Filtered by CWE-306
Filtered by vendor Subscriptions
Total 2252 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2011-4605 1 Redhat 6 Jboss Enterprise Application Platform, Jboss Enterprise Brms Platform, Jboss Enterprise Portal Platform and 3 more 2025-04-11 N/A
The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.
CVE-2025-1283 1 Dingtian-tech 8 Dt-r002, Dt-r002 Firmware, Dt-r008 and 5 more 2025-04-10 9.8 Critical
The Dingtian DT-R0 Series is vulnerable to an exploit that allows attackers to bypass login requirements by directly navigating to the main page.
CVE-2025-0257 1 Hcltechsw 2 Hcl Devops Deploy, Hcl Launch 2025-04-10 6.3 Medium
HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its Agent Relay service.
CVE-2024-3777 1 Ai3 1 Qbibot 2025-04-08 9.8 Critical
The password reset feature of Ai3 QbiBot lacks proper access control, allowing unauthenticated remote attackers to reset any user's password.
CVE-2022-46463 1 Linuxfoundation 1 Harbor 2025-04-08 7.5 High
An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature."
CVE-2022-43976 1 Ge 2 Ms 3000, Ms 3000 Firmware 2025-04-07 9.8 Critical
An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. Direct access to the API is possible on TCP port 8888 via programs located in the cgi-bin folder without any authentication.
CVE-2022-42275 1 Nvidia 2 Bmc, Dgx A100 2025-04-07 7.7 High
NVIDIA BMC IPMI handler allows an unauthenticated host to write to a host SPI flash bypassing secureboot protections. This may lead to a loss of integrity and denial of service.
CVE-2022-42276 1 Nvidia 2 Dgx A100, Dgx A100 Firmware 2025-04-07 7.5 High
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.
CVE-2022-42277 1 Nvidia 2 Dgx Station A100, Dgx Station A100 Firmware 2025-04-07 7.5 High
NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.
CVE-2020-23256 1 Electerm Project 1 Electerm 2025-04-03 9.8 Critical
An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.
CVE-2020-22661 1 Ruckuswireless 28 R310, R310 Firmware, R500 and 25 more 2025-04-03 6.5 Medium
In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to erase the backup secondary official image and write secondary backup unauthorized image.
CVE-2022-41505 1 Tp-link 2 Tapo C200 V1, Tapo C200 V1 Firmware 2025-04-03 6.4 Medium
An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by connecting to the UART pins, interrupting the boot process, and setting an init=/bin/sh value.
CVE-2021-33658 2 Huawei, Openatom 2 Atune, Openeuler 2025-04-02 7.8 High
atune before 0.3-0.8 log in as a local user and run the curl command to access the local atune url interface to escalate the local privilege or modify any file. Authentication is not forcibly enabled in the default configuration.
CVE-2021-43447 1 Onlyoffice 1 Server 2025-04-02 7.5 High
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication.
CVE-2022-3738 1 Wago 14 Cc100, Cc100 Firmware, Edge Controller and 11 more 2025-04-02 5.9 Medium
The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull.
CVE-2023-0463 1 Devolutions 1 Remote Desktop Manager 2025-04-02 7.8 High
The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022.3.30 allows a user to save sensitive data on disk.
CVE-2024-2921 1 Devolutions 1 Devolutions Server 2025-03-28 9.8 Critical
Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access unauthorized PAM entries via a specific set of permissions.
CVE-2021-36888 1 Blocksera 1 Image Hover Effects 2025-03-28 9.8 Critical
Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.
CVE-2025-25068 1 Mattermost 1 Mattermost Server 2025-03-27 7.5 High
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated attackers to bypass MFA protections via API requests to plugin-specific routes.
CVE-2024-8053 1 Openwebui 1 Open Webui 2025-03-27 8.2 High
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.