Filtered by CWE-306
Filtered by vendor Subscriptions
Total 1414 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-35830 1 Stw-mobile-machines 4 Tcg-4, Tcg-4 Firmware, Tcg-4lite and 1 more 2024-11-27 9.8 Critical
STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TCG-4lite Connectivity Module DeploymentPackage_v3.04r2-Jellyfish allow an attacker to gain full remote access with root privileges without the need for authentication, giving an attacker arbitrary remote code execution over LTE / 4G network via SMS.
CVE-2023-36347 1 Codekop 1 Codekop 2024-11-27 7.5 High
A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.
CVE-2023-34761 1 7-eleven 2 Hello Cup, Led Message Cup 2024-11-27 6.5 Medium
An unauthenticated attacker within BLE proximity can remotely connect to a 7-Eleven LED Message Cup, Hello Cup 1.3.1 for Android, and bypass the application's client-side chat censor filter.
CVE-2023-46381 1 Loytec 6 Linx-212, Linx-212 Firmware, Liob-586 and 3 more 2024-11-27 8.2 High
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication for the preinstalled version of LWEB-802 via an lweb802_pre/ URI. An unauthenticated attacker can edit any project (or create a new project) and control its GUI.
CVE-2024-47138 1 Myscada 2 Mypro Manager, Mypro Runtime 2024-11-26 9.8 Critical
The administrative interface listens by default on all interfaces on a TCP port and does not require authentication when being accessed.
CVE-2023-2834 1 Stylemixthemes 1 Bookit 2024-11-26 9.8 Critical
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
CVE-2024-5721 1 Logsign 1 Unified Secops 2024-11-26 N/A
Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the cluster HTTP API, which listens on TCP port 1924 when enabled. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24169.
CVE-2024-5718 1 Logsign 1 Unified Secops 2024-11-26 N/A
Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the cluster HTTP API, which listens on TCP port 1924 by default when enabled. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24166.
CVE-2024-40408 1 Cybelesoft 1 Thinfinity Workspace 2024-11-25 7.3 High
Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section. This vulnerability allows attackers to create arbitrary user profiles with elevated privileges.
CVE-2024-40405 1 Cybelesoft 1 Thinfinity Workspace 2024-11-25 8.1 High
Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request.
CVE-2024-40404 1 Cybelesoft 1 Thinfinity Workspace 2024-11-25 9.8 Critical
Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are established.
CVE-2023-22906 1 Heroelectronix 4 Qubo Hcd01, Qubo Hcd01 Firmware, Qubo Hcd02 and 1 more 2024-11-25 8.8 High
Hero Qubo HCD01_02_V1.38_20220125 devices allow TELNET access with root privileges by default, without a password.
CVE-2020-12491 2024-11-25 N/A
Improper control of framework service permissions with possibility of some sensitive device information leakage.
CVE-2020-12492 2024-11-25 N/A
Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information.
CVE-2024-38643 1 Qnap 1 Notes Station 3 2024-11-22 N/A
A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to gain access to and execute certain functions. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later
CVE-2019-1876 1 Cisco 1 Wide Area Application Services 2024-11-21 N/A
A vulnerability in the HTTPS proxy feature of Cisco Wide Area Application Services (WAAS) Software could allow an unauthenticated, remote attacker to use the Central Manager as an HTTPS proxy. The vulnerability is due to insufficient authentication of proxy connection requests. An attacker could exploit this vulnerability by sending a malicious HTTPS CONNECT message to the Central Manager. A successful exploit could allow the attacker to access public internet resources that would normally be blocked by corporate policies.
CVE-2019-15282 1 Cisco 1 Identity Services Engine Software 2024-11-21 5.3 Medium
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker read tcpdump files generated on an affected device. The vulnerability is due an issue in the authentication logic of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web interface. A successful exploit could allow the attacker to read a tcpdump file generated with a particular naming scheme.
CVE-2024-33622 2024-11-21 6.5 Medium
Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker.
CVE-2024-52437 1 Saul Morales Pacheco 1 Banner System 2024-11-21 8.8 High
Missing Authentication for Critical Function vulnerability in Saul Morales Pacheco Banner System allows Privilege Escalation.This issue affects Banner System: from n/a through 1.0.0.
CVE-2024-52438 1 Deco.agency 1 De.branding 2024-11-21 8.8 High
Missing Authentication for Critical Function vulnerability in deco.Agency de:branding allows Privilege Escalation.This issue affects de:branding: from n/a through 1.0.2.