Filtered by CWE-306
Filtered by vendor Subscriptions
Total 1650 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-30041 1 Cgm 1 Clininet 2025-08-29 N/A
The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data containing session IDs.
CVE-2025-30040 1 Cgm 1 Clininet 2025-08-29 N/A
The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls.pl" endpoint.
CVE-2025-30039 1 Cgm 1 Clininet 2025-08-29 N/A
Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges.
CVE-2025-30048 1 Cgm 1 Clininet 2025-08-29 N/A
The "serverConfig" endpoint, which returns the module configuration including credentials, is accessible without authentication.
CVE-2025-25736 1 Kapsch 1 Ris-9260 2025-08-29 9.8 Critical
Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to contain Android Debug Bridge (ADB) pre-installed (/mnt/c3platpersistent/opt/platform-tools/adb) and enabled by default, allowing unauthenticated root shell access to the cellular modem via the default 'kapsch' user.
CVE-2025-53789 1 Microsoft 17 Server, Windows, Windows 10 1507 and 14 more 2025-08-28 7.8 High
Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
CVE-2025-1495 1 Ibm 2 Business Automation Workflow, Cloud Pak For Business Automation 2025-08-28 4.3 Medium
IBM Business Automation Workflow 24.0.0 and 24.0.1 through 24.0.1 IF001 Center may leak sensitive information due to missing authorization validation.
CVE-2024-41968 2025-08-28 5.4 Medium
A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.
CVE-2024-41967 1 Wago 5 Cc100, Edge Controller, Pfc100 and 2 more 2025-08-28 8.1 High
A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denial-of-service attack.
CVE-2023-46381 1 Loytec 6 Linx-212, Linx-212 Firmware, Liob-586 and 3 more 2025-08-27 8.2 High
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication for the preinstalled version of LWEB-802 via an lweb802_pre/ URI. An unauthenticated attacker can edit any project (or create a new project) and control its GUI.
CVE-2024-37303 2 Element-hq, Matrix 2 Synapse, Synapse 2025-08-26 5.3 Medium
Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. Synapse 1.106 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector.
CVE-2025-8627 1 Tp-link 2 Kp303, Smart Plug 2025-08-26 N/A
The TP-Link KP303 Smartplug can be issued unauthenticated protocol commands that may cause unintended power-off condition and potential information leak. This issue affects TP-Link KP303 (US) Smartplug: before 1.1.0.
CVE-2025-53118 1 Securden 1 Unified Pam 2025-08-26 9.8 Critical
An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM.
CVE-2022-43110 1 Voltronicpower 1 Viewpower 2025-08-25 9.8 Critical
Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web interface. An unauthenticated remote attacker can make changes to the system including: changing the web interface admin password, view/change system configuration, enumerate connected UPS devices and shut down connected UPS devices. This extends to being able to configure operating system commands that should run if the system detects a connected UPS shutting down.
CVE-2025-55581 1 D-link 1 Dcs-825l 2025-08-25 7.3 High
D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script. The script monitors and respawns the `dcp` and `signalc` binaries without validating their integrity, origin, or permissions. An attacker with filesystem access (e.g., via UART or firmware modification) may replace these binaries to achieve persistent arbitrary code execution with root privileges. The issue stems from improper handling of executable trust and absence of integrity checks in the watchdog logic.
CVE-2025-41689 2025-08-25 7.5 High
An unauthenticated remote attacker can get access without password protection to the affected device. This enables the unprotected read-only access to the stored measurement data.
CVE-2025-8610 1 Aomei 1 Cyber Backup 2025-08-25 N/A
AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of AOMEI Cyber Backup. Authentication is not required to exploit this vulnerability. The specific flaw exists within the StorageNode service, which listens on TCP port 9075 by default. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-26156.
CVE-2025-3319 1 Ibm 2 Spectrum Protect Server, Storage Protect Backup Archive Client 2025-08-24 8.1 High
IBM Spectrum Protect Server 8.1 through 8.1.26 could allow attacker to bypass authentication due to improper session authentication which can result in access to unauthorized resources.
CVE-2025-9254 1 Uniong 1 Webitr 2025-08-23 9.8 Critical
WebITR developed by Uniong has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to log into the system as arbitrary users by exploiting a specific functionality.
CVE-2025-48814 1 Microsoft 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more 2025-08-23 7.5 High
Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an unauthorized attacker to bypass a security feature over a network.