Fallos del tipo CWE-306

2600 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2020-15799—A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT sEPSS 1.1%CVE-2026-49819CRITICALUpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmdEPSS 1.1%CVE-2016-6549—Zizai Tech Nut allows for unauthenticated Bluetooth pairingEPSS 1.1%CVE-2022-29881MEDIUMA vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employEPSS 1.1%CVE-2026-57967CRITICALApache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachmentEPSS 1.1%CVE-2025-7862MEDIUMTOTOLINK T6 Telnet Service cstecgi.cgi setTelnetCfg missing authenticationEPSS 1.1%CVE-2022-42785CRITICALWiesemann & Theis: Authentication bypass in Com-Server familyEPSS 1.1%CVE-2022-45140CRITICALWAGO: Missing Authentication for Critical Function EPSS 1.1%CVE-2026-86184CRITICALLara Dashboard before 1.3.0 Missing Authentication in screenshot-login RouteEPSS 1.1%CVE-2026-86242HIGHUnauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked BuildsEPSS 1.1%CVE-2025-41703HIGHPhoenix Contact: UPS Shutdown via Unauthenticated Modbus CommandEPSS 1.1%CVE-2025-4268MEDIUMTOTOLINK A720R cstecgi.cgi missing authenticationEPSS 1.1%CVE-2026-41473HIGHCyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner EndpointsEPSS 1.1%CVE-2020-36892CRITICALEibiz i-Media Server Digital Signage 3.8.0 Unauthenticated Privilege EscalationEPSS 1.1%CVE-2021-3589—An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can acEPSS 1.0%CVE-2025-48814HIGHRemote Desktop Licensing Service Security Feature Bypass VulnerabilityEPSS 1.0%CVE-2020-23648HIGHAsus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. Through system.asp / start_apply.htm, an attacker can changeEPSS 1.0%CVE-2023-33553CRITICALAn issue in Planet Technologies WDRT-1800AX v1.01-CP21 allows attackers to bypass authentication and escalate privileges to root via manipulEPSS 1.0%CVE-2021-1396CRITICALCisco Application Services Engine Unauthorized Access VulnerabilitiesEPSS 1.0%CVE-2026-8505CRITICALAuthentication Bypass in Webhook Endpoints Allowed Unauthorized Flow ExecutionEPSS 1.0%