CWE-306
CVEs classified under CWE-306, newest first.
1129 CVEsRSS
CVE-2021-4469High· 8.7PoCDenver SHO-110 IP cameras expose a secondary HTTP service on TCP port 8001 that provides access to a '/snapshot' endpoint without authentication
Denver SHO-110 IP cameras expose a secondary HTTP service on TCP port 8001 that provides access to a '/snapshot' endpoint without authentication. While the primary web interface on port 80 enforces authentication, the backdoor service al…
CVE-2025-40817Medium· 6.5A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions < V1.84.05), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions < V1.84.05), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions < V1.84.05), LOGO! 230R…
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions < V1.84.05), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions < V1.84.05), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions < V1.84.05), LOGO! 230R…
CVE-2025-40816High· 7.6A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions < V1.84.05), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions < V1.84.05), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions < V1.84.05), LOGO! 230R…
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions < V1.84.05), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions < V1.84.05), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions < V1.84.05), LOGO! 230R…
CVE-2025-11986Medium· 5.3PoCThe Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22
The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allo…
CVE-2025-12447Medium· 4.2Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page
Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security sever…
CVE-2025-12444Medium· 4.2Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page
Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: …
CVE-2025-12436Medium· 5.9Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension.…
Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension.…
CVE-2025-41090NonePoCmicroCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests
microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests. To do so, the attacker…
CVE-2025-43994High· 8.6Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability
Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, lea…
CVE-2025-41110High· 8.8Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK
Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK. This vulnerability allows an attacker to connect to the robot's WiFi and view all its data, as it runs on ROS 2 without default authentication. In…
CVE-2025-62607Medium· 5.3Nautobot Single Source of Truth (SSoT) is an app for Nautobot
Nautobot Single Source of Truth (SSoT) is an app for Nautobot. Prior to version 3.10.0, an unauthenticated attacker could access this page to view the Service Now public instance name e.g. companyname.service-now.com. This is considered …
CVE-2025-61756High· 7.5Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: System Configuration)
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: System Configuration). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.…
CVE-2025-62481Critical· 9.8Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration)
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker wi…
CVE-2025-62287Medium· 6.1Vulnerability in the Oracle Life Sciences InForm product of Oracle Health Sciences Applications (component: Web Server)
Vulnerability in the Oracle Life Sciences InForm product of Oracle Health Sciences Applications (component: Web Server). The supported version that is affected is 7.0.1.0. Easily exploitable vulnerability allows unauthenticated attacke…
CVE-2025-61757Critical· 9.8CISA KEVPoCVulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices)
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attack…
CVE-2025-61752High· 7.5Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker wit…
CVE-2025-53072Critical· 9.8PoCVulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration)
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker wi…
CVE-2025-53037Critical· 9.8Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easil…
CVE-2025-53034Medium· 5.4Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easil…
CVE-2025-11942High· 7.3A flaw has been found in 70mai X200 up to 20251010
A flaw has been found in 70mai X200 up to 20251010. Affected is an unknown function of the component Pairing. Executing manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been p…
CVE-2025-11852Medium· 5.3A vulnerability was found in Apeman ID71 218.53.203.117
A vulnerability was found in Apeman ID71 218.53.203.117. The impacted element is an unknown function of the file /onvif/device_service of the component ONVIF Service. Performing manipulation results in missing authentication. The attack …
CVE-2025-62586Critical· 9.8OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password
OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0.
CVE-2025-0275Medium· 5.3HCL BigFix Mobile 3.3 and earlier is affected by improper access control
HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.
CVE-2025-0274Medium· 5.3HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control
HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.
CVE-2025-11728Medium· 5.3The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'return_payment' and 'notice_payment' functions in…
The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'return_payment' and 'notice_payment' functions in…
CVE-2025-23356High· 8.4NVIDIA Isaac Lab contains a vulnerability in SB3 configuration parsing
NVIDIA Isaac Lab contains a vulnerability in SB3 configuration parsing. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
CVE-2025-7328Critical· 9.8Multiple Broken Authentication security issues exist in the affected product
Multiple Broken Authentication security issues exist in the affected product. The security issues are due to missing authentication checks on critical functions. These could result in potential denial-of-service, admin account takeover, …
CVE-2025-40765Critical· 9.8A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3)
A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application contains an information disclosure vulnerability. This could allow an unauthenticated remote attacker to…
CVE-2025-11672Medium· 5.3Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a specific page to obtain user group names.
Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a specific page to obtain user group names.
CVE-2025-11671Medium· 5.3Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a specific page to obtain information such as account names and IP addresses.
Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a specific page to obtain information such as account names and IP addresses.