CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- weblateWeblate lacks rate limiting when verifying second factor4.9 Medium
- autoeastern cyclone matrix trfAutoeastern Smart Keyless Entry System Replay Attack9.4 Critical
- kia aftermarket generic smart keyless entry systemKIA-branded Aftermarket Generic Smart Keyless Entry System Replay Attack9.4 Critical
- vantage6vantage6 lacks brute-force protection on change password functionality1.7 Low
- sick media serverNo protection against brute-force attacks5.3 Medium
- avaya media server, sick baggage analytics, field analytics +3 more +5 moreNo brute-force protection5.3 Medium
- tenda tdsee appTenda TDSEE App Password Reset Confirmation Code ConfirmSmsCode excessive authentication6.3 Medium
- schweitzer engineering laboratories sel-5056 software-defined network flow controllerImproper Restriction of Excessive Authentication Attempts7.5 High
- infiniflow ragflowRAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute...9.1 Critical
- schweitzer engineering laboratories sel blueframe osImproper Restriction of Excessive Authentication Attempts8.1 High
- flytxt neon-dxAn issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1...5.4 Medium
- cisco ios xe software, ios, ios xe +6 more +8 moreA vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco...5.3 Medium
- berabuddies agentflowFlowring Technology Agentflow - Account Lockout Bypass9.8 Critical
- meon kyc solutionsBrute Force Attack Vulnerability in Meon KYC solutions8.2 High
- scriptandtools ecommerce-website-in-phpScriptAndTools eCommerce-website-in-PHP login.php excessive authentication6.3 Medium
- scriptandtools ecommerce-website-in-phpScriptAndTools eCommerce-website-in-PHP login.php excessive authentication6.3 Medium
- access code project code, drupal access code +1 moreAccess code - Moderately critical - Access bypass - SA-CONTRIB-2025-0284.8 Medium
- valmet dnaValmet DNA Lack of protection against brute force attacks7.0 High
- fermax meetmeImproper Restriction of Excessive Authentication Attempts vulnerability in MeetMe products5.3 Medium
- bg-tek coslat hotspotImproper Authentication in BG-TEK's Coslat Hotspot6.5 Medium
- langgenius dify, langgenius/dify +1 moreImproper Restriction of Excessive Authentication Attempts in langgenius/dify7.4 High
- hcl software myxalytics, hcltech dryice myxalytics +1 moreHCL MyXalytics is affected by concurrent login vulnerability2.6 Low
- iitb safeA lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass...9.8 Critical
- ibm concert softwareIBM Concert Software information disclosure7.5 High
- perforce gliffyUsername Enumeration in Gliffy6.9 Medium
- red hat build of keycloak, data grid 8, fuse 7 +13 more +15 moreOrg.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli8.1 High
- excitel broadband private my excitel appExcitel Broadband Private my Excitel App One-Time Password excessive authentication5.1 Medium
- autheliaRegulation applies separately to Username-based logins to Email-based logins in authelia2.3 Low
- rameez iqbal real estate managerWordPress Real Estate Manager plugin <= 7.3 - Captcha Bypass Vulnerability vulnerability5.3 Medium
- easyappointmentsEasy!Appointments Improper Restriction of Excessive Authentication Attempts9.8 Critical
- syliusWithdrawn Advisory: Sylius allows unrestricted brute-force attacks on user accounts7.5 High
- fortinet forticlientemsAn improper restriction of excessive authentication attempts [CWE-307] in FortiClientEMS version...7.7 High
- drupal email tfa, email tfa project tfa +1 moreEmail TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-0018.8 High
- jatosJATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system, where...7.5 High
- trend micro, inc. micro id security, trendmicro id security +1 moreTrend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an...6.5 Medium
- digital operation services wifiburadaImproper Authentication in Digital Operation Services' WiFiBurada4.3 Medium
- dell recoverpoint for virtual machinesDell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of...6.5 Medium
- citeum openctiOpenCTI's lack of Rate Limit lead to OTP brute forcing8.1 High
- No product listedAn issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication...9.8 Critical
- hitachi energy nsd570 teleprotection equipment, hitachienergy nsd570 firmware +1 moreA vulnerability exists in NSD570 login panel that does not restrict excessive authentication...5.3 Medium
- dell wyse management suiteDell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of...7.6 High
- logsign unified secops platform, unified secops +1 moreLogsign Unified SecOps Platform Authentication Bypass Vulnerability8.6 High
- phpipam, phpipam phpipam/phpipam +1 moreImproper Restriction of Excessive Authentication Attempts in phpipam/phpipam5.3 Medium
- baxter life2000 ventilation system, life2000 ventilator firmware +1 moreNo limit on failed login attempts with Clinician Password or Serial Number Clinician Password on Life2000 Ventilator9.3 Critical
- blackberry secusuiteVulnerabilities in SecuSUITE Server Components Impact SecuSUITE4.8 Medium
- digistar ag-30 plusDigistar AG-30 Plus Login Page excessive authentication2.3 Low
- sap netweaver application server java, sap se netweaver application server java (logon application) +1 moreInformation Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Application)5.3 Medium
- 63moons wave 2.0, aero +1 moreBrute Force Attack Vulnerability in Wave 2.09.3 Critical
- digitory multi-channel integrated posA lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS...9.1 Critical
- progress telerik report serverAccount Controller allows high count of login attempts7.5 High
- Show moreLoading…