Fallos del tipo CWE-306

2610 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2025-0355HIGHMissing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and EPSS 0.5%CVE-2023-46978HIGHTOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset login password & WIFI passwords withoutEPSS 0.5%CVE-2013-10046HIGHAgnitum Outpost Internet Security Local Privilege EscalationEPSS 0.5%CVE-2026-9371MEDIUMItzCrazyKns Vane API route.ts missing authenticationEPSS 0.5%CVE-2026-72605HIGHSwing Music Swing Music - Missing AuthenticationEPSS 0.5%CVE-2026-63757HIGHSurrealDB before 3.1.0 Session Hijacking via /rpc sessionsEPSS 0.5%CVE-2023-31444HIGHIn Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of EPSS 0.5%CVE-2022-45794HIGHOmron CJ-series and CS-series unauthenticated filesystem access.EPSS 0.5%CVE-2026-58658HIGHGPUStack Unauthenticated Information Disclosure via Worker EndpointsEPSS 0.5%CVE-2026-31243MEDIUMThe mem0 1.0.0 server lacks authentication and authorization controls for its memory reset and table re-creation functionality accessible viEPSS 0.5%CVE-2026-35065HIGHDell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticEPSS 0.5%CVE-2026-4272HIGHCVE-2026-4272 - Bluetooth Remote Execution of System Commands VulnerabilityEPSS 0.5%CVE-2026-28767MEDIUMGardyn Cloud API Missing Authentication for Critical FunctionEPSS 0.5%CVE-2026-2248CRITICALUnauthenticated Remote Root Shell Access via Web Console in METIS WICEPSS 0.5%CVE-2026-2249CRITICALUnauthenticated Remote Command Execution via Web Console in METIS DFSEPSS 0.5%CVE-2026-32296HIGHSipeed NanoKVM unauthenticated Wi-Fi configuration endpointEPSS 0.5%CVE-2025-40765CRITICALA vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application containEPSS 0.5%CVE-2025-63206CRITICALAn authentication bypass issue was discovered in Dasan Switch DS2924 web based interface, firmware versions 1.01.18 and 1.02.00, allowing atEPSS 0.5%CVE-2024-0949CRITICALImproper Access Control in Talya Informatics' ElektrawebEPSS 0.5%CVE-2025-71318CRITICALNetMan 204 Missing Authentication for Administrative FunctionsEPSS 0.5%