CWE-307 · Improper Restriction of Excessive Authentication Attempts (page 4)
Page 4 of 7 — CVEs classified under CWE-307, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-45190 | Medium | 5.1 | 2024-02-09 | IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. Thi… |
CVE-2023-38273 | High | 7.5 | 2024-02-02 | IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credent… |
CVE-2023-50326 | High | 7.5 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID… |
CVE-2023-33759 | Critical | 9.8 | 2024-01-25 | SpliceCom Maximiser Soft PBX v1.5 and before does not restrict excessive authentication attempts, allowing attackers to bypass authentication via a brute force… |
CVE-2022-45790 | High | 8.6 | 2024-01-22 | The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow a… |
CVE-2024-22317 | Critical | 9.1 | 2024-01-18 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to obtain sensitive information or cause a d… |
CVE-2023-50123 | High | 8.1 | 2024-01-11 | The number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state is not limited. This could allow an attacker to perform a brut… |
CVE-2023-49810 | High | 7.3 | 2024-01-10 | A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafte… |
CVE-2023-49792 | Medium | 5.3 | 2023-12-22 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcl… |
CVE-2023-6912 | High | 7.5 | 2023-12-20 | Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially comprom… |
CVE-2023-27172 | Critical | 9.1 | 2023-12-20 | Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows attackers to easily obtain the secret key used to sign JWT tokens via… |
CVE-2023-6928 | Critical | 9.8 | 2023-12-19 | EuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full c… |
CVE-2023-6272 | Critical | 9.8 | 2023-12-18 | The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, w… |
CVE-2023-50444 | High | 7.5 | 2023-12-13 | By default, .ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualif… |
CVE-2023-6756 | Medium | 5.3 | 2023-12-13 | A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login of the component C… |
CVE-2023-49278 | Medium | 5.3 | 2023-12-12 | Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a brute force exploit can b… |
CVE-2023-49443 | Critical | 9.8 | 2023-12-08 | DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords. This vulnerability allows attackers to gain access to… |
CVE-2023-35039 | Critical | 9.8 | 2023-12-07 | Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Au… |
CVE-2023-24051 | Critical | 9.8 | 2023-12-04 | A client side rate limit issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via brute force style attacks. |
CVE-2023-48028 | Critical | 9.8 | 2023-11-18 | kodbox 1.46.01 has a security flaw that enables user enumeration. This problem is present on the login page, where an attacker can identify valid users based o… |
CVE-2023-46745 | Medium | 5.3 | 2023-11-17 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In a… |
CVE-2023-45582 | Medium | 5.6 | 2023-11-14 | An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and… |
CVE-2023-42480 | Medium | 5.3 | 2023-11-14 | The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids… |
CVE-2023-41270 | Low | 3.5 | 2023-11-08 | Improper Restriction of Excessive Authentication Attempts vulnerability in Samsung Smart TV UE40D7000 version T-GAPDEUC-1033.2 and before allows attackers to c… |
CVE-2023-2675 | Critical | 9.8 | 2023-11-07 | Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 2023.Q1.1223. |
CVE-2023-4625 | Medium | 5.3 | 2023-11-06 | Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server funct… |
CVE-2023-41350 | High | 7.5 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote atta… |
CVE-2023-37832 | High | 7.5 | 2023-10-31 | A lack of rate limiting in Elenos ETG150 FM transmitter v3.12 allows attackers to obtain user credentials via brute force and cause other unspecified impacts. |
CVE-2015-20110 | High | 7.5 | 2023-10-31 | JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is dif… |
CVE-2023-5754 | Critical | 9.1 | 2023-10-26 | Sielco PolyEco1000 uses a weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of th… |
CVE-2023-42769 | Critical | 9.8 | 2023-10-26 | The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass auth… |
CVE-2023-46123 | Medium | 5.3 | 2023-10-25 | jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the… |
CVE-2023-37635 | Critical | 9.8 | 2023-10-23 | UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application. |
CVE-2023-27152 | Critical | 9.8 | 2023-10-23 | DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication. |
CVE-2022-24402 | High | 8.8 | 2023-10-19 | The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystr… |
CVE-2023-45149 | Medium | 4.3 | 2023-10-16 | Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be byp… |
CVE-2023-45148 | Medium | 4.3 | 2023-10-16 | Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset unexpected… |
CVE-2023-39960 | Medium | 5.0 | 2023-10-13 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as… |
CVE-2023-44111 | High | 7.5 | 2023-10-11 | Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44096 | High | 7.5 | 2023-10-11 | Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-36434 | Critical | 9.8 | 2023-10-10 | Windows IIS Server Elevation of Privilege Vulnerability |
CVE-2023-43699 | High | 7.5 | 2023-10-09 | Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker to guess the password via trial-and-err… |
CVE-2023-42818 | Medium | 5.4 | 2023-09-27 | JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding… |
CVE-2023-40834 | Critical | 9.8 | 2023-09-12 | OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to g… |
CVE-2023-26271 | Medium | 5.3 | 2023-08-28 | IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) uses an inadequate account lockout setting that could allow a remote atta… |
CVE-2022-43904 | High | 7.5 | 2023-08-28 | IBM Security Guardium 11.3 and 11.4 could disclose sensitive information to an attacker due to improper restriction of excessive authentication attempts. IBM… |
CVE-2023-40706 | High | 8.6 | 2023-08-24 | There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brute-force attack on t… |
CVE-2023-39958 | Medium | 5.8 | 2023-08-10 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24… |
CVE-2023-21709 | Critical | 9.8 | 2023-08-08 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
CVE-2023-3669 | Low | 3.3 | 2023-08-03 | A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password w… |
CVE-2023-3548 | High | 8.3 | 2023-07-25 | An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack. |
CVE-2023-32657 | Medium | 5.3 | 2023-07-19 | Weintek Weincloud v0.13.6 could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error messag… |
CVE-2023-29301 | High | 7.5 | 2023-07-12 | Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Restriction of Excessive Au… |
CVE-2023-36917 | Medium | 5.9 | 2023-07-11 | SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass th… |
CVE-2023-3605 | Medium | 6.5 | 2023-07-10 | A vulnerability was found in PHPGurukul Online Shopping Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2023-35697 | Medium | 5.3 | 2023-07-10 | Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials. |
CVE-2023-33868 | Medium | 5.9 | 2023-07-06 | The number of login attempts is not limited. This could allow an attacker to perform a brute force on HTTP basic authentication. |
CVE-2023-32224 | Critical | 9.8 | 2023-06-28 | D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts |
CVE-2023-35172 | High | 8.7 | 2023-06-23 | NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 u… |
CVE-2023-32320 | High | 8.7 | 2023-06-22 | Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were exe… |
CVE-2022-32757 | High | 7.5 | 2023-06-15 | IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 uses an inadequate account lockout setting that could allow a remote attacker to brute force account cre… |
CVE-2022-42478 | High | 8.1 | 2023-06-13 | An Improper Restriction of Excessive Authentication Attempts [CWE-307] in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several endpoint… |
CVE-2023-3173 | Critical | 9.8 | 2023-06-09 | Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20. |
CVE-2023-34243 | Medium | 5.8 | 2023-06-08 | TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could d… |
CVE-2023-33754 | Medium | 6.5 | 2023-06-01 | The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery, allowing attackers… |
CVE-2023-23755 | High | 7.5 | 2023-05-30 | An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods. |
CVE-2023-32319 | High | 8.1 | 2023-05-26 | Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to b… |
CVE-2023-32074 | High | 8.0 | 2023-05-25 | user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. It is recommended that the Nextcloud use… |
CVE-2023-2531 | Critical | 9.8 | 2023-05-05 | Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3. |
CVE-2023-28847 | Low | 3.1 | 2023-04-25 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior t… |
CVE-2022-43377 | High | 7.5 | 2023-04-18 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is p… |
CVE-2022-30076 | Medium | 5.3 | 2023-04-16 | ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There i… |
CVE-2022-2525 | Critical | 9.8 | 2023-04-15 | Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20. |
CVE-2023-26756 | High | 7.5 | 2023-04-14 | The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. NOTE: The vendor's position is that this is effectively mitigated by rate limits… |
CVE-2023-27746 | Critical | 9.8 | 2023-04-13 | BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2… |
CVE-2022-43947 | Medium | 5.0 | 2023-04-11 | An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiPr… |
CVE-2023-29005 | High | 7.5 | 2023-04-10 | Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to en… |
CVE-2023-1665 | Critical | 9.8 | 2023-03-27 | Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0. |
CVE-2023-25818 | Medium | 5.3 | 2023-03-27 | Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and th… |
CVE-2022-36413 | Critical | 9.1 | 2023-03-23 | Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications. |
CVE-2023-27100 | Critical | 9.8 | 2023-03-22 | Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 al… |
CVE-2023-25820 | Medium | 4.2 | 2023-03-22 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of t… |
CVE-2023-1539 | Medium | 5.3 | 2023-03-21 | Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2023-26209 | Low | 3.7 | 2023-03-09 | A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows a remote unauthenticated… |
CVE-2023-26208 | Low | 3.7 | 2023-03-09 | A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows a remote unauthenti… |
CVE-2022-29056 | Low | 3.7 | 2023-03-09 | A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before… |
CVE-2023-1101 | High | 8.8 | 2023-03-02 | SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes. |
CVE-2023-26476 | High | 7.5 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResult… |
CVE-2023-24080 | Critical | 9.8 | 2023-02-21 | A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to compromise user accounts via a bruteforce… |
CVE-2023-0860 | High | 7.5 | 2023-02-16 | Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4. |
CVE-2023-25156 | High | 7.5 | 2023-02-15 | Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks ag… |
CVE-2022-34389 | Low | 3.7 | 2023-02-11 | Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentially exploit this vul… |
CVE-2023-0574 | Medium | 6.8 | 2023-02-09 | Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentic… |
CVE-2022-32515 | High | 8.6 | 2023-01-30 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account w… |
CVE-2023-24020 | High | 7.5 | 2023-01-30 | Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login. |
CVE-2023-22960 | High | 7.5 | 2023-01-23 | Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. |
CVE-2021-27782 | Medium | 5.4 | 2023-01-20 | HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts. |
CVE-2022-38491 | High | 8.2 | 2023-01-10 | An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-force attacks. Versi… |
CVE-2022-4797 | Medium | 4.3 | 2022-12-28 | Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-26964 | High | 7.4 | 2022-12-26 | Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-force attack. An err… |