CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- kiwitcms kiwi, kiwi tcms +1 moreKiwi TCMS has no protection against brute-force attacks on login page7.5 High
- dell supportassist, supportassist for business pcs, supportassist for home pcs +2 moreDell SupportAssist contains a rate limit bypass issues in screenmeet API third party component....3.7 Low
- yugabyte yugabytedb managed, yugabytedb anywhere +1 moreServer-Side Request Forgery6.8 Medium
- snap one wattbox wb-300-ip-3, snapav wattbox wb-300-ip-3 firmware +1 moreSnap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection...7.5 High
- schneider electric conext™ combox, schneider-electric conext combox firmware +1 moreA CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that...8.6 High
- lexmark b2236 firmware, b2338 firmware, b2442 firmware +125 more +127 moreLexmark products through 2023-01-10 have Improper Control of Interaction Frequency.7.5 High
- hcl software bigfix mobileHCL BigFix Mobile / Modern Client Management Server passwords are susceptible to a brute-force attack5.4 Medium
- easyvista service managerAn issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application...8.2 High
- usememos memos, usememos/memos +1 moreImproper Restriction of Excessive Authentication Attempts in usememos/memos9.8 Critical
- devolutions remote desktop managerWeak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows...7.4 High
- planetestream planet estreamPlanet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative...8.8 High
- fortinet fortideceptor, fortisandbox +1 moreAn insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to...3.6 Low
- checkpoint ssl network extenderThe IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network...7.5 High
- wger, wger-project wger-project/wger +1 moreImproper Restriction of Excessive Authentication Attempts in wger-project/wger7.8 High
- maarch rmMaarch RM 2.8.3 solution contains an improper restriction of excessive authentication attempts...7.5 High
- joinmastodon mastodon, mastodon mastodon/mastodon +1 moreImproper Restriction of Excessive Authentication Attempts in mastodon/mastodon9.8 Critical
- statamic cmsWBCE CMS Header class.login.php increase_attempts excessive authentication3.7 Low
- aiphone gt-db-vn firmware, gt-dmb-lvn firmware, gt-dmb-n firmware +1 more +3 moreAiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against...6.5 Medium
- kareadita kareadita/kavita, kavitareader kavita +1 moreImproper Restriction of Excessive Authentication Attempts in kareadita/kavita9.4 Critical
- kareadita kareadita/kavita, kavitareader kavita +1 moreImproper Restriction of Excessive Authentication Attempts in kareadita/kavita9.4 Critical
- citrix application delivery controller firmware, gateway, citrix adc, gateway +2 moreUser login brute force protection functionality bypass5.3 Medium
- pwndoc project pwndocPwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by...5.3 Medium
- pwndoc project pwndocPwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by...5.3 Medium
- chatwoot, chatwoot chatwoot/chatwoot +1 moreImproper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot9.4 Critical
- getkirby kirbyUser enumeration in the code-based login and password reset forms4.8 Medium
- gxgroup gpon ont titanium 2122a firmwareAn issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate...9.8 Critical
- gitlabAn issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions...3.7 Low
- dell xtremio, xtremio management server +1 moreDell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote...8.1 High
- wijungle u250 firmwareWiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the...9.8 Critical
- fortinet fortitesterAn improper restriction of excessive authentication attempts vulnerability [CWE-307] in...8.1 High
- connectwise screenconnectConnectWise - ScreenConnect Session Code Bypass5.3 Medium
- huawei ws7200-10 firmwareThere is a password verification vulnerability in WS7200-10 11.0.2.13. Attackers on the LAN may...6.5 Medium
- plextracThe PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts...7.5 High
- plextracThe PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission...8.8 High
- octoprint, octoprint octoprint/octoprint +1 moreAuthentication Bypass by Primary Weakness in octoprint/octoprint3.7 Low
- nextcloud talk, kiteworks security-advisories +1 moreMissing rate limit when trying to join a password protected Nextcloud Talk conversation3.5 Low
- redhat process automation managerA flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a...9.8 Critical
- zammadZammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force...9.8 Critical
- nextcloud server, kiteworks security-advisories +1 moreMissing brute force protection on cloud federation sharing in Nextcloud Server6.5 Medium
- bookwyrm-social bookwyrmMissing rate limit in Authentication in bookwyrm5.3 Medium
- ovarro tbox, tbox lt2-530 firmware, tbox lt2-532 firmware +6 more +8 moreOvarro TBox Insufficiently Protected Credentials7.5 High
- dell powerstore, emc powerstore 1200t firmware, emc powerstore 3200t firmware +3 more +5 moreDell EMC PowerStore, contain(s) an Improper Restriction of Excessive Authentication Attempts...8.1 High
- dsk dsknetAn issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control....5.3 Medium
- ibm security verify governanceIBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could...5.3 Medium
- heroiclabs heroiclabs/nakama, nakama +1 moreImproper Restriction of Excessive Authentication Attempts in heroiclabs/nakama7.5 High
- ibm spectrum protect serverWhile a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being...5.3 Medium
- ibm spectrum protect serverAn IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force...5.9 Medium
- ibm spectrum protect server, spectrum protect operations center +1 moreIn some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0...5.9 Medium
- 17ido topidp3000 topsec operating systemAn issue in TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp allows attackers to...9.8 Critical
- verbatim gd25lk01-3637-c firmware, keypad secure usb 3.2 gen 1 firmware +1 moreAn issue was discovered in certain Verbatim drives through 2022-03-31. The security feature for...4.6 Medium
- Show moreLoading…