Fallos del tipo CWE-306

2599 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2025-34223CRITICALVasion Print (formerly PrinterLogic) Insecure Installation CredentialsEPSS 1.2%CVE-2019-16003MEDIUMCisco UCS Director Information Disclosure VulnerabilityEPSS 1.2%CVE-2019-15282MEDIUMCisco Identity Services Engine Information Disclosure VulnerabilityEPSS 1.2%CVE-2024-5749HIGHCertain HP DesignJet products – Credential reflectionEPSS 1.2%CVE-2020-3461MEDIUMCisco Data Center Network Manager Information Disclosure VulnerabilityEPSS 1.2%CVE-2022-32251HIGHA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). There is a missing authentication verification foEPSS 1.2%CVE-2021-41104HIGHweb_server allows OTA update without checking user defined basic auth username & passwordEPSS 1.2%CVE-2024-23618CRITICALArris SURFboard SBG6950AC2 Arbitrary Code Execution VulnerabilityEPSS 1.2%CVE-2025-59090CRITICALUnauthenticated SOAP API in dormakaba Kaba exos 9300EPSS 1.2%CVE-2022-26026HIGHA denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software OAS Platform V16.00.EPSS 1.2%CVE-2026-23746CRITICALEntrust Instant Financial Issuance (IFI) SmartCardController Service .NET Remoting RCEEPSS 1.2%CVE-2022-25922MEDIUMICSA-22-063-01 Missing Authentication for Critical Function in Trailer Power Line Communications (PLC) J2497EPSS 1.2%CVE-2026-55450CRITICALLangflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leakEPSS 1.2%CVE-2026-72748MEDIUMAVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.phpEPSS 1.2%CVE-2022-44001CRITICALAn issue was discovered in BACKCLICK Professional 5.9.63. User authentication for accessing the CORBA back-end services can be bypassed.EPSS 1.2%CVE-2023-34329CRITICALAuthentication Bypass via HTTP Header SpoofingEPSS 1.2%CVE-2022-24829HIGHMissing authentication in GardenEPSS 1.2%CVE-2023-23444HIGHMissing Authentication for Critical Function in SICK Flexi Classic and Flexi Soft Gateways with Partnumbers 1042193, 1042964, 1044078, 10440EPSS 1.2%CVE-2023-38123HIGHInductive Automation Ignition OPC UA Quick Client Missing Authentication for Critical Function Authentication Bypass VulnerabilityEPSS 1.2%CVE-2026-47391CRITICALPraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool executionEPSS 1.2%