Fallos del tipo CWE-306

3081 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2018-0376—A vulnerability in the Policy Builder interface of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to accesEPSS 2.6%CVE-2018-0374—A vulnerability in the Policy Builder database of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to connecEPSS 2.6%CVE-2026-59801CRITICAL9Router 0.4.41 - Unauthenticated API Exposure via /api/providersEPSS 2.6%CVE-2013-2056HIGHRed hat network satellite: red hat network satellite: information disclosure via inter-satellite sync (iss) authentication bypassEPSS 2.6%CVE-2012-10030CRITICALFreeFloat FTP Server Arbitrary File UploadEPSS 2.6%CVE-2025-34111CRITICALTiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCEEPSS 2.6%CVE-2022-46414CRITICALAn issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Unauthenticated remote command exeEPSS 2.5%CVE-2020-10272CRITICALRVD#2554: MiR ROS computational graph presents no authentication mechanismsEPSS 2.5%CVE-2022-4978CRITICALSteppschuh Remote Control Server 3.1.1.12 Unauthenticated RCEEPSS 2.5%CVE-2025-59516HIGHWindows Storage VSP Driver Elevation of Privilege VulnerabilityEPSS 2.5%CVE-2026-61808CRITICALLightRAG: Missing Authentication for Critical API Functions in Default ConfigurationEPSS 2.5%CVE-2026-103956CRITICALMissing authentication for critical function in Loom for AWSEPSS 2.5%CVE-2011-10013CRITICALTraq 2.0–2.3 admincp/common.php RCEEPSS 2.5%CVE-2025-0896CRITICALOrthanc Server Missing Authentication for Critical FunctionEPSS 2.5%CVE-2022-45378CRITICALApache SOAP allows unauthenticated users to potentially invoke arbitrary codeEPSS 2.5%CVE-2022-45477CRITICALTelepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization EPSS 2.5%CVE-2018-4854—A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to porEPSS 2.5%CVE-2024-5947MEDIUMDeep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure VulnerabilityEPSS 2.4%CVE-2025-34119HIGHEasyCafe Server 2.2.14 Remote File Disclosure via Opcode 0x43EPSS 2.4%CVE-2023-46819MEDIUMApache OFBiz: Execution of Solr plugin queries without authenticationEPSS 2.4%