Fallos del tipo CWE-306

3080 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2026-59726CRITICALRuflo: Unauthenticated RCE in MCP bridge default docker-compose deploymentEPSS 3.0%CVE-2025-34113HIGHTiki Wiki CMS Authenticated Command Injection in Calendar ModuleEPSS 3.0%CVE-2025-15517HIGHAuthorization Bypass in HTTP Server Endpoints on TP-Link Archer NX200, NX210, NX500 and NX600EPSS 2.9%CVE-2022-0992CRITICALSiteGround Security <= 1.2.5 - Authentication Bypass via 2FA SetupEPSS 2.9%CVE-2020-12500CRITICALPepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx productsEPSS 2.9%CVE-2022-0424—Popup by Supsystic < 1.10.9 - Unauthenticated Subscriber Email Addresses DisclosureEPSS 2.8%CVE-2025-34112CRITICALRiverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCEEPSS 2.8%CVE-2025-34121CRITICALIdera Up.Time ≤ 7.2 post2file.php Arbitrary File Upload RCEEPSS 2.8%CVE-2020-10921CRITICALThis vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen EPSS 2.8%CVE-2026-46339CRITICAL9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routesEPSS 2.8%CVE-2026-42796CRITICALArelle < 2.39.10 Unauthenticated RCE via /rest/configureEPSS 2.7%CVE-2019-10919—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Attackers with access to port 10005/tcp couEPSS 2.7%CVE-2014-125116CRITICALHybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration InjectionEPSS 2.7%CVE-2019-5163MEDIUMAn exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream CiphEPSS 2.7%CVE-2021-43832CRITICALImproper Access Control in spinnakerEPSS 2.7%CVE-2019-18339CRITICALA vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The HTTP service (default port 5401/tcp) of the SiVEPSS 2.7%CVE-2018-18995—Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrativEPSS 2.6%CVE-2026-85688CRITICALTEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN DesignerEPSS 2.6%CVE-2019-10922—A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All versions), SIMATIC WEPSS 2.6%CVE-2018-0376—A vulnerability in the Policy Builder interface of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to accesEPSS 2.6%