CWE-307 · Improper Restriction of Excessive Authentication Attempts (page 5)
Page 5 of 7 — CVEs classified under CWE-307, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-36917 | Medium | 5.9 | 2023-07-11 | SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass th… |
CVE-2023-3605 | Medium | 6.5 | 2023-07-10 | A vulnerability was found in PHPGurukul Online Shopping Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2023-35697 | Medium | 5.3 | 2023-07-10 | Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials. |
CVE-2023-33868 | Medium | 5.9 | 2023-07-06 | The number of login attempts is not limited. This could allow an attacker to perform a brute force on HTTP basic authentication. |
CVE-2023-32224 | Critical | 9.8 | 2023-06-28 | D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication Attempts |
CVE-2023-35172 | High | 8.7 | 2023-06-23 | NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 u… |
CVE-2023-32320 | High | 8.7 | 2023-06-22 | Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were exe… |
CVE-2022-32757 | High | 7.5 | 2023-06-15 | IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 uses an inadequate account lockout setting that could allow a remote attacker to brute force account cre… |
CVE-2022-42478 | High | 8.1 | 2023-06-13 | An Improper Restriction of Excessive Authentication Attempts [CWE-307] in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several endpoint… |
CVE-2023-3173 | Critical | 9.8 | 2023-06-09 | Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20. |
CVE-2023-34243 | Medium | 5.8 | 2023-06-08 | TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could d… |
CVE-2023-33754 | Medium | 6.5 | 2023-06-01 | The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery, allowing attackers… |
CVE-2023-23755 | High | 7.5 | 2023-05-30 | An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods. |
CVE-2023-32319 | High | 8.1 | 2023-05-26 | Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to b… |
CVE-2023-32074 | High | 8.0 | 2023-05-25 | user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. It is recommended that the Nextcloud use… |
CVE-2023-2531 | Critical | 9.8 | 2023-05-05 | Improper Restriction of Excessive Authentication Attempts in GitHub repository azuracast/azuracast prior to 0.18.3. |
CVE-2023-28847 | Low | 3.1 | 2023-04-25 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior t… |
CVE-2022-43377 | High | 7.5 | 2023-04-18 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is p… |
CVE-2022-30076 | Medium | 5.3 | 2023-04-16 | ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There i… |
CVE-2022-2525 | Critical | 9.8 | 2023-04-15 | Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20. |
CVE-2023-26756 | High | 7.5 | 2023-04-14 | The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. NOTE: The vendor's position is that this is effectively mitigated by rate limits… |
CVE-2023-27746 | Critical | 9.8 | 2023-04-13 | BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2… |
CVE-2022-43947 | Medium | 5.0 | 2023-04-11 | An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiPr… |
CVE-2023-29005 | High | 7.5 | 2023-04-10 | Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to en… |
CVE-2023-1665 | Critical | 9.8 | 2023-03-27 | Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0. |
CVE-2023-25818 | Medium | 5.3 | 2023-03-27 | Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and th… |
CVE-2022-36413 | Critical | 9.1 | 2023-03-23 | Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications. |
CVE-2023-27100 | Critical | 9.8 | 2023-03-22 | Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 al… |
CVE-2023-25820 | Medium | 4.2 | 2023-03-22 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of t… |
CVE-2023-1539 | Medium | 5.3 | 2023-03-21 | Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2023-26209 | Low | 3.7 | 2023-03-09 | A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows a remote unauthenticated… |
CVE-2023-26208 | Low | 3.7 | 2023-03-09 | A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows a remote unauthenti… |
CVE-2022-29056 | Low | 3.7 | 2023-03-09 | A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before… |
CVE-2023-1101 | High | 8.8 | 2023-03-02 | SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes. |
CVE-2023-26476 | High | 7.5 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResult… |
CVE-2023-24080 | Critical | 9.8 | 2023-02-21 | A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to compromise user accounts via a bruteforce… |
CVE-2023-0860 | High | 7.5 | 2023-02-16 | Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4. |
CVE-2023-25156 | High | 7.5 | 2023-02-15 | Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks ag… |
CVE-2022-34389 | Low | 3.7 | 2023-02-11 | Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentially exploit this vul… |
CVE-2023-0574 | Medium | 6.8 | 2023-02-09 | Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentic… |
CVE-2022-32515 | High | 8.6 | 2023-01-30 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account w… |
CVE-2023-24020 | High | 7.5 | 2023-01-30 | Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a login. |
CVE-2023-22960 | High | 7.5 | 2023-01-23 | Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. |
CVE-2021-27782 | Medium | 5.4 | 2023-01-20 | HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts. |
CVE-2022-38491 | High | 8.2 | 2023-01-10 | An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-force attacks. Versi… |
CVE-2022-4797 | Medium | 4.3 | 2022-12-28 | Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-26964 | High | 7.4 | 2022-12-26 | Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-force attack. An err… |
CVE-2022-45893 | High | 8.8 | 2022-12-25 | Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the O… |
CVE-2022-30305 | Low | 3.7 | 2022-12-06 | An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4… |
CVE-2022-23746 | High | 7.5 | 2022-11-30 | The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password… |
CVE-2022-2650 | Critical | 9.8 | 2022-11-24 | Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2. |
CVE-2022-37772 | High | 7.5 | 2022-11-23 | Maarch RM 2.8.3 solution contains an improper restriction of excessive authentication attempts due to excessive verbose responses from the application. An unau… |
CVE-2022-2166 | Critical | 9.8 | 2022-11-16 | Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0. |
CVE-2022-4006 | Low | 3.7 | 2022-11-15 | A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/fra… |
CVE-2022-40903 | Medium | 6.5 | 2022-11-14 | Aiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access attempts, which allows an attacker to gai… |
CVE-2022-3993 | Critical | 9.4 | 2022-11-14 | Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3. |
CVE-2022-3945 | Medium | 5.3 | 2022-11-11 | Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3. |
CVE-2022-27516 | Medium | 5.3 | 2022-11-08 | User login brute force protection functionality bypass |
CVE-2022-44023 | Medium | 5.3 | 2022-10-30 | PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts. |
CVE-2022-44022 | Medium | 5.3 | 2022-10-30 | PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts. |
CVE-2022-3741 | Critical | 9.8 | 2022-10-28 | Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources… |
CVE-2022-39314 | Low | 3.7 | 2022-10-24 | Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excess… |
CVE-2022-35846 | High | 8.1 | 2022-10-18 | An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0… |
CVE-2022-40055 | Critical | 9.8 | 2022-10-17 | An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page. |
CVE-2022-3031 | Low | 3.7 | 2022-10-17 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15… |
CVE-2022-31228 | High | 8.1 | 2022-10-12 | Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability… |
CVE-2022-33106 | Critical | 9.8 | 2022-10-12 | WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account… |
CVE-2022-36781 | Medium | 5.3 | 2022-09-28 | ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiti… |
CVE-2022-33735 | Medium | 6.5 | 2022-09-20 | There is a password verification vulnerability in WS7200-10 11.0.2.13. Attackers on the LAN may use brute force cracking to obtain passwords, which may cause s… |
CVE-2022-37145 | High | 7.5 | 2022-09-08 | The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication pr… |
CVE-2022-37144 | High | 8.8 | 2022-09-08 | The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of… |
CVE-2022-2822 | High | 7.5 | 2022-08-15 | An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user an… |
CVE-2022-35932 | Low | 3.5 | 2022-08-12 | Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are suscepti… |
CVE-2022-2457 | Critical | 9.8 | 2022-08-10 | A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the applicat… |
CVE-2022-35490 | Critical | 9.8 | 2022-08-08 | Zammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force attacks trying to guess login credentials. After a configurable… |
CVE-2022-31118 | Medium | 6.5 | 2022-08-04 | Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and p… |
CVE-2022-35925 | Medium | 5.3 | 2022-08-02 | BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force at… |
CVE-2021-22640 | High | 7.5 | 2022-07-28 | An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks. |
CVE-2022-31234 | High | 8.1 | 2022-07-21 | Dell EMC PowerStore, contain(s) an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStore Manager GUI. A remote unauthenticated… |
CVE-2022-24689 | Medium | 5.3 | 2022-07-18 | An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information page… |
CVE-2022-22452 | High | 7.5 | 2022-07-14 | IBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM… |
CVE-2022-2321 | Critical | 9.8 | 2022-07-05 | Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks. |
CVE-2022-22496 | Medium | 6.5 | 2022-06-30 | While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSECURITY=TRANSITIONA… |
CVE-2022-22487 | Critical | 9.8 | 2022-06-30 | An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agen… |
CVE-2022-22485 | Critical | 9.8 | 2022-06-17 | In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's inval… |
CVE-2022-31273 | Critical | 9.8 | 2022-06-14 | An issue in TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp allows attackers to perform a brute-force attack via a crafted session_id cookie. |
CVE-2022-28386 | Medium | 4.6 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. The security feature for lockout (e.g., requiring a reformat of the drive after 20 faile… |
CVE-2022-28384 | Medium | 5.5 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they allow an offline brute-force attack for determining the… |
CVE-2022-30235 | High | 8.6 | 2022-06-02 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attacker uses brute forc… |
CVE-2022-29084 | High | 8.1 | 2022-06-02 | Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication attempts in Unisphere GUI. A remote unauthe… |
CVE-2013-10004 | Medium | 6.5 | 2022-05-24 | A vulnerability classified as critical was found in Telecommunication Software SAMwin Contact Center Suite 5.1. This vulnerability affects the function passwor… |
CVE-2022-24044 | High | 7.5 | 2022-05-20 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2022-26519 | Medium | 5.5 | 2022-04-20 | There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Version 3002-19 interface, which allows loca… |
CVE-2022-22561 | High | 8.1 | 2022-04-12 | Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contain an improper restriction of excessive authentication attempts. An unauthenticated remote attacker could p… |
CVE-2021-43958 | Critical | 9.8 | 2022-03-16 | Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not ch… |
CVE-2022-25820 | Medium | 4.2 | 2022-03-10 | A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perform brute force attack on screen lock pa… |
CVE-2022-26314 | Critical | 9.8 | 2022-03-08 | A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix… |
CVE-2022-22810 | Critical | 9.8 | 2022-02-09 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to manipulate the admin after numerous a… |
CVE-2021-22818 | High | 7.5 | 2022-01-28 | A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to the chargi… |
CVE-2021-43298 | Critical | 9.8 | 2022-01-25 | The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that a… |