Fallos del tipo CWE-306

2608 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2022-30229HIGHA vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does not require authenticEPSS 0.7%CVE-2026-22238CRITICALAdministrator Account Creation Vulnerability in BLUVOYIXEPSS 0.7%CVE-2023-4699CRITICALArbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA productsEPSS 0.7%CVE-2026-58319CRITICALApache Doris: Improper Authentication in Frontend HTTP APIEPSS 0.7%CVE-2026-44101CRITICALOCPP reconfiguration vulnerabilityEPSS 0.7%CVE-2026-44090CRITICALMissing authentication for MQTT BrokerEPSS 0.7%CVE-2025-65856CRITICALAuthentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthentiEPSS 0.7%CVE-2026-85637MEDIUMjofpin trape Admin Endpoint sockets.py join_room missing authenticationEPSS 0.7%CVE-2025-34231HIGHVasion Print (formerly PrinterLogic) SSRF via HP badgeSetup.phpEPSS 0.7%CVE-2026-31242CRITICALThe mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memorieEPSS 0.7%CVE-2026-31882HIGHDagu SSE Authentication Bypass in Basic Auth ModeEPSS 0.7%CVE-2025-61945CRITICALMissing Authentication for Critical Function in Radiometrics VizAirEPSS 0.7%CVE-2022-45138CRITICALWAGO: Missing Authentication for Critical FunctionEPSS 0.7%CVE-2022-20830MEDIUMCisco Software-Defined Application Visibility and Control on Cisco vManage Authentication Bypass VulnerabilityEPSS 0.7%CVE-2026-5057HIGHATEN Unizon RpcProvider Missing Authentication Denial-of-Service VulnerabilityEPSS 0.7%CVE-2023-21842HIGHVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affEPSS 0.7%CVE-2025-21559MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8EPSS 0.7%CVE-2026-97864MEDIUMGibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authenticationEPSS 0.7%CVE-2019-5164HIGHAn exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets seEPSS 0.7%CVE-2025-34070CRITICALGFI Kerio Control GFIAgent Missing Authentication on Administrative InterfacesEPSS 0.7%