Fallos del tipo CWE-306

2607 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2026-25703HIGHPotential information leakage from manager /network/graph API in NeuVectorEPSS 0.8%CVE-2024-22513MEDIUMdjangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources EPSS 0.8%CVE-2022-27623HIGHMissing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.EPSS 0.8%CVE-2026-84840MEDIUMtsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authenticationEPSS 0.8%CVE-2021-27395—A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versioEPSS 0.8%CVE-2023-6595HIGHWhatsUp Gold Unauthenticated Access to an API EndpointEPSS 0.8%CVE-2026-4312CRITICALDrangSoft｜GCB/FCB Audit Software - Missing AuthenticationEPSS 0.8%CVE-2020-36894CRITICALEibiz i-Media Server Digital Signage 3.8.0 Unauthenticated User Creation VulnerabilityEPSS 0.8%CVE-2026-63508CRITICALMicrosoft Planetary Computer Pro Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2023-49617CRITICALMachineSense FeverWarn Missing Authentication for Critical FunctionEPSS 0.8%CVE-2026-63455CRITICALAuthentication bypass via spoofed HTTP headers Orchestrator REST APIEPSS 0.8%CVE-2026-12795MEDIUMBerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authenticationEPSS 0.8%CVE-2026-73125CRITICALEbyte NA111-M Missing Authentication for Critical FunctionEPSS 0.8%CVE-2026-24124HIGHDragonfly Manager Job API Allows Unauthenticated AccessEPSS 0.8%CVE-2024-2921CRITICALImproper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to tEPSS 0.8%CVE-2025-21524CRITICALVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported verEPSS 0.8%CVE-2022-22809—A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in aEPSS 0.8%CVE-2026-82967CRITICALIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.8%CVE-2022-50790MEDIUMSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Radio Stream DisclosureEPSS 0.8%CVE-2026-72593CRITICALdulldusk phpfm - Missing Authentication by Default Allows Full Filesystem AccessEPSS 0.8%