Fallos del tipo CWE-306

3079 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2026-46817CRITICALVulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affecteEPSS 12.3%KEVCVE-2021-22784—A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that could allow an attackerEPSS 12.1%CVE-2022-2138HIGHAdvantech iViewEPSS 11.6%CVE-2026-27446CRITICALApache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationEPSS 11.4%CVE-2024-45844HIGHBIG-IP monitors vulnerabilityEPSS 10.6%CVE-2022-26925HIGHWindows LSA Spoofing VulnerabilityEPSS 10.5%KEVCVE-2026-25137CRITICALNixOs Odoo database and filestore publicly accessible with default odoo configurationEPSS 10.3%CVE-2019-3978—RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. ThEPSS 10.3%CVE-2025-34057HIGHRuijie NBR Router Administrative Credential DisclosureEPSS 10.1%CVE-2025-52089HIGHA hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to exEPSS 9.7%CVE-2025-34102CRITICALCryptoLog Unauthenticated RCE via SQL Injection and Command InjectionEPSS 9.5%CVE-2024-12106CRITICALWhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authenticationEPSS 9.5%CVE-2025-20702HIGHIn the Airoha Bluetooth audio SDK, there is a possible unauthorized access to the RACE protocol. This could lead to remote escalation of priEPSS 9.3%CVE-2016-9369CRITICALAn issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions pEPSS 9.0%CVE-2026-34472HIGHUnauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attacEPSS 9.0%CVE-2024-24578CRITICALRaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload EPSS 8.7%CVE-2026-45087CRITICALDalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server ModeEPSS 8.7%CVE-2026-41179CRITICALRClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command executionEPSS 8.6%CVE-2023-27290CRITICALIBM Observability with Instana missing authenticationEPSS 8.6%CVE-2023-7308HIGHSecGate3600 Firewall Information Disclosure via authManageSet.cgiEPSS 8.1%