CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- shilpi computers client dashboardUser Enumeration vulnerability9.3 Critical
- kaitenA vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code...9.8 Critical
- apex softcell ld geo, apexsoftcell ld dp back office +1 moreUser Enumeration vulnerability9.3 Critical
- yordam library automation systemUser Enumeration in Yordam Information Technology's Yordam Library Automation System6.9 Medium
- hitachi id bravura security fabricAn issue was discovered in Bravura Security Fabric versions 12.3.x before 12.3.5.32784, 12.4.x...9.1 Critical
- reedos aim-star, reedos software solutions mutual fund distribution product (aim-star) +1 moreUser Enumeration vulnerability9.3 Critical
- fortinet fortisoarAn improper authorization vulnerability [CWE-285] in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0...7.1 High
- qnap qts, quts hero, qnap systems inc. qutscloud +2 moreQTS, QuTS hero2.6 Low
- windmill-labs windmillWindmill HTTP Request users.rs excessive authentication6.3 Medium
- identityautomation rapididentity, rapididentity lts, rapididentity cloud +2 moreRapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive...5.9 Medium
- redhat keycloak, red hat build of keycloak, build of keycloak 22 +11 more +13 moreKeycloak: potential bypass of brute force protection6.5 Medium
- opentext netiq advance authentication, microfocus netiq advanced authentication +1 moreImproper account management vulnerability in NetIQ Advance Authentication8.2 High
- upkeeper managerLack of resources and rate limiting - login9.5 Critical
- upkeeper managerLack of resources and rate limiting - two factor authentication9.0 Critical
- pluck-cms pluckPluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute...9.8 Critical
- adobe commerce, magento +1 moreOTP 2FA can be bruteforced7.4 High
- siemens sinec traffic analyzerA vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions ...8.7 High
- siemens location intelligence family, location intelligence +1 moreA vulnerability has been identified in Location Intelligence family (All versions < V4.4)....6.9 Medium
- gl-inet a1300 firmware, ap1300 firmware, ar300m16 firmware +25 more +27 moreGL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000...9.8 Critical
- horizoncloud catereaseAn issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly...6.8 Medium
- microsoft groupmeGroupMe Elevation of Privilege Vulnerability8.1 High
- neutrinolabs xrdpxrdp allows an ininite number of login attempts7.2 High
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1)....8.7 High
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1)....8.7 High
- ibm storage defender - resiliency service, storage defender +1 moreIBM Storage Defender information disclosure6.5 Medium
- mia technology inc. mia-med health aplicationUser Enumeration in Mia Technology's Mia-Med Health Aplication7.5 High
- hitachi energy foxman-un, unem +1 moreA vulnerability exists in the FOXMAN-UN/UNEM server / APIGateway that if exploited allows a...6.5 Medium
- contact form builder project form builder, wpdevart contact form builder, contact widget +1 moreWordPress Contact Form Builder, Contact Widget plugin <= 2.1.7 - Bypass Vulnerability vulnerability5.3 Medium
- checkmkMissing brute-force protection for two factor authentication5.9 Medium
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 moreJSON Injection in mintplex-labs/anything-llm5.3 Medium
- webfactory captcha codeWordPress Captcha Code plugin <= 2.9 - Captcha Bypass vulnerability5.3 Medium
- codepeople contact form emailWordPress Contact Form Email plugin <= 1.3.41 - Captcha Bypass vulnerability5.3 Medium
- 10web form maker, 10web form builder team form maker by 10web +1 moreWordPress Form Maker by 10Web plugin <= 1.15.20 - Captcha Bypass Vulnerability vulnerability5.3 Medium
- nitin rathod wp forms puzzle captchaWordPress WP Forms Puzzle Captcha plugin <= 4.1 - Captcha Bypass vulnerability5.3 Medium
- forge12 interactive gmbh captcha/honeypot for contact form 7WordPress Captcha for Contact Form 7 plugin <= 1.11.3 - Capcha Bypass vulnerability5.3 Medium
- devnath verma wp captchaWordPress WP Captcha plugin <= 2.0.0 - Captcha Bypass vulnerability5.3 Medium
- john darrel hide my wp ghostWordPress Hide My WP Ghost – Security Plugin plugin <= 5.0.25 - Captcha Bypass vulnerability5.3 Medium
- brainstorm force spectraWordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Captcha Bypass Vulnerability5.3 Medium
silverstripe/frameworkPackagistSilverstripe Brute force bypass on default admin9.1 Critical- metagauss profilegridWordPress ProfileGrid plugin <= 5.8.2 - Group Members Limit Bypass vulnerability4.3 Medium
- codepeople appointment hour bookingWordPress Appointment Hour Booking plugin <= 1.4.56 - Captcha Bypass vulnerability5.3 Medium
ezsystems/ezplatform-userPackagisteZ Platform Admin UI Password reset vulnerabilityNo scoreezsystems/ezplatform-admin-uiPackagisteZ Platform Password reset vulnerabilityNo score- kiowareKioWare for Windows (versions all through 8.35) allows to brute force the PIN number, which...6.2 Medium
- zitadelZITADEL's Improper Lockout Mechanism Leads to MFA Bypass6.5 Medium
- loginpress proWordPress LoginPress Pro plugin < 3.0.0 - Captcha Bypass vulnerability5.3 Medium
- checkmkBrute-force protection ineffective for some login methods5.9 Medium
- juniper junos os evolvedJunos OS Evolved: Connection limits is not being enforced while the resp. rate limit is being enforced6.9 Medium
- codelyfe stupid simple cmscodelyfe Stupid Simple CMS Login Page excessive authentication3.7 Low
- argoproj argo cd, argo-cd +1 moreArgo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow7.5 High
- Show moreLoading…