CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- stormshield network securityAn issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur.7.5 High
- hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 moreNextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an atta…9.8 Critical
- apache apisix dashboardBypass network access control5.3 Medium
- redhat 3scale, 3scale api management +1 moreIt was found that all versions of 3Scale developer portal lacked brute force protections. An...7.3 High
- schneider-electric homelynk firmware, spacelynk firmware +1 moreInsufficiently Protected Credentials vulnerability exists in homeLYnk (Wiser For KNX) and...9.8 Critical
- bluetooth mesh profile, core specification +1 moreMesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to...7.5 High
- invoiceplaneInvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is...5.3 Medium
- gestsupGestsup before 3.2.10 allows account takeover through the password recovery functionality (remote...9.8 Critical
- linux kernel, fedoraproject fedora +1 moreAn issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly...5.5 Medium
- broadcom ehealth** UNSUPPORTED WHEN ASSIGNED ** CA eHealth Performance Manager through 6.3.2.12 is affected by...7.5 High
- advantech spectre rt ert351 firmwareAdvantech Spectre RT ERT351 Versions 5.1.3 and prior has insufficient login authentication...9.8 Critical
- ibm spectrum scaleIBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account...6.2 Medium
- siemens ruggedcom rm1224, scalance m-800, scalance s615 +5 more +7 moreA vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE...7.5 High
- adguard homeAn issue was discovered in AdGuard before 0.105.2. An attacker able to get the user's cookie is...7.5 High
- gigaset dx600a firmwareThe telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does...9.8 Critical
- eyesofnetworkEyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might...9.8 Critical
- mbconnectline mbconnect24, mymbconnect24 +1 moreAn issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login...9.8 Critical
- xn--b1agzlht fx aggregator terminal clientThe Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a...7.5 High
- logitec corporation lan-wh450n/gr, logitech lan-wh450n\/gr firmware +1 moreImproper restriction of excessive authentication attempts in LOGITEC LAN-WH450N/GR allows an...6.5 Medium
- discourseIn Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement...7.5 High
- cisco webex meetings server, webex meetings +1 moreCisco Webex Meetings and Cisco Webex Meetings Server Host Key Brute Forcing Vulnerability5.4 Medium
- mersive solstice pod firmwareIn Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using...7.5 High
- mersive solstice pod firmwareIn Solstice Pod before 3.3.0 (or Open4.3), the screen key can be enumerated using brute-force...7.5 High
- moxa nport iaw5000a-i/o, nport iaw5000a-i\/o firmware +1 moreMOXA NPort IAW5000A-I/O Series9.8 Critical
- limitloginattempts limit login attempts reloadedLimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress...9.8 Critical
- bitrix24 bitrix frameworkAn issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. An "User...6.5 Medium
- cpanelIn cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).6.5 Medium
- bigbluebuttonAn issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because...3.7 Low
- schneider-electric ecostruxure control expertA CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC...9.8 Critical
- anuko time trackerAnuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows...7.5 High
- clickstudios passwordstateAn issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system...6.8 Medium
- tikitiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid...9.8 Critical
- sonicwall sonicos, sonicosv +1 moreA vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist...6.5 Medium
- zte zxone 19700 snpe firmwareA ZTE product is impacted by the improper access control vulnerability. Due to lack of an...9.8 Critical
- nextcloud preferred providers, opensuse backports sle, leap +2 moreA missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password...5.3 Medium
- mediawiki, fedoraproject fedora +1 moreOATHAuth extension in MediaWiki is not implementing rate limit7.5 High
- gradle enterpriseAn issue was discovered in Gradle Enterprise 2018.5. There is a lack of lock-out after excessive...5.5 Medium
- gitlabA vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth...6.5 Medium
- siemens simatic hmi basic panels 2nd generation (incl. siplus variants), simatic hmi comfort panels (incl. siplus variants), simatic hmi mobile panels +5 more +7 moreA vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS...9.8 Critical
- schneider-electric spacelynk firmware, wiser for knx firmware +1 moreImproper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware...7.5 High
- open-xchange appsuiteOX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User...9.8 Critical
- mitel 6863 firmware, 6865 firmware, 6867 firmware +8 more +10 moreThe Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0...7.5 High
- umanni human resourcesUmanni RH 1.0 does not limit the number of authentication attempts. An unauthenticated user may...9.8 Critical
- nextcloud preferred providersImproper check of inputs in Nextcloud Preferred Providers app v1.6.0 allowed to perform a denial...5.3 Medium
- nec um4730 firmware, um8000 firmware +1 moreNEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may...9.1 Critical
- ibm security key lifecycle managerIBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that...8.6 High
- ibm verify gateway (ivg), verify gateway +1 moreIBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could...7.5 High
- open source openclinic ga, openclinic ga project ga +1 moreOpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system...9.8 Critical
- open source openclinic ga, openclinic ga project ga +1 moreOpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account...9.8 Critical
- ufactory xarm5 lite, xarm 6 and xarm 7, xarm 5 lite firmware +1 moreRVD#3322: Weak authentication implementation make the system vulnerable to a brute-force attack over adjacent networks9.4 Critical
- Show moreLoading…