CWE-306 · 2.686 kayıt
Kritik işlev için kimlik doğrulaması eksik
Neden olur?
Geliştirme ya da destek için eklenen bir işlev, üretime kimlik doğrulaması olmadan çıkıyor. Çoğu zaman “yalnızca iç ağdan erişilir” varsayımına güvenilir.
Hatalı ve düzeltilmiş kod
Temsili ders örneği. Vurgulu satırlar hatanın ve düzeltmenin yeridir.
Hatalı
// Destek ekibi için eklendiapp.post("/maintenance/reset", resetDevice);Düzeltilmiş
if (config.maintenanceEnabled) { app.post( "/maintenance/reset", requireSession, requireRole("admin"), resetDevice );}Nasıl önlenir?
- 01Bakım ve hata ayıklama işlevlerini üretim derlemesinden çıkarın.
- 02Kalması gerekiyorsa yetki kontrolü ve ayrı bir yapılandırma anahtarıyla koruyun.
- 03Ağ konumunu kimlik doğrulamanın yerine koymayın.
Bu sınıftaki CVE’ler
2.688 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
100Hemen | CVE-2025-32433Silahlaştırılmış | Erlang/OTP SSH Vulnerable to Pre-Authentication RCEerlang · erlang\/otp · CWE-306 | Kritik10,0 | KEV | %98,8 | 16 Nis 2025 |
99Hemen | CVE-2025-3248Silahlaştırılmış | Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/codelangflow · langflow · CWE-306 | Kritik9,8 | KEV | %100,0 | 7 Nis 2025 |
99Hemen | CVE-2022-1388Silahlaştırılmış | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior f5 · big-ip access policy manager · CWE-306 | Kritik9,8 | KEV | %100,0 | 5 May 2022 |
99Hemen | CVE-2021-37415Silahlaştırılmış | Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authenticatiozohocorp · manageengine servicedesk plus · CWE-306 | Kritik9,8 | KEV | %99,8 | 1 Eyl 2021 |
99Hemen | CVE-2020-13927Silahlaştırılmış | The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security riapache · airflow · CWE-306 | Kritik9,8 | KEV | %99,8 | 10 Kas 2020 |
99Hemen | CVE-2022-21587Silahlaştırılmış | Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).oracle · e-business suite · CWE-306 | Kritik9,8 | KEV | %98,3 | 18 Eki 2022 |
98Hemen | CVE-2020-6207Silahlaştırılmış | SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication forsap · solution manager · CWE-306 | Kritik9,8 | KEV | %98,1 | 10 Mar 2020 |
98Hemen | CVE-2026-20253Silahlaştırılmış | Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprisesplunk · splunk · CWE-306 | Kritik9,8 | KEV | %96,9 | 10 Haz 2026 |
98Hemen | CVE-2021-35587Silahlaştırılmış | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent).oracle · access manager · CWE-306 | Kritik9,8 | KEV | %96,3 | 19 Oca 2022 |
98Hemen | CVE-2020-6287Silahlaştırılmış | SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows ansap · netweaver application server java · CWE-306 | Kritik10,0 | KEV | %94,7 | 14 Tem 2020 |
97Hemen | CVE-2024-0012Silahlaştırılmış | PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)paloaltonetworks · pan-os · CWE-306 | Kritik9,3 | KEV | %99,8 | 18 Kas 2024 |
97Hemen | CVE-2026-41940Silahlaştırılmış | WebPros cPanel and WHM Authentication Bypass via Login Flowcpanel · cpanel · CWE-306 | Kritik9,3 | KEV | %98,5 | 29 Nis 2026 |
97Hemen | CVE-2024-47575Silahlaştırılmış | A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, Fofortinet · fortimanager · CWE-306 | Kritik9,8 | KEV | %94,8 | 23 Eki 2024 |
97Hemen | CVE-2021-44077Silahlaştırılmış | Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unzohocorp · manageengine servicedesk plus · CWE-306 | Kritik9,8 | KEV | %93,3 | 29 Kas 2021 |
97Hemen | CVE-2024-11680Silahlaştırılmış | ProjectSend Unauthenticated Configuration Modificationprojectsend · projectsend · CWE-306 | Kritik9,8 | KEV | %91,7 | 26 Kas 2024 |
96Hemen | CVE-2020-3952Silahlaştırılmış | Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC)vmware · vcenter server · CWE-306 | Kritik9,8 | KEV | %90,4 | 10 Nis 2020 |
96Hemen | CVE-2025-61757Silahlaştırılmış | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).oracle · identity manager · CWE-306 | Kritik9,8 | KEV | %88,6 | 21 Eki 2025 |
95Hemen | CVE-2025-0108Silahlaştırılmış | PAN-OS: Authentication Bypass in the Management Web Interfacepaloaltonetworks · pan-os · CWE-306 | Yüksek8,8 | KEV | %98,5 | 12 Şub 2025 |
95Hemen | CVE-2024-5910Silahlaştırılmış | Expedition: Missing Authentication Leads to Admin Account Takeoverpaloaltonetworks · expedition · CWE-306 | Kritik9,3 | KEV | %91,8 | 10 Tem 2024 |
95Hemen | CVE-2022-26143Silahlaştırılmış | The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers tomitel · micollab · CWE-306 | Kritik9,8 | KEV | %87,3 | 10 Mar 2022 |
95Hemen | CVE-2024-51567Silahlaştırılmış | upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication andcyberpanel · cyberpanel · CWE-306 | Kritik9,8 | KEV | %86,6 | 29 Eki 2024 |
93Hemen | CVE-2026-24423Silahlaştırılmış | SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub APIsmartertools · smartermail · CWE-306 | Kritik9,3 | KEV | %88,2 | 23 Oca 2026 |
90Hemen | CVE-2017-10271Silahlaştırılmış | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security).oracle · weblogic server · CWE-306 | Yüksek7,5 | KEV | %100,0 | 19 Eki 2017 |
85Hemen | CVE-2022-24990Silahlaştırılmış | TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/aterra-master · terramaster operating system · CWE-306 | Yüksek7,5 | KEV | %83,0 | 7 Şub 2023 |
84Hemen | CVE-2023-27532Silahlaştırılmış | Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained.veeam · veeam backup \& replication · CWE-306 | Yüksek7,5 | KEV | %81,3 | 10 Mar 2023 |
- CVE-2025-32433100Hemen
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %99erlang · erlang\/otp16 Nis 2025
- CVE-2025-324899Hemen
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100langflow · langflow7 Nis 2025
- CVE-2022-138899Hemen
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100f5 · big-ip access policy manager5 May 2022
- CVE-2021-3741599Hemen
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authenticatio
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100zohocorp · manageengine servicedesk plus1 Eyl 2021
- CVE-2020-1392799Hemen
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security ri
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100apache · airflow10 Kas 2020
- CVE-2022-2158799Hemen
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98oracle · e-business suite18 Eki 2022
- CVE-2020-620798Hemen
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98sap · solution manager10 Mar 2020
- CVE-2026-2025398Hemen
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97splunk · splunk10 Haz 2026
- CVE-2021-3558798Hemen
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent).
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %96oracle · access manager19 Oca 2022
- CVE-2020-628798Hemen
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %95sap · netweaver application server java14 Tem 2020
- CVE-2024-001297Hemen
PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
KritikCVSS 9,3KEVSilahlaştırılmışEPSS %100paloaltonetworks · pan-os18 Kas 2024
- CVE-2026-4194097Hemen
WebPros cPanel and WHM Authentication Bypass via Login Flow
KritikCVSS 9,3KEVSilahlaştırılmışEPSS %99cpanel · cpanel29 Nis 2026
- CVE-2024-4757597Hemen
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, Fo
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %95fortinet · fortimanager23 Eki 2024
- CVE-2021-4407797Hemen
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to un
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %93zohocorp · manageengine servicedesk plus29 Kas 2021
- CVE-2024-1168097Hemen
ProjectSend Unauthenticated Configuration Modification
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %92projectsend · projectsend26 Kas 2024
- CVE-2020-395296Hemen
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC)
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %90vmware · vcenter server10 Nis 2020
- CVE-2025-6175796Hemen
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %89oracle · identity manager21 Eki 2025
- CVE-2025-010895Hemen
PAN-OS: Authentication Bypass in the Management Web Interface
YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %98paloaltonetworks · pan-os12 Şub 2025
- CVE-2024-591095Hemen
Expedition: Missing Authentication Leads to Admin Account Takeover
KritikCVSS 9,3KEVSilahlaştırılmışEPSS %92paloaltonetworks · expedition10 Tem 2024
- CVE-2022-2614395Hemen
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %87mitel · micollab10 Mar 2022
- CVE-2024-5156795Hemen
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %87cyberpanel · cyberpanel29 Eki 2024
- CVE-2026-2442393Hemen
SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
KritikCVSS 9,3KEVSilahlaştırılmışEPSS %88smartertools · smartermail23 Oca 2026
- CVE-2017-1027190Hemen
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security).
YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %100oracle · weblogic server19 Eki 2017
- CVE-2022-2499085Hemen
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/a
YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %83terra-master · terramaster operating system7 Şub 2023
- CVE-2023-2753284Hemen
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained.
YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %81veeam · veeam backup \& replication10 Mar 2023