CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- verbatim keypad secure usb 3.2 gen 1 firmware, store \'n\' go secure portable hdd firmware +1 moreAn issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design,...5.5 Medium
- schneider electric wiser smart, schneider-electric wiser smart eer21000 firmware, wiser smart eer21001 firmware +2 moreA CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that...8.6 High
- dell unity, unity operating environment, unity xt operating environment +1 more +3 moreDell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict...8.1 High
- telecommunication software samwin contact center suite, telecomsoftware samwin contact center, samwin agent +2 moreTelecommunication Software SAMwin Contact Center Suite Password SAMwinLIBVB.dll passwordScramble improper authentication6.5 Medium
- siemens desigo dxr2, desigo pxc3, desigo pxc4 +5 more +7 moreA vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 ...7.5 High
- interlogix hills comnav, carrier hills comnav firmware +1 moreInterlogix Hills ComNav Improper Restriction of Excessive Authentication Attempts5.5 Medium
- dell powerscale onefs, emc powerscale onefs +1 moreDell PowerScale OneFS, versions 8.2.x-9.3.0.x, contain an improper restriction of excessive...8.1 High
- sophos utm, unified threat management +1 moreConfd log files contain local users', including root’s, SHA512crypt password hashes with...3.3 Low
- atlassian crucible, fisheye +1 moreVarious rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to...9.8 Critical
- google android, samsung mobile devices +1 moreA vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows...4.2 Medium
- mendix forgot password, siemens mendix forgot password appstore module, mendix forgot password appstore module (mendix 7 compatible) +2 moreA vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3...9.8 Critical
- schneider-electric fellerlynk firmware, spacelynk firmware, wiser for knx firmware +2 moreA CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that...9.8 Critical
- siemens simatic pcs 7 v8.2, simatic pcs 7 v9.0, simatic pcs 7 v9.1 +7 more +9 moreA vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS...8.8 High
- schneider-electric evlink city evc1s22p4 firmware, evlink city evc1s7p4 firmware, evlink parking evf2 firmware +3 more +5 moreA CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that...7.5 High
- embedthis goaheadThe code that performs password matching when using 'Basic' HTTP authentication does not use a...9.8 Critical
- dell appsync, emc appsync +1 moreDell EMC AppSync versions 3.9 to 4.3 contain an Improper Restriction of Excessive Authentication...8.1 High
- m-files server, web +1 moreLack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts.7.5 High
- chshcms cscmsAn issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute...9.8 Critical
- 8cms ljcmsAn issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute...9.8 Critical
- zendesk enc datavault, sandisk secureaccess, zendesk enc vaultapi +2 moreENC DataVault 7.1.1W and VaultAPI v67, which is currently being used in various other...8.1 High
- huntflow enterpriseDue to insufficient server-side login-attempt limit enforcement, a vulnerability in /account...9.8 Critical
- business-dna solutions gmbh topeaseLack of Rate limiting in Authentication in TopEase7.5 High
- ibm connect:direct web services, sterling connect\ +1 moreIBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses an inadequate account lockout setting...5.9 Medium
- asus gt-ax11000 firmware, rt-ax3000 firmware, rt-ax55 firmware +15 more +17 moreA brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000,...9.8 Critical
- ionic identity vaultIn Ionic Identity Vault before 5.0.5, the protection mechanism for invalid unlock attempts can be...6.8 Medium
- gnu mailman, debian linux +1 moreIn GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an...6.5 Medium
- fimer aurora visionAn issue was discovered in Fimer Aurora Vision before 2.97.10. The response to a failed login...5.3 Medium
- elabftwBypass bruteforce protection on login form in elabftw5.9 Medium
- gnu mailman, debian linux +1 moreGNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is...4.3 Medium
- inhand networks ir615 router, inhandnetworks ir615 firmware +1 moreInHand Networks IR615 Router6.3 Medium
- dell cpg bios, latitude 5310 2-in-1 firmware, latitude 5320 firmware +19 more +21 moreDell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A...5.7 Medium
- dell cpg bios, latitude 5310 2-in-1 firmware, latitude 5320 firmware +19 more +21 moreDell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A...5.7 Medium
- ibm websphere application server, websphere application server liberty +1 moreIBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could...3.7 Low
- bab-technologie eibport firmwareBAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to ...9.8 Critical
- bab-technologie eibport firmwareBAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access...9.8 Critical
- thedaylightstudio fuel cmsFuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php5.3 Medium
- vmware identity manager, workspace one access, cloud foundation +1 more +3 moreVMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on...7.5 High
- talelin lin-cms-flaskLin-CMS-Flask vulnerable to Improper Authentication9.8 Critical
- ibm security guardiumIBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote...5.3 Medium
- mozilla firefox, thunderbird +1 moreAfter requesting multiple permissions, and closing the first permission panel, subsequent...6.5 Medium
- openstack keystoneOpenStack Keystone allows information disclosure during account locking7.5 High
- vizio e50x-e1 firmware, p65-f1 firmware +1 moreThe pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and...7.5 High
- firefly-iii firefly-iii/firefly-iii, firefly iii +1 moreImproper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iii5.3 Medium
- debian linux, lemonldap-ng lemonldap\ +1 moreAn issue was discovered in LemonLDAP::NG before 2.0.12. Session cache corruption can lead to...8.8 High
- mv mconnectInformation disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker...7.5 High
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreLack of ratelimit on public DAV endpoint5.3 Medium
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreLack of ratelimit on shareinfo endpoint5.3 Medium
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreRatelimit not applied on OCS API responses3.7 Low
- ibm guardium data encryptionIBM Guardium Data Encryption (GDE) 4.0.0.4 uses an inadequate account lockout setting that could...5.9 Medium
- dell storage manager, qsan sanos, xevo +2 moreQSAN Storage Manager, XEVO, SANOS - Improper Restriction of Excessive Authentication Attempts9.8 Critical
- Show moreLoading…