CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- espocrmEspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker...8.8 High
- microsoft windows server, windows server, version 1903 (server core installation), windows server 2012 +2 more +4 moreA security feature bypass vulnerability exists in Active Directory Federation Services (ADFS)...5.3 Medium
- ibm robotic process automation with automation anywhereIBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout...7.5 High
- ibm intelligent operations center, intelligent operations center for emergency management, water operations for waternamics +2 moreIBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to user enumeration,...5.9 Medium
- huawei mate 9 pro, mate 9 pro firmware +1 moreThere is an information disclosure vulnerability on Mate 9 Pro Huawei smartphones versions...4.6 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: Login credentials are vulnerable to brute force attacks through the REST API5.3 Medium
- teltonika rut950 firmwareAn issue was discovered in /cgi-bin/luci on Teltonika RTU9XX (e.g., RUT950) R_31.04.89 before...7.1 High
- plataformatec devise, devise ruby gem +1 moredevise Time-of-check Time-of-use Race Condition vulnerability9.8 Critical
- ics-cert moxa iks, eds, moxa eds-405a firmware, eds-408a firmware +2 more +4 moreMoxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication...9.8 Critical
- emerson deltavA specially crafted script could bypass the authentication of a maintenance port of Emerson...6.5 Medium
- rudrasoftech edusecindex.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm...9.8 Critical
- pivotal on demand services sdk, pivotal software broker api +1 moreOn Demand Services SDK Timing Attack Vulnerability9.1 Critical
- keycloak, redhat single sign-on +1 moreKeycloak Improper Bruteforce Detection5.4 Medium
- cloud foundry uaa, uaa release, pivotal software cloudfoundry uaa +1 more +3 moreCloud Foundry UAA MFA does not prevent brute force of MFA code6.6 Medium
- gleeztech gleez cmsA vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker...5.3 Medium
- onefilecmsonefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force...9.8 Critical
- misp-project mispAn issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can...9.8 Critical
- hclsoftware bigfix platformIBM BigFix Platform 9.2 and 9.5 uses an inadequate account lockout setting that could allow a...9.8 Critical
- belden hirschmann m1-8mm-sc, hirschmann m1-8sfp, hirschmann m1-8sm-sc +131 more +133 moreAn Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden...9.8 Critical
- ibm security guardium big data intelligenceIBM Security Guardium Big Data Intelligence (SonarG) 3.1 uses an inadequate account lockout...7.5 High
- cisco identity services engine softwareA vulnerability in the Guest Portal login page of Cisco Identity Services Engine (ISE) could...7.5 High
- synology carddav serverAn improper restriction of excessive authentication attempts vulnerability in /principals in...9.8 Critical
- dlink dir-850l firmwarehtdocs/parentalcontrols/bind.php on D-Link DIR-850L REV. A (with firmware through...7.5 High
- apache openmeetingsApache OpenMeetings has Inadequate Encryption Strength9.8 Critical
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series: Cluster configuration sync failures occur if the root user account is locked out5.3 Medium
- phpmyfaqphpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in...9.8 Critical
- rockwellautomation 1763-l16awa series a, 1763-l16awa series b, 1763-l16bbb series a +17 more +19 moreAn Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell...9.8 Critical
- ibm bigfix compliance analytics, bigfix security compliance analytics +1 moreIBM BigFix Compliance (TEMA SUAv1 SCA SCM) uses an inadequate account lockout setting that could...9.8 Critical
- moxa oncell 5004-hspa firmware, oncell 5104-hsdpa firmware, oncell 5104-hspa firmware +3 more +5 moreAn Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell...9.8 Critical
- web2pyweb2py is vulnerable to password brute-force attack9.8 Critical
- revive-adserver revive adserverRevive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication...9.8 Critical
- moxa nport, nport 5100 series firmware, nport 5100a series firmware +8 more +10 moreAn issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions...9.8 Critical
- moxa nport, nport 5100 series firmware, nport 5100a series firmware +8 more +10 moreAn issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions...9.8 Critical
- beckhoff embedded pc images, twincat, twincat components featuring automation device specification (ads) communication +2 moreBeckhoff Embedded PC Images and TwinCAT Components Improper Restriction of Excessive Authentication Attempts9.1 Critical
- polycom viewstation 128, viewstation 512, viewstation dcp +5 more +7 moreThe Telnet service for Polycom ViewStation before 7.2.4 does not restrict the number of failed...7.5 High
- 3com superstack ii ps hub 40 firmwareThe telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect...9.8 Critical
- anybus ipc\@chip firmwareBeck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users from the service when...9.8 Critical
- lightwavemo consoleserver 3200 firmwareLightwave ConsoleServer 3200 does not disconnect users after unsuccessful login attempts, which...9.8 Critical
- hp openvms vaxVAXstations running Open VMS 5.3 through 5.5-2 with VMS DECwindows or MOTIF do not properly...9.8 Critical
- compaq microcom 6000 firmwareCompaq/Microcom 6000 Access Integrator does not disconnect a client after a certain number of...7.5 High