CWE-306
2,554 CVEs • Abstraction: Base • Likelihood of Exploit: High
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CVEs (2,554)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Teradici 1Pcoip Management Console Jun 17, 2026 Mar 25, 2020 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the default admin account. This vulnerability only exists when the default admin acco...Show more |
An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. S-Voice leaks keyboard learned words via the lock screen. The Samsung ID is SVE-2018-12981 (February 2019). |
An issue was discovered on Samsung mobile devices with O(8.x) software. Bixby leaks the keyboard's learned words, and the clipboard contents, via the lock screen. The Samsung IDs are SVE-2018-12896, SVE-2018-12897 (May 2...Show more |
An issue was discovered on Samsung mobile devices with P(9.0) software. Quick Panel allows enabling or disabling the Bluetooth stack without authentication. The Samsung ID is SVE-2019-14545 (July 2019). |
An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. Gallery allows attackers to enable Location information sharing from the lock screen. The Samsung ID is SVE-2019-14462 (August 2...Show more |
An issue was discovered on Samsung mobile devices with P(9.0) software. Gallery allows viewing of photos on the lock screen. The Samsung ID is SVE-2019-15055 (October 2019). |
An issue was discovered on Samsung mobile devices with O(8.x) (released in China and India) software. The S Secure app can access the content of a locked app without a password. The Samsung ID is SVE-2019-13805 (October...Show more |
An issue was discovered on Samsung mobile devices with Q(10.0) software. The DeX Lockscreen allows attackers to access the quick panel and notifications. The Samsung ID is SVE-2019-16532 (March 2020). |
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can access the Developer options without authentication. The Samsung ID is SVE-2019-15800 (December 2019). |
1Motorola 4Fx9500 41324d41 Us Firmware Fx9500 41324d41 Ww FirmwareFx9500 81324d41 Us Firmware+1 moreJun 17, 2026 Mar 23, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Motorola FX9500 devices allow remote attackers to read database files. |
1Schneider Electric 1Interactive Graphical Scada System Jun 17, 2026 Mar 23, 2020 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a local user to execute processes that otherwise require escal...Show more |
In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. |
The bootloader of the homee Brain Cube V2 through 2.23.0 allows attackers with physical access to gain root access by manipulating the U-Boot environment via the CLI after connecting to the internal UART interface. |
D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't require any authentication and will lead to saving t...Show more |
Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management server. The request doesn't require any authentication and will...Show more |
1Onap 1Open Network Automation Platform Jun 17, 2026 Mar 19, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In ONAP OOM through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication...Show more |
1Onap 1Open Network Automation Platform Jun 17, 2026 Mar 19, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In ONAP DCAE through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authenticatio...Show more |
1Onap 1Open Network Automation Platform Jun 17, 2026 Mar 19, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In ONAP Logging through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentica...Show more |
1Onap 1Open Network Automation Platform Jun 17, 2026 Mar 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 In ONAP CLI through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication...Show more |
1Onap 1Open Network Automation Platform Jun 17, 2026 Mar 19, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 In ONAP MSB through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full access to the respective ONAP services without any authentication...Show more |