Fallos del tipo CWE-306

3091 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2025-8286CRITICALGüralp Systems FMUS Series and MIN Series DevicesEPSS 1.4%CVE-2022-26067MEDIUMAn information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform EPSS 1.4%CVE-2020-6964—In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X EPSS 1.4%CVE-2022-29226CRITICALTrivial authentication bypass in EnvoyEPSS 1.4%CVE-2022-24829HIGHMissing authentication in GardenEPSS 1.4%CVE-2022-33138—A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All veEPSS 1.3%CVE-2026-42221HIGHnginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin ClaimEPSS 1.3%CVE-2021-44222—A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The underlying MQTT service of affected systems dEPSS 1.3%CVE-2026-63722HIGHICEcoder 8.1 Unauthenticated RCE via terminal-xhr.phpEPSS 1.3%CVE-2022-29951CRITICALJTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol (configurable on ports 1024-65534 on eEPSS 1.3%CVE-2023-35830—STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TCEPSS 1.3%CVE-2023-29411CRITICAL A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leadinEPSS 1.3%CVE-2026-76578CRITICALIpa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aciEPSS 1.3%CVE-2023-38186HIGHWindows Mobile Device Management Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2023-23906HIGHMissing authentication for critical function exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unautEPSS 1.3%CVE-2023-27060CRITICALLightCMS v1.3.7 was discovered to contain a remote code execution (RCE) vulnerability via the image:make function.EPSS 1.3%CVE-2025-12548CRITICALGithub.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/3333EPSS 1.3%CVE-2022-20858CRITICALCisco Nexus Dashboard Unauthorized Access VulnerabilitiesEPSS 1.3%CVE-2022-38168CRITICALBroken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackEPSS 1.3%CVE-2026-84731CRITICALPre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOSEPSS 1.3%