CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- argoproj argo cd, argo-cd +1 moreArgo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss9.8 Critical
- schneider electric easergy t200 (dnp3) models: t200i, t200e, t200p, t200s, t200h, easergy t200 (iec104) models: t200i, t200e, t200p, t200s, t200h, easergy t200 (modbus) models: t200i, t200e, t200p, t200s, t200h +5 more +7 moreCWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that...9.8 Critical
- icewhale casaos, icewhaletech casaos-userservice +1 moreCasaOS Improper Restriction of Excessive Authentication Attempts vulnerability9.1 Critical
- innovaphone pbxAn issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to...6.5 Medium
- areal topkapi webserv2Temporary denial of service during a brute force attack7.5 High
- laborofficefreeWeak MySQL database root password in LaborOfficeFree6.8 Medium
- authcrunch caddy-securityImproper Restriction of Excessive Authentication Attempts in github.com/greenpau/caddy-security4.8 Medium
- dell recoverpoint for virtual machines, recoverpoint for vms +1 moreDell RecoverPoint for Virtual Machines 5.3.x contains a brute force/dictionary attack...6.5 Medium
- ibm engineering lifecycle optimization, engineering lifecycle optimization - publishing +1 moreIBM Engineering Lifecycle Optimization information disclosure7.5 High
- ibm engineering lifecycle optimization, engineering lifecycle optimization - publishing +1 moreIBM Engineering Lifecycle Optimization HTTP header injection5.1 Medium
- ibm cloud pak systemIBM Cloud Pak System information disclosure7.5 High
- ibm powerscIBM PowerSC information Disclosure7.5 High
- splicecom maximiser soft pbxSpliceCom Maximiser Soft PBX v1.5 and before does not restrict excessive authentication attempts,...9.8 Critical
- omron cj-series and cs-series cpu modules, cj1g-cpu42p firmware, cj1g-cpu43p firmware +44 more +46 moreOmron FINS memory protection susceptible to bruteforce8.6 High
- ibm app connect enterpriseIBM App Connect Enterprise denial of service9.1 Critical
- hozard alarm systemThe number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state...8.1 High
- wwbn avideoWWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability7.3 High
- nextcloud server, kiteworks security-advisories +1 moreBruteforce protection can be bypassed with misconfigured proxy5.3 Medium
- m-files serverBrute force vulnerability in M-Files user authentication7.5 High
- xpand-it write-back managerXpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows...9.1 Critical
- eurotel etl3100, etl3100 firmware +1 moreImproper Restriction of Excessive Authentication Attempts9.8 Critical
- thememylogin 2fa, unknown tml-2fa +1 moreTheme My Login 2FA < 1.2 - Lack of Rate Limiting9.8 Critical
- thecosy icecmsThecosy IceCMS Captcha login excessive authentication5.3 Medium
- primx zedmail, zonecentral, zed\! +2 moreBy default, .ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI...7.5 High
- umbraco cms, umbraco-cms +1 moreUmbraco CMS brute force exploit can be used to collect valid usernames5.3 Medium
- html-js doracmsDoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and...9.8 Critical
- be devious web development password reset with code for wordpress rest apiWordPress Password Reset with Code for WordPress REST API Plugin <= 0.0.15 is vulnerable to Broken Authentication9.8 Critical
- connectize ac21000 g6 firmwareA client side rate limit issue discovered in Connectize AC21000 G6 641.139.1.1256 allows...9.8 Critical
- librenmsRate limiting Bypass on login page in libreNMS5.3 Medium
- kodcloud kodboxkodbox 1.46.01 has a security flaw that enables user enumeration. This problem is present on the...9.8 Critical
- fortinet fortimailAn improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail...5.3 Medium
- sap se netweaver as java, sap netweaver application server java +1 moreInformation Disclosure in NetWeaver AS Java Logon5.3 Medium
- samsung ue40d7000, ue40d7000 firmware +1 moreSamsung Smart TV UE40D7000 WPS DoS attack3.5 Low
- mitsubishi electric corporation melsec iq-f series fx5s-30mr/es, melsec iq-f series fx5s-30mt/es, melsec iq-f series fx5s-30mt/ess +140 more +142 moreDenial-of-Service（DoS） Vulnerability in Web server function on MELSEC Series CPU module5.3 Medium
- chunghwa telecom nokia g-040w-q, nokia g-040w-q firmware +1 moreChunghwa Telecom NOKIA G-040W-Q - Excessive Authentication Attempts7.5 High
- elenos etg150 fm, etg150 firmware +1 moreA lack of rate limiting in Elenos ETG150 FM transmitter v3.12 allows attackers to obtain user...7.5 High
- jhipstergenerator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character7.5 High
- sielco polyeco1000, polyeco1000 firmware, polyeco300 firmware +1 more +3 moreImproper Restriction of Excessive Authentication Attempts in Sielco PolyEco10009.1 Critical
- sielco analog fm transmitter, radio link, analog fm transmitter exc1000gt firmware +14 more +16 moreSielco Radio Link and Analog FM Transmitters Improper Access Control9.8 Critical
- fit2cloud jumpserverjumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values5.3 Medium
- uvdesk community-skeletonUVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks...9.8 Critical
- opnsenseDECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to...9.8 Critical
- etsi tetra standard, midnightblue tetra\ +1 moreIntentionally weakened effective strength in TETRA TEA18.8 High
- nextcloud talk, kiteworks security-advisories +1 morePassword of talk conversations can be bruteforced in Nextcloud4.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreRate limiter not working reliable when Memcached is installed in Nextcloud4.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint5.0 Medium
- huawei emui, harmonyos +1 moreVulnerability of brute-force attacks on the device authentication module.Successful exploitation...7.5 High
- huawei emui, harmonyos +1 moreVulnerability of brute-force attacks on the device authentication module.Successful exploitation...7.5 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +26 more +28 moreWindows IIS Server Elevation of Privilege Vulnerability9.8 Critical
- sick apu0200, apu0200 firmware +1 moreImproper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an...7.5 High
- Show moreLoading…