CWE-799: Insufficient anti-automation
The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
Also known as Improper Control of Interaction Frequency, Brute force.
A kind of CWE-691 Insufficient Control Flow Management.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedHarness Login Endpoint login excessive authentication6.3 Medium
- ethyca fidesFides Webserver API Rate Limiting Vulnerability in Proxied Environments6.3 Medium
- mtons mblogmtons mblog password excessive authentication6.3 Medium
- mtons mblogmtons mblog Verification Code send_code excessive authentication6.3 Medium
- macrozheng mallmacrozheng mall Admin Login excessive authentication6.3 Medium
- mercusys mw301rMercusys MW301R Login excessive authentication2.3 Low
- meshtastic firmwareTraceroute_APP responses are not rate-limited.2.7 Low
- gotson komgaKomga Vulnerable to Arbitrary Code Execution via Crafted EPUB File4.2 Medium
- mbuesch letmeinLetmein connection limiter allows an arbitrary amount of simultaneous connections1.7 Low
- tenda tdsee appTenda TDSEE App Password Reset Confirmation Code ConfirmSmsCode excessive authentication6.3 Medium
- schweitzer engineering laboratories sel-5056 software-defined network flow controllerImproper Control of Interaction Frequency4.3 Medium
- scriptandtools ecommerce-website-in-phpScriptAndTools eCommerce-website-in-PHP login.php excessive authentication6.3 Medium
- scriptandtools ecommerce-website-in-phpScriptAndTools eCommerce-website-in-PHP login.php excessive authentication6.3 Medium
- shopwareShopware's default newsletter opt-in settings allow for mass sign-up abuse6.9 Medium
- rising technosoft cap back office applicationNo Rate Limiting Vulnerability in CAP back office application8.2 High
- excitel broadband private my excitel appExcitel Broadband Private my Excitel App One-Time Password excessive authentication5.1 Medium
- rupeeseed technology ventures rupeewebNo Rate Limiting Vulnerability in RupeeWeb trading platform5.1 Medium
- mayswind ezbookkeepingMissing rate limit in MaysWind ezBookkeeping6.3 Medium
- digital operation services wifiburadaProtection Mechanism Failure in Digital Operation Services' WiFiBurada6.5 Medium
- digistar ag-30 plusDigistar AG-30 Plus Login Page excessive authentication2.3 Low
- 63moons wave 2.0, aero +1 moreNo Rate Limiting Vulnerability in Wave 2.07.1 High
- syracom secure loginThe Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows...5.9 Medium
- shilpi computers client dashboardNo Rate Limiting vulnerability7.1 High
- clibo manager manager, clibomanager clibo manager +1 moreRate limit vulnerability in Clibo Manager5.8 Medium
- reedos aim-star, reedos software solutions mutual fund distribution product (aim-star) +1 moreNo Rate Limiting Vulnerability8.7 High
- drupal open socialOpen Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-0385.3 Medium
- journyx, journyx (jtime) +1 moreJournyx Unauthenticated Password Reset Bruteforce8.8 High
- westermo l210-f2g lynx, l210-f2g firmware +1 moreWestermo L210-F2G Lynx Improper Control of Interaction Frequency8.7 High
- westermo l210-f2g lynx, l210-f2g lynx firmware +1 moreWestermo L210-F2G Lynx Improper Control of Interaction Frequency8.7 High
- nvidia vgpu software and cloud gamingCVE5.5 Medium
- metagauss registrationmagicWordPress RegistrationMagic plugin <= 5.2.5.0 - Form Submission Limit Bypass vulnerability5.3 Medium
- cartpauj register captchaWordPress Cartpauj Register Captcha plugin <= 1.0.02 - Captcha Bypass vulnerability6.5 Medium
- lester ‘gamerz’ chan wp-postratingsWordPress WP-PostRatings plugin <= 1.91 - Rating limit Bypass vulnerability5.3 Medium
- codepeople cp polls, polls cp +1 moreWordPress Polls CP plugin <= 1.0.71 - Polls Limitation Bypass vulnerability5.3 Medium
- sakuraisayeki wows-karmaWOWS Karma vulnerable to a post submission bounce/timing attack6.3 Medium
- ibm aspera faspexIBM Aspera Faspex denial of service6.5 Medium
- microsoft dynamics 365, dynamics 365 for finance and operations +1 moreMicrosoft Dynamics 365 Finance and Operations Denial of Service Vulnerability7.5 High
- jetbrains youtrackIn JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms6.5 Medium
- contec conprosys hmi systemContec CONPROSYS HMI System (CHS) v3.5.2 Denial of Service3.7 Low
- asus gt-axe11000, rt-ax3000, rt-ax55 +7 more +9 moreASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication3.7 Low
- nextcloud server, kiteworks security-advisories +1 moreRate-limits not working on instances without configured memory cache backend8.1 High
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An...4.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreLack of ratelimit on public share link mount endpoint5.3 Medium
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreLack of ratelimit on public DAV endpoint5.3 Medium
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreLack of ratelimit on shareinfo endpoint5.3 Medium
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreRatelimit not applied on OCS API responses3.7 Low
- koelImproper rate limiting in Koel7.5 High
- sonicwall sonicos, sonicosv +1 moreA vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist...6.5 Medium
- mattermost serverMattermost Server does not enforce rate limits on password change attempts7.5 High
- apache syncopeImproper Control of Interaction Frequency in Apache syncope-core5.4 Medium
- Show moreLoading…