Filtered by CWE-306
Filtered by vendor Subscriptions
Total 1337 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-2368 1 Sap 1 Netweaver System Landscape Directory 2024-11-21 N/A
SAP NetWeaver System Landscape Directory, LM-CORE 7.10, 7.20, 7.30, 7.31, 7.40, does not perform any authentication checks for functionalities that require user identity.
CVE-2018-2360 1 Sap 1 Sap Kernel 2024-11-21 N/A
SAP Startup Service, SAP KERNEL 7.45, 7.49, and 7.52, is missing an authentication check for functionalities that require user identity and cause consumption of file system storage.
CVE-2018-21132 1 Netgear 4 Wac505, Wac505 Firmware, Wac510 and 1 more 2024-11-21 9.8 Critical
Certain NETGEAR devices are affected by authentication bypass. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17.
CVE-2018-21041 1 Google 1 Android 2024-11-21 7.5 High
An issue was discovered on Samsung mobile devices with O(8.x) software. Access to Gallery in the Secure Folder can occur without authentication. The Samsung ID is SVE-2018-13057 (December 2018).
CVE-2018-20507 1 Gitlab 1 Gitlab 2024-11-21 5.3 Medium
An issue was discovered in GitLab Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.
CVE-2018-20220 1 Teracue 6 Enc-400 Hdmi, Enc-400 Hdmi2, Enc-400 Hdmi2 Firmware and 3 more 2024-11-21 N/A
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted with, a large portion of the HTTP endpoints are missing authentication. An attacker is able to view these pages before being authenticated, and some of these pages may disclose sensitive information.
CVE-2018-1757 1 Ibm 1 Security Identity Governance And Intelligence 2024-11-21 N/A
IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive information due to missing authentication in IGI for the survey application. IBM X-Force ID: 148601.
CVE-2018-1745 1 Ibm 1 Security Key Lifecycle Manager 2024-11-21 N/A
IBM Security Key Lifecycle Manager 2.7 and 3.0 could allow an unauthenticated user to restart the SKLM server due to missing authentication. IBM X-Force ID: 148424.
CVE-2018-1501 1 Ibm 1 Security Guardium 2024-11-21 7.5 High
IBM Security Guardium 10.5, 10.6, and 11.0 could allow an unauthorized user to obtain sensitive information due to missing security controls. IBM X-Force ID: 141226.
CVE-2018-1164 1 Zyxel 2 P-870h-51, P-870h-51 Firmware 2024-11-21 N/A
This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router 1.00(AWG.3)D5. Authentication is not required to exploit this vulnerability. The specific flaw exists within numerous exposed CGI endpoints. The vulnerability is caused by improper access controls that allow access to critical functions without authentication. An attacker can use this vulnerability to reboot affected devices, along with other actions. Was ZDI-CAN-4540.
CVE-2018-19636 1 Opensuse 1 Supportutils 2024-11-21 N/A
Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root privileges
CVE-2018-19248 1 Epson 2 Epson Workforce Wf-2861, Epson Workforce Wf-2861 Firmware 2024-11-21 N/A
The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA devices allows remote attackers to upload a firmware file and reset the printer without authentication by making a request to the /DOWN/FIRMWAREUPDATE/ROM1 URI and a POST request to the /FIRMWAREUPDATE URI.
CVE-2018-19079 2 Foscam, Opticam 6 C2, C2 Application Firmware, C2 System Firmware and 3 more 2024-11-21 N/A
An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SystemReboot method allows unauthenticated reboot.
CVE-2018-18995 1 Abb 4 Gate-e1, Gate-e1 Firmware, Gate-e2 and 1 more 2024-11-21 N/A
Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrative telnet or web interfaces, which could enable various effects vectors, including conducting device resets, reading or modifying registers, and changing configuration settings such as IP addresses.
CVE-2018-18264 1 Kubernetes 1 Dashboard 2024-11-21 N/A
Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster.
CVE-2018-17924 1 Rockwellautomation 32 1756-en2f Series A, 1756-en2f Series A Firmware, 1756-en2f Series B and 29 more 2024-11-21 8.6 High
Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could send a CIP connection request to an affected device, and upon successful connection, send a new IP configuration to the affected device even if the controller in the system is set to Hard RUN mode. When the affected device accepts this new IP configuration, a loss of communication occurs between the device and the rest of the system as the system traffic is still attempting to communicate with the device via the overwritten IP address.
CVE-2018-17906 1 Philips 2 Intellispace Pacs, Isite Pacs 2024-11-21 8.8 High
Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third party software may allow an attacker to compromise a component of the system.
CVE-2018-17880 2 D-link, Dlink 2 Dir-823g Firmware, Dir-823g 2024-11-21 N/A
On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without authentication to trigger a reboot.
CVE-2018-16758 3 Debian, Starwindsoftware, Tinc-vpn 3 Debian Linux, Starwind Virtual San, Tinc 2024-11-21 5.9 Medium
Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the encryption of VPN packets.
CVE-2018-15466 1 Cisco 1 Policy Suite For Mobile 2024-11-21 N/A
A vulnerability in the Graphite web interface of the Policy and Charging Rules Function (PCRF) of Cisco Policy Suite (CPS) could allow an unauthenticated, remote attacker to access the Graphite web interface. The attacker would need to have access to the internal VLAN where CPS is deployed. The vulnerability is due to lack of authentication. An attacker could exploit this vulnerability by directly connecting to the Graphite web interface. An exploit could allow the attacker to access various statistics and Key Performance Indicators (KPIs) regarding the Cisco Policy Suite environment.