CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- fit2cloud jumpserverSSH public key login without private key challenge if mfa is enabled in jumpserver5.4 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreKernel: ksmbd brute force delay bypass via asynchronous requests3.7 Low
- opencartOpenCart v4.0.2.2 is vulnerable to Brute Force Attack.9.8 Critical
- ibm guardium cloud key managerIBM Security Guardium Data Encryption information disclosure5.3 Medium
- ibm security guardiumIBM Security Guardium information disclosure7.5 High
- opto 22 snap pac s1, opto22 snap pac s1 firmware +1 moreImproper Restriction of Excessive Authentication Attempts in OPTO 22 SNAP PAC S1 Built-in Web Server8.6 High
- nextcloud server, kiteworks security-advisories +1 moreMissing brute force protection on password reset token OAuth2 API controller5.8 Medium
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Elevation of Privilege Vulnerability9.8 Critical
- codesys development systemCODESYS: Missing Brute-Force protection in CODESYS Development System3.3 Low
- johnson controls iq wifi 6, johnsoncontrols iq wifi 6 firmware +1 moreIQ Wifi 68.3 High
- weintek weincloudWeintek Weincloud Improper Restriction of Excessive Authentication Attempts5.3 Medium
- adobe coldfusionAdobe ColdFusion Improper Restriction of Excessive Authentication Attempts Security feature bypass7.5 High
- sap businessobjects business intelligence, sap se businessobjects business intelligence platform +1 morePassword Change rate limit bypass in SAP BusinessObjects Business Intelligence Platform5.9 Medium
- campcodes online shopping portalPHPGurukul Online Shopping Portal Registration Page excessive authentication6.5 Medium
- sick ag icr890-4, sick icr890-4 firmware +1 moreImproper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a...5.3 Medium
- piigab m-bus softwarepack, m-bus 900s firmware +1 morePiiGAB M-Bus Improper Restriction of Excessive Authentication Attempts5.9 Medium
- d-link dsl-224 firmware version 3.0.10, dsl-224 firmware +1 moreD-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts9.8 Critical
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server password reset endpoint is not brute force protected8.7 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's brute force protection allows someone to send more requests than intended8.7 High
- ibm security directory suite vaIBM Security Directory Suite VA information disclosure7.5 High
- fortinet fortisiemAn Improper Restriction of Excessive Authentication Attempts [CWE-307] in FortiSIEM below 7.0.0...8.1 High
- froxlor, froxlor froxlor/froxlor +1 moreImproper Restriction of Excessive Authentication Attempts in froxlor/froxlor9.8 Critical
- tgstation tgstation-serverWindows user name disclosure in TGstation5.8 Medium
- inpiazza cloud wifiThe captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on...6.5 Medium
- joomla joomla\!, joomla! project cms +1 more[20230502] - Core - Bruteforce prevention within the mfa screen7.5 High
- nextcloud server, kiteworks security-advisories +1 moreBasic auth header on WebDAV requests is not brute-force protected in Nextcloud8.1 High
- kiteworks security-advisories, nextcloud user oidc +1 moreNextcloud user_oidc app is missing brute force protection8.0 High
- linagora linagora/twake, twake +1 moreImproper Restriction of Excessive Authentication Attempts in linagora/twake5.5 Medium
- azuracast, azuracast azuracast/azuracast +1 moreImproper Restriction of Excessive Authentication Attempts in azuracast/azuracast7.3 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server missing brute force protection for passwords of password protected share links3.1 Low
- schneider electric netbotz 4 - 355/450/455/550/570, schneider-electric netbotz 355 firmware, netbotz 450 firmware +3 more +5 moreA CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists...7.5 High
- entab erpENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a...5.3 Medium
- janeczku calibre-web, janeczku/calibre-web +1 moreImproper Restriction of Excessive Authentication Attempts in janeczku/calibre-web7.3 High
- revive adserverThe login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks.7.5 High
- blackvue dr750-2ch ir lte firmware, dr750-2ch lte firmware +1 moreBlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase...9.8 Critical
- fortinet fortios, fortiproxy +1 moreAn improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet...4.7 Medium
- dpgaspar flask-appbuilderNo Rate Limiting on Login AUTH DB7.5 High
- nextcloud server, kiteworks security-advisories +1 moreMissing brute force protection on password reset token in Nextcloud Server5.3 Medium
- linagora linagora/twake, twake +1 moreImproper Restriction of Excessive Authentication Attempts in linagora/twake7.8 High
- zohocorp manageengine adselfservice plusZoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that...9.1 Critical
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server and Enterprise Server missing brute force protection on password confirmation modal4.2 Medium
- netgate pfsense plus, pfsense +1 moreImproper restriction of excessive authentication attempts in the SSHGuard component of Netgate...9.8 Critical
- answer, answerdev answerdev/answer +1 moreImproper Restriction of Excessive Authentication Attempts in answerdev/answer5.3 Medium
- fortinet fortideceptorA improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet...3.5 Low
- fortinet fortiauthenticatorA improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet...3.5 Low
- fortinet fortimailA improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet...3.5 Low
- xwiki, xwiki xwiki-platform +1 moreTwo XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor7.5 High
- sonicwall sonicosSonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an...8.8 High
- chamberlain myqA lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS)...9.8 Critical
- modoboa installer, modoboa/modoboa-installer +1 moreImproper Restriction of Excessive Authentication Attempts in modoboa/modoboa-installer7.8 High
- Show moreLoading…