Fallos del tipo CWE-306

3091 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2025-34079HIGHNSClient++ Authenticated Remote Code Execution via ExternalScripts APIEPSS 1.7%CVE-2025-21355HIGHMicrosoft Bing Remote Code Execution VulnerabilityEPSS 1.7%CVE-2024-38143MEDIUMWindows WLAN AutoConfig Service Elevation of Privilege VulnerabilityEPSS 1.7%CVE-2021-31337—The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow EPSS 1.7%CVE-2026-16740CRITICALMissing Authentication for Critical Function in TR7 Cyber ​​Defense's TR7 ASPEPSS 1.7%CVE-2022-25250HIGHPTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical FunctionEPSS 1.7%CVE-2020-25228—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). A service available on port 10005/tcp of thEPSS 1.6%CVE-2022-40202CRITICAL The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attEPSS 1.6%CVE-2020-10625—WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account.EPSS 1.6%CVE-2021-3825CRITICALMissing Authorization Checks in LiderAhenkEPSS 1.6%CVE-2023-44413MEDIUMD-Link D-View shutdown_coreserver Missing Authentication Denial-of-Service VulnerabilityEPSS 1.6%CVE-2026-45695CRITICALKopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is usedEPSS 1.6%CVE-2026-84452HIGHWindows ML CLI: CORS misconfig enables localhost RCEEPSS 1.6%CVE-2022-20857CRITICALCisco Nexus Dashboard Unauthorized Access VulnerabilitiesEPSS 1.6%CVE-2020-3402MEDIUMCisco Unified Customer Voice Portal Information Disclosure VulnerabilityEPSS 1.6%CVE-2026-67277HIGHKernel memory disclosure and denial of service in MikroTik RouterOS btest serviceEPSS 1.6%KEVCVE-2017-2638MEDIUMIt was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnEPSS 1.6%CVE-2022-21952HIGHSUMA unauthenticated remote DoS via resource exhaustionEPSS 1.5%CVE-2020-3392HIGHCisco IoT Field Network Director Missing API Authentication VulnerabilityEPSS 1.5%CVE-2021-22772—A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), EaseEPSS 1.5%