CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- venki supravizio bpmVenki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An...9.8 Critical
- mattermost serverAn issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks...7.3 High
- schneider-electric easergy t300 firmwareA CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in...9.8 Critical
- royalapps royal tsRoyal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel...8.8 High
- google androidAn issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. The...9.8 Critical
- foxitsoftware phantompdf, reader +1 moreAn issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has brute-force attack...9.8 Critical
- ibm security guardiumIBM Security Guardium 11.1 uses an inadequate account lockout setting that could allow a remote...4.4 Medium
- ibm security identity governance and intelligenceIBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate...5.3 Medium
- google androidAn issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software...7.5 High
- sorceryImproper Restriction of Excessive Authentication Attempts in Sorcery8.3 High
- oklok project oklokThe OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has weak...9.8 Critical
- oklok project oklokThe OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not...7.5 High
- dlink dir-615 firmwareThe login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA...8.8 High
- ixsystems freenas firmware, truenas firmware +1 moreAn issue was discovered in iXsystems FreeNAS 11.2 and 11.3 before 11.3-U1. It allows a denial of...7.5 High
- argoproj argo cdImproper Restriction of Excessive Authentication Attempts in Argo API7.5 High
- juniper networks jatp, juniper advanced threat protection, virtual advanced threat protection +2 moreJATP Series: JATP Is susceptible to slow brute force attacks on the SSH service.5.3 Medium
- hcltech appscan, ibm corporation hcl appscan standard edition +1 moreHCL AppScan Standard is vulnerable to excessive authorization attempts9.8 Critical
- pulsesecure pulse connect secure, pulse policy secure +1 moreAn issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet...8.8 High
- cacagoo tv-288zd-2mp firmwareCACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak...9.8 Critical
- google androidAn issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos7885,...9.8 Critical
- hp deskjet ink advantage 5000 m2u86a firmware, deskjet ink advantage 5000 m2u89b firmware, envy 5000 m2u85a firmware +5 more +7 moreA potential security vulnerability has been identified for certain HP Printers and All-in-Ones...6.5 Medium
- ricoh sp c250dn firmware, sp c250sf firmware, sp c252dn firmware +1 more +3 moreRicoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks....9.8 Critical
- xerox phaser 3320 firmwareSome Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement account lockout....7.5 High
- netgear cg3700b firmwareThe Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over...9.8 Critical
- hunesion i-onenetIncorrect Access Control in Hunesion i-oneNet 3.0.6042.1200 allows the local user to access other...5.5 Medium
- linksys spa2102 firmwareThe SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a...8.8 High
- keplerproject cgiluaThe session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated...6.1 Medium
- py-bcrypt, fedoraproject fedora +1 moreImproper Restriction of Excessive Authentication Attempts in py-bcrypt7.5 High
- pwgenThe Phonemes mode in Pwgen 2.06 generates predictable passwords, which makes it easier for...9.8 Critical
- dolibarr erp\/crmDolibarr Improper Restriction of Excessive Authentication Attempts9.8 Critical
- hikvision ds-7204hghi-f1 firmwareHikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for...5.3 Medium
- gitlab, gitlab ce/ee +1 moreAn information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12...4.3 Medium
- omron plc cj firmware, plc cs firmware, plc nj firmware +2 moreIn Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series,...9.8 Critical
- weidmueller ie-sw-pl08m-6tx-2sc firmware, ie-sw-pl08m-6tx-2scs firmware, ie-sw-pl08m-6tx-2st firmware +37 more +39 moreAn issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build...9.8 Critical
- saltstackSaltStack RSA Key Generation allows remote users to decrypt communications8.1 High
- huawei honor play firmwareHonor play smartphones with versions earlier than 9.1.0.333(C00E333R1P1T8) have an information...4.6 Medium
- huawei hisuite, hwbackup +1 moreHiSuite with 9.1.0.305 and earlier versions and 9.1.0.305(MAC) and earlier versions and HwBackup...5.5 Medium
- pimcorePimcore 2FA Vulnerable to Brute Forcing9.8 Critical
- pimcorePimcore Discloses Usernames In Use7.5 High
- cryptocatCryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force Weakness7.5 High
- autopi 4g\/lte firmware, wi-fi\/nb firmware +1 moreAutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force...9.8 Critical
- bluditbl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection...3.7 Low
- vzug combi-stream mslq firmwareAn issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05...9.8 Critical
- ibm security directory serverIBM Security Directory Server 6.4.0 uses an inadequate account lockout setting that could allow a...7.5 High
- dell elastic cloud storage, emc elastic cloud storage +1 moreDell EMC ECS versions prior to 3.4.0.0 contain an improper restriction of excessive...8.1 High
- dell integrated data protection appliance, emc integrated data protection appliance firmware +1 moreDell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of...9.8 Critical
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1)....9.8 Critical
- google nest cam iq indoor firmwareAn exploitable information disclosure vulnerability exists in the Weave PASE pairing...9.0 Critical
- ibm security guardium big data intelligenceIBM Security Guardium Big Data Intelligence 4.0 (SonarG) uses an inadequate account lockout...7.5 High
- telenav scout gps linkThe Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an...7.5 High
- Show moreLoading…