Filtered by CWE-306
Filtered by vendor Subscriptions
Total 1673 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-45276 3 Helmholz, Mb Connect Line, Mbconnectline 5 Rex 100, Rex 100 Firmware, Mbnet.mini and 2 more 2025-01-24 7.5 High
An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication.
CVE-2024-26263 2 Ebm Technologies, Ebmtech 2 Risweb, Risweb 2025-01-23 5.3 Medium
EBM Technologies RISWEB's specific URL path is not properly controlled by permission, allowing attackers to browse specific pages and query sensitive data without login.
CVE-2023-24934 1 Microsoft 1 Malware Protection Platform 2025-01-23 6.2 Medium
Microsoft Defender Security Feature Bypass Vulnerability
CVE-2024-47574 1 Fortinet 2 Forticlient, Forticlientwindows 2025-01-22 7.4 High
A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0, and 6.4.10 through 6.4.0 allows low privilege attacker to execute arbitrary code with high privilege via spoofed named pipe messages.
CVE-2024-7125 2 Hitachi, Linux 2 Ops Center Common Services, Linux Kernel 2025-01-21 7.8 High
Authentication Bypass vulnerability in Hitachi Ops Center Common Services.This issue affects Hitachi Ops Center Common Services: from 10.9.3-00 before 11.0.2-01.
CVE-2024-12757 2025-01-21 8.6 High
Nedap Librix Ecoreader is missing authentication for critical functions that could allow an unauthenticated attacker to potentially execute malicious code.
CVE-2025-0355 2025-01-21 7.5 High
Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network.
CVE-2022-46732 1 Ge 1 Proficy Historian 2025-01-18 9.8 Critical
Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status.
CVE-2024-11639 1 Ivanti 1 Cloud Services Appliance 2025-01-17 10 Critical
An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access
CVE-2023-1837 1 Hypr 1 Hypr Server 2025-01-17 8.5 High
Missing Authentication for critical function vulnerability in HYPR Server allows Authentication Bypass when using Legacy APIs.This issue affects HYPR Server: before 8.0 (with enabled Legacy APIs)
CVE-2023-0052 1 Sauter-controls 10 Modunet300 Ey-am300f001, Modunet300 Ey-am300f001 Firmware, Modunet300 Ey-am300f002 and 7 more 2025-01-17 9.8 Critical
SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allows the execution of commands without credentials. As Telnet and file transfer protocol (FTP) are the only protocols available for device management, an unauthorized user could access the system and modify the device configuration, which could result in the unauthorized user executing unrestricted malicious commands.
CVE-2023-0102 1 Ls-electric 2 Xbc-dn32u, Xbc-dn32u Firmware 2025-01-17 9.1 Critical
LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker to delete arbitrary files.
CVE-2023-22803 1 Ls-electric 2 Xbc-dn32u, Xbc-dn32u Firmware 2025-01-17 7.5 High
LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the PLC. This could allow an attacker to change the PLC's mode arbitrarily.
CVE-2023-22804 1 Ls-electric 2 Xbc-dn32u, Xbc-dn32u Firmware 2025-01-17 9.1 Critical
LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use an account with elevated privileges and take control of the device.
CVE-2023-1140 1 Deltaww 1 Infrasuite Device Master 2025-01-17 9.8 Critical
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability that could allow an attacker to achieve unauthenticated remote code execution in the context of an administrator.
CVE-2023-33247 1 Talend 1 Data Catalog 2025-01-16 7.5 High
Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. (A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog server.)
CVE-2023-31594 1 Ic 2 Realtime Icip-p2012t, Realtime Icip-p2012t Firmware 2025-01-16 7.5 High
IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via an exposed HTTP channel using VLC network.
CVE-2023-31227 1 Huawei 1 Emui 2025-01-16 7.5 High
The hwPartsDFR module has a vulnerability in API calling verification. Successful exploitation of this vulnerability may affect device confidentiality.
CVE-2023-0116 1 Huawei 1 Emui 2025-01-15 7.5 High
The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerability may affect availability.
CVE-2024-3661 10 Apple, Cisco, Citrix and 7 more 13 Iphone Os, Macos, Anyconnect Vpn Client and 10 more 2025-01-15 7.6 High
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.