Filtered by CWE-306
Filtered by vendor Subscriptions
Total 2254 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-7315 1 Humaxdigital 2 Hg100r, Hg100r Firmware 2025-04-20 N/A
An issue was discovered on Humax Digital HG100R 2.0.6 devices. To download the backup file it's not necessary to use credentials, and the router credentials are stored in plaintext inside the backup, aka GatewaySettings.bin.
CVE-2017-6872 1 Siemens 4 Ozw672, Ozw672 Firmware, Ozw772 and 1 more 2025-04-20 N/A
A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker with access to port 21/tcp to access or alter historical measurement data stored on the device.
CVE-2017-16241 1 Amag 6 En-1dbc, En-1dbc Firmware, En-2dbc and 3 more 2025-04-20 N/A
Incorrect access control in AMAG Symmetry Door Edge Network Controllers (EN-1DBC Boot App 23611 03.60 and STD App 23603 03.60; EN-2DBC Boot App 24451 01.00 and STD App 2461 01.00) enables remote attackers to execute door controller commands (e.g., lock, unlock, add ID card value) by sending unauthenticated requests to the affected devices via Serial over TCP/IP, as demonstrated by a Ud command.
CVE-2024-48950 1 Logpoint 2 Logpoint, Siem 2025-04-18 7.5 High
An issue was discovered in Logpoint before 7.5.0. An endpoint used by Distributed Logpoint Setup was exposed, allowing unauthenticated attackers to bypass CSRF protections and authentication.
CVE-2022-1070 1 Aethon 1 Tug Home Base Server 2025-04-17 8.2 High
Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
CVE-2021-26264 1 Emerson 2 Deltav Distributed Control System, Deltav Workstation 2025-04-17 6.1 Medium
A specially crafted script could cause the DeltaV Distributed Control System Controllers (All Versions) to restart and cause a denial-of-service condition.
CVE-2024-2076 1 Codeastro 1 House Rental Management System 2025-04-16 5.3 Medium
A vulnerability was found in CodeAstro House Rental Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file booking.php/owner.php/tenant.php. The manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255392.
CVE-2021-33008 1 Aveva 1 System Platform 2025-04-16 8.8 High
AVEVA System Platform versions 2017 through 2020 R2 P01 does not perform any authentication for functionality that requires a provable user identity.
CVE-2022-41644 1 Deltaww 1 Infrasuite Device Master 2025-04-16 8.8 High
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that changes group privileges. An attacker could use this to create a denial-of-service state or escalate their own privileges.
CVE-2021-33843 1 Fresenius-kabi 2 Agilia Sp Mc Wifi, Agilia Sp Mc Wifi Firmware 2025-04-16 5.3 Medium
Fresenius Kabi Agilia SP MC WiFi vD25 and prior has a default configuration page accessible without authentication. An attacker may use this functionality to change the exposed configuration values such as network settings.
CVE-2020-10640 1 Emerson 1 Openenterprise Scada Server 2025-04-16 10 Critical
Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a specific communication service.
CVE-2022-25922 1 Hegemonelectronics 2 Plc4trucks, Plc4trucks Firmware 2025-04-16 6.1 Medium
Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is no authentication or authorization for these functions.
CVE-2022-25247 1 Ptc 2 Axeda Agent, Axeda Desktop Server 2025-04-16 9.8 Critical
Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to obtain full file-system access and remote code execution.
CVE-2022-25250 1 Ptc 2 Axeda Agent, Axeda Desktop Server 2025-04-16 7.5 High
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain command to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to shut down a specific service.
CVE-2022-25251 1 Ptc 2 Axeda Agent, Axeda Desktop Server 2025-04-16 9.8 Critical
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messages to a specific port without proper authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to read and modify the affected product’s configuration.
CVE-2022-0922 1 Philips 2 E-alert, E-alert Firmware 2025-04-16 6.5 Medium
The software does not perform any authentication for critical system functionality.
CVE-2020-14479 1 Inductiveautomation 1 Ignition 2025-04-16 5.3 Medium
Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server
CVE-2022-1521 1 Illumina 8 Iseq 100, Local Run Manager, Miniseq and 5 more 2025-04-16 9.1 Critical
LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data.
CVE-2022-2141 1 Micodus 2 Mv720, Mv720 Firmware 2025-04-16 9.8 Critical
SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.
CVE-2022-2138 1 Advantech 1 Iview 2025-04-16 8.2 High
The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute arbitrary code, resulting in a denial-of-service condition.