Fallos del tipo CWE-306

2599 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2022-45477CRITICALTelepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization EPSS 2.3%CVE-2020-7540—A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon QuantuEPSS 2.3%CVE-2014-125116CRITICALHybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration InjectionEPSS 2.3%CVE-2019-5163MEDIUMAn exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream CiphEPSS 2.3%CVE-2019-1895CRITICALCisco Enterprise NFV Infrastructure Software VNC Authentication Bypass VulnerabilityEPSS 2.3%CVE-2026-34472HIGHUnauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attacEPSS 2.3%CVE-2025-34089CRITICALRemote for Mac Unauthenticated Remote Code Execution via AppleScript InjectionEPSS 2.3%CVE-2018-4853—A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to porEPSS 2.3%CVE-2022-4978CRITICALSteppschuh Remote Control Server 3.1.1.12 Unauthenticated RCEEPSS 2.3%CVE-2019-1631MEDIUMCisco Integrated Management Controller Information Disclosure VulnerabilityEPSS 2.2%CVE-2020-6769CRITICALMissing Authentication for Critical Function in Bosch Video Streaming GatewayEPSS 2.2%CVE-2026-4810CRITICALRemote Code Execution in Google Agent Development Kit (ADK)EPSS 2.2%CVE-2020-3531CRITICALCisco IoT Field Network Director Unauthenticated REST API VulnerabilityEPSS 2.2%CVE-2025-34111CRITICALTiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCEEPSS 2.2%CVE-2025-34119HIGHEasyCafe Server 2.2.14 Remote File Disclosure via Opcode 0x43EPSS 2.2%CVE-2018-0181HIGHCisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent Software Redis Server Unauthenticated Access VulnerabilityEPSS 2.2%CVE-2014-125124CRITICALPandora FMS <= 5.0RC1 Anyterm Unauthenticated Command InjectionEPSS 2.1%CVE-2020-7389MEDIUMSage X3 Syracuse Missing Authentication for Critical Function in Developer EnvironmentEPSS 2.1%CVE-2026-56270HIGHFlowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod EndpointEPSS 2.0%CVE-2017-3217—CalAmp LMU 3030 series OBD-II CDMA and GSM devices has an SMS (text message) interface that can be deployed where no password is configured for this interface by the integrator / resellerEPSS 2.0%