4505 1Miniorange 1Staff / Employee Business Directory For Active Directory Jun 17, 2026 Sep 27, 2023 N/A· v4 4.9 MEDIUM· v3 N/A· v2 The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP serv...Show more The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.Show less
CVE-2023-44152 1Acronis 1Cyber Protect Jun 17, 2026 Sep 27, 2023 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.

Previous 1...777879...131 Next