Fallos del tipo CWE-306

2605 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2023-28697CRITICALMoxa MiiNePort E1 - Broken Access ControlEPSS 0.9%CVE-2020-14479MEDIUMICSA-20-147-01 Inductive Automation Ignition (Update B)EPSS 0.9%CVE-2023-38028CRITICALSaho ADM100&ADM-100FP - Broken Access ControlEPSS 0.9%CVE-2025-27642CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Unauthenticated Driver Package EditEPSS 0.9%CVE-2026-23751CRITICALKofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET RemotingEPSS 0.9%CVE-2022-47377CRITICALPassword recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker toEPSS 0.9%CVE-2024-21619MEDIUMJunos OS: SRX Series and EX Series: J-Web - unauthenticated access to temporary files containing sensitive informationEPSS 0.9%CVE-2023-27980HIGHA CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation EPSS 0.9%CVE-2026-6847CRITICALUnauthenticated Remote Code Execution in ThemisNETPanelEPSS 0.9%CVE-2025-69425CRITICALRuckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCEEPSS 0.9%CVE-2022-4018MEDIUMMissing Authentication for Critical Function in ikus060/rdiffwebEPSS 0.9%CVE-2026-25593HIGHOpenClaw Affected by Unauthenticated Local RCE via WebSocket config.applyEPSS 0.9%CVE-2026-49827CRITICALWebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)EPSS 0.9%CVE-2022-43989HIGHPassword recovery vulnerability in SICK SIM2x00 (ARM) Partnumber 1092673 and 1081902 with firmware version < 1.2.0 allows an unprivileged reEPSS 0.9%CVE-2022-43990HIGHPassword recovery vulnerability in SICK SIM1012 Partnumber 1098146 with firmware version <2.2.0 allows an unprivileged remote attacker to gaEPSS 0.9%CVE-2026-67593CRITICALApache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletionEPSS 0.9%CVE-2024-14007HIGHTVT NVMS-9000 < 1.3.4 Unauthenticated Administrative Queries & Information DisclosureEPSS 0.9%CVE-2026-71878CRITICALAuthentication bypass in Integrated Publishing ToolkitEPSS 0.9%CVE-2025-6916HIGHTOTOLINK T6 formLoginAuth.htm Form_Login missing authenticationEPSS 0.9%CVE-2020-23256CRITICALAn issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.EPSS 0.9%