CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-306

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
401 CVE-2017-3217 306 2018-07-24 2019-10-09
9.3
None Remote Medium Not required Complete Complete Complete
CalAmp LMU 3030 series OBD-II CDMA and GSM devices has an SMS (text message) interface that can be deployed where no password is configured for this interface by the integrator / reseller. This interface must be password protected, otherwise, the attacker only needs to know the phone number of the device (via an IMSI Catcher, for example) to send administrative commands to the device. These commands can be used to provide ongoing, real-time access to the device and can configure parameters such as IP addresses, firewall rules, and passwords.
402 CVE-2017-3216 306 Bypass 2017-06-20 2019-10-09
10.0
None Remote Low Not required Complete Complete Complete
WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.
403 CVE-2017-3209 306 2018-07-24 2020-05-28
4.8
None Local Network Low Not required Partial Partial None
The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem read/write permissions to the anonymous user. A remote user within range of the open access point on the drone may utilize the anonymous user of the FTP server to read arbitrary files, such as images and video recorded by the device, or to replace system files such as /etc/shadow to gain further access to the device. Furthermore, the DBPOWER U818A WIFI quadcopter drone uses BusyBox 1.20.2, which was released in 2012, and may be vulnerable to other known BusyBox vulnerabilities.
404 CVE-2017-2708 306 Bypass 2017-11-22 2019-10-03
4.9
None Local Low Not required None None Complete
The 'Find Phone' function in Nice smartphones with software versions earlier before Nice-AL00C00B0135 has an authentication bypass vulnerability. An unauthenticated attacker may wipe and factory reset the phone by special steps. Due to missing authentication of the 'Find Phone' function, an attacker may exploit the vulnerability to bypass the 'Find Phone' function in order to use the phone normally.
405 CVE-2017-2637 306 2018-07-26 2021-08-04
10.0
None Remote Low Not required Complete Complete Complete
A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default (by director) listening on 0.0.0.0 (all interfaces) with no-authentication or encryption. Anyone able to make a TCP connection to any compute host IP address, including 127.0.0.1, other loopback interface addresses, or in some cases possibly addresses that have been exposed beyond the management interface, could use this to open a virsh session to the libvirtd instance and gain control of virtual machine instances or possibly take over the host.
406 CVE-2017-1523 306 2017-10-24 2019-10-03
5.0
None Remote Low Not required Partial None None
IBM InfoSphere Master Data Management - Collaborative Edition 11.5 could allow an unauthorized user to download reports without authentication. IBM X-Force ID: 129892.
407 CVE-2017-1483 306 2017-09-28 2017-10-06
7.5
None Remote Low Not required Partial Partial Partial
IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 128621.
408 CVE-2017-0919 306 Bypass 2018-07-03 2018-09-04
5.0
None Remote Low Not required None Partial None
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker being able to perform operations under a group in which they were previously unauthorized.
409 CVE-2016-9496 306 2018-07-13 2019-10-09
6.1
None Local Network Low Not required None None Complete
Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, lacks authentication. An unauthenticated user may send an HTTP GET request to http://[ip]/com/gatewayreset or http://[ip]/cgi/reboot.bin to cause the modem to reboot.
410 CVE-2016-8355 306 2017-02-13 2017-02-28
9.0
None Remote Low ??? Complete Complete Complete
An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. CADD-Solis Medication Safety Software grants an authenticated user elevated privileges on the SQL database, which would allow an authenticated user to modify drug libraries, add and delete users, and change user permissions. According to Smiths-Medical, physical access to the pump is required to install drug library updates.
411 CVE-2016-7830 306 Bypass 2017-06-09 2017-06-22
5.8
None Local Network Low Not required Partial Partial Partial
Sony PCS-XG100, PCS-XG100S, PCS-XG100C, PCS-XG77, PCS-XG77S, PCS-XG77C devices with firmware versions prior to Ver.1.51 and PCS-XC1 devices with firmware version prior to Ver.1.22 allow an attacker on the same network segment to bypass authentication to perform administrative operations via unspecified vectors.
412 CVE-2016-5053 306 Exec Code 2017-04-10 2017-04-14
7.5
None Remote Low Not required Partial Partial Partial
OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 allows remote attackers to execute arbitrary commands via TCP port 4000.
413 CVE-2016-2004 306 Exec Code 2016-04-21 2019-07-12
9.3
None Remote Medium Not required Complete Complete Complete
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623.
414 CVE-2015-9030 306 Bypass 2017-06-13 2017-07-08
9.3
None Remote Medium Not required Complete Complete Complete
In all Android releases from CAF using the Linux kernel, the Hypervisor API could be misused to bypass authentication.
415 CVE-2015-5201 306 2020-02-25 2020-03-05
5.0
None Remote Low Not required None Partial None
VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows remote attackers to log in without authentication via unspecified vectors.
416 CVE-2015-2888 306 Bypass 2017-04-10 2021-09-13
7.5
None Remote Low Not required Partial Partial Partial
Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to bypass authentication, related to the MySnapCam web service.
417 CVE-2014-7271 306 2018-03-08 2018-03-27
4.6
None Local Low Not required Partial Partial Partial
Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication.
418 CVE-2014-3449 306 Bypass 2020-01-09 2020-01-14
7.5
None Remote Low Not required Partial Partial Partial
BSS Continuity CMS 4.2.22640.0 has an Authentication Bypass vulnerability
419 CVE-2013-1793 306 2019-12-10 2019-12-14
5.0
None Remote Low Not required Partial None None
openstack-utils openstack-db has insecure password creation
420 CVE-2012-2736 306 2019-12-26 2020-01-04
3.3
None Local Medium Not required Partial Partial None
In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network.
421 CVE-2011-4322 306 2020-01-21 2020-01-29
5.0
None Remote Low Not required Partial None None
websitebaker prior to and including 2.8.1 has an authentication error in backup module.
422 CVE-2011-3055 306 2012-03-22 2020-04-14
4.3
None Remote Medium Not required None Partial None
The browser native UI in Google Chrome before 17.0.963.83 does not require user confirmation before an unpacked extension installation, which allows user-assisted remote attackers to have an unspecified impact via a crafted extension.
423 CVE-2011-2187 306 2019-11-27 2019-12-16
4.6
None Local Low Not required Partial Partial Partial
xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which allows local attackers to access resources without authentication.
424 CVE-2009-1780 306 +Priv 2009-05-22 2020-05-20
7.5
None Remote Low Not required Partial Partial Partial
admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_admin_pass parameters.
425 CVE-2007-0956 306 Bypass 2007-04-06 2021-02-02
10.0
None Remote Low Not required Complete Complete Complete
The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882.
426 CVE-2006-0062 306 Bypass 2019-11-06 2019-11-06
7.5
None Remote Low Not required Partial Partial Partial
xlockmore 5.13 allows potential xlock bypass when FVWM switches to the same virtual desktop as a new Gaim window.
427 CVE-2006-0061 306 2019-11-06 2019-11-08
7.5
None Remote Low Not required Partial Partial Partial
xlockmore 5.13 and 5.22 segfaults when using libpam-opensc and returns the underlying xsession. This allows unauthorized users access to the X session.
Total number of vulnerabilities : 419   Page : 1 2 3 4 5 6 7 8 9 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.