Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

CVEs (2,630)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2014-9197 1Schneider Electric 5Etg3000 Factorycast Hmi Gateway Firmware Tsxetg3000Tsxetg3010+2 more May 6, 2026 Jan 27, 2015 N/A· v4 N/A· v3 7.8 HIGH· v2 The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and confi...Show more The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and configuration information via a direct request.Show less
CVE-2014-9195 1Phoenixcontact Software 2Multiprog Proconos Eclr May 6, 2026 Jan 17, 2015 N/A· v4 N/A· v3 7.5 HIGH· v2 Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic.
CVE-2014-4872 1Bmc 1Track It! May 6, 2026 Oct 10, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information via...Show more BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information via a .NET Remoting request to (1) FileStorageService or (2) ConfigurationService.Show less
CVE-2014-2590 1Siemens 1Ruggedcom Rugged Operating System May 6, 2026 Apr 1, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The web management interface in Siemens RuggedCom ROS before 3.11, ROS 3.11 before 3.11.5 for RS950G, ROS 3.12, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service (interface outage) via crafted...Show more The web management interface in Siemens RuggedCom ROS before 3.11, ROS 3.11 before 3.11.5 for RS950G, ROS 3.12, and ROS 4.0 for RSG2488 allows remote attackers to cause a denial of service (interface outage) via crafted HTTP packets.Show less
CVE-2011-3055 2Google Opensuse 2Chrome Opensuse Apr 29, 2026 Mar 22, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The browser native UI in Google Chrome before 17.0.963.83 does not require user confirmation before an unpacked extension installation, which allows user-assisted remote attackers to have an unspecified impact via a craf...Show more The browser native UI in Google Chrome before 17.0.963.83 does not require user confirmation before an unpacked extension installation, which allows user-assisted remote attackers to have an unspecified impact via a crafted extension.Show less
CVE-2008-6827 1Symantec 1Altiris Deployment Solution Apr 23, 2026 Jun 8, 2009 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack...Show more The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack on the "command prompt" hidden GUI button to (1) overwrite the CommandLine parameter to cmd.exe to use SYSTEM privileges and (2) modify the DLL that is loaded using the LoadLibrary API function.Show less
CVE-2009-1780 1Frax 1Php Recommend Apr 23, 2026 May 22, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_...Show more admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_admin_pass parameters.Show less
CVE-2007-0956 3Canonical DebianMit 3Debian Linux Kerberos 5Ubuntu Linux Apr 23, 2026 Apr 6, 2007 N/A· v4 N/A· v3 10.0 HIGH· v2 The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882.
CVE-2004-0213 1Microsoft 1Windows 2000 Apr 16, 2026 Aug 6, 2004 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message...Show more Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context sensitive help and bypassing the GUI, then sending another message to winhlp32 in order to open a user-selected file, a different vulnerability than CVE-2003-0908.Show less
CVE-2002-1810 1Dlink 1Dwl 900ap+ Firmware Apr 16, 2026 Dec 31, 2002 N/A· v4 7.5 HIGH· v3 7.5 HIGH· v2 D-Link DWL-900AP+ Access Point 2.1 and 2.2 allows remote attackers to access the TFTP server without authentication and read the config.img file, which contains sensitive information such as the administrative password,...Show more D-Link DWL-900AP+ Access Point 2.1 and 2.2 allows remote attackers to access the TFTP server without authentication and read the config.img file, which contains sensitive information such as the administrative password, the WEP encryption keys, and network configuration information.Show less

Previous 1...128 129 130 131132