Filtered by CWE-306
Filtered by vendor Subscriptions
Total 1332 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-49604 2 Najeeb Ahmad, Najeebmedia 2 Simple User Registration, Simple User Registration 2024-10-23 9.8 Critical
Authentication Bypass Using an Alternate Path or Channel vulnerability in Najeeb Ahmad Simple User Registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through 5.5.
CVE-2024-40091 1 Viloliving 1 Vilo 5 Mesh Wifi System Firmware 2024-10-23 5.3 Medium
Vilo 5 Mesh WiFi System <= 5.16.1.33 lacks authentication in the Boa webserver, which allows remote, unauthenticated attackers to retrieve logs with sensitive system.
CVE-2024-47912 1 Mitel 1 Micollab 2024-10-23 8.2 High
A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to perform unauthorized data-access attacks due to missing authentication mechanisms. A successful exploit could allow an attacker to access and delete sensitive information.
CVE-2024-40087 1 Viloliving 1 Vilo 5 Mesh Wifi System Firmware 2024-10-23 9.6 Critical
Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the router.
CVE-2024-21272 1 Oracle 2 Mysql, Mysql Connector\/python 2024-10-21 7.5 High
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2024-39300 1 Elecom 2 Wab-i1750-ps, Wab-i1750-ps Firmware 2024-10-21 8.1 High
Missing authentication vulnerability exists in Telnet function of WAB-I1750-PS v1.5.10 and earlier. When Telnet function of the product is enabled, a remote attacker may login to the product without authentication and alter the product's settings.
CVE-2024-49399 1 Elvaco 1 Cme3100 Firmware 2024-10-18 N/A
The affected product is vulnerable to an attacker being able to use commands without providing a password which may allow an attacker to leak information.
CVE-2024-48920 1 Putongoj 1 Putongoj 2024-10-18 9.1 Critical
PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unauthorized access, enabling users to perform admin-level operations, potentially compromising sensitive data and system integrity. This problem has been fixed in v2.1.0.beta.1. As a workaround, one may apply the patch from commit `211dfe9` manually.
CVE-2024-8530 1 Schneider-electric 1 Data Center Expert 2024-10-17 5.9 Medium
CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generated “logcaptures” archive is accessed directly by HTTPS.
CVE-2024-47130 1 Gotenna 2 Gotenna Pro, Pro App 2024-10-17 8.8 High
The goTenna Pro App allows unauthenticated attackers to remotely update the local public keys used for P2P and group messages. It is advised to update your app to the current release for enhanced encryption protocols.
CVE-2024-9984 1 Ragic 1 Enterprise Cloud Database 2024-10-17 9.8 Critical
Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated remote attackers to use this functionality to obtain any user's session cookie.
CVE-2024-5749 1 Hp 2 Designjet T730 Firmware, Designjet T830 Firmware 2024-10-16 7.5 High
Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials.
CVE-2023-22650 1 Suse 1 Rancher 2024-10-16 8.8 High
A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.
CVE-2024-38143 1 Microsoft 20 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 17 more 2024-10-16 4.2 Medium
Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability
CVE-2024-48771 1 Almando 1 Almando Play Firmware 2024-10-16 7.5 High
An issue in almando GmbH Almando Play APP (com.almando.play) 1.8.2 allows a remote attacker to obtain sensitive information via the firmware update process
CVE-2024-48768 1 Almando 1 Almando Control Firmware 2024-10-16 7.5 High
An issue in almaodo GmbH appinventor.ai_google.almando_control 2.3.1 allows a remote attacker to obtain sensitive information via the firmware update process
CVE-2024-48776 1 Shelly 1 Home Firmware 2024-10-15 7.5 High
An issue in Shelly com.home.shelly 1.0.4 allows a remote attacker to obtain sensitive information via the firmware update process
CVE-2024-48775 1 Starvedia 1 Ezset Firmware 2024-10-15 7.5 High
An issue in Plug n Play Camera com.ezset.delaney 1.2.0 allows a remote attacker to obtain sensitive information via the firmware update process.
CVE-2024-48773 1 Wo-smart 1 Morepro Firmware 2024-10-15 7.5 High
An issue in WoFit v.7.2.3 allows a remote attacker to obtain sensitive information via the firmware update process
CVE-2024-48777 1 Ledvance 1 Smartplus Firmware 2024-10-15 7.5 High
LEDVANCE com.ledvance.smartplus.eu 2.1.10 allows a remote attacker to obtain sensitive information via the firmware update process.