Fallos del tipo CWE-306

2610 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2025-29870HIGHMissing authentication for critical function vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticaEPSS 0.6%CVE-2026-3207HIGHTIBCO BPM Enterprise Remote Code Execution (RCE) VulnerabilityEPSS 0.6%CVE-2026-66006MEDIUMlakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefsEPSS 0.6%CVE-2026-72822HIGHGrav before 1.0.13 Authentication Bypass via disable2faEPSS 0.6%CVE-2025-34039CRITICALYonyou NC BeanShell Command InjectionEPSS 0.6%CVE-2025-30135CRITICALAn issue was discovered on IROAD Dashcam FX2 devices. Dumping Files Over HTTP and RTSP Without Authentication can occur. It lacks authenticaEPSS 0.6%CVE-2025-24924CRITICALGMOD Apollo Missing Authentication for Critical FunctionEPSS 0.6%CVE-2023-6368MEDIUMWhatsUp Gold Unauthenticated Access to an API EndpointEPSS 0.6%CVE-2026-48325CRITICALColdFusion | Missing Authentication for Critical Function (CWE-306)EPSS 0.6%CVE-2025-3461CRITICALON Semiconductor Quantenna Telnet Missing AuthenticationEPSS 0.6%CVE-2024-1491HIGHElectrolink FM/DAB/TV Transmitter Missing Authentication for Critical FunctionEPSS 0.6%CVE-2026-53952CRITICALGetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic FlawEPSS 0.6%CVE-2026-47837MEDIUMSpring Cloud Config Server Monitor Endpoint Does Not Validate Webhook RequestsEPSS 0.6%CVE-2026-86728HIGHAVideo through 29.0 Unauthenticated Disclosure via epg.json.phpEPSS 0.6%CVE-2025-63390MEDIUMAn authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fails to implement proEPSS 0.6%CVE-2025-15683HIGHMultiple Unauthenticated Denial-of-Service ConditionsEPSS 0.6%CVE-2026-31244MEDIUMThe mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories/{memory_id}). TEPSS 0.6%CVE-2025-34232MEDIUMVasion Print (formerly PrinterLogic) Blind SSRF via Lexmark dellCheck.phpEPSS 0.6%CVE-2024-23815HIGHA vulnerability has been identified in Desigo CC (All versions if access from Installed Clients to Desigo CC server is allowed from networksEPSS 0.6%CVE-2026-31241MEDIUMThe mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories). The endpoint EPSS 0.6%