CWE-307 · Improper Restriction of Excessive Authentication Attempts (page 5)
Page 5 of 7 — CVEs classified under CWE-307, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45893 | High | 8.8 | 2022-12-25 | Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the O… |
CVE-2022-30305 | Low | 3.7 | 2022-12-06 | An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4… |
CVE-2022-23746 | High | 7.5 | 2022-11-30 | The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password… |
CVE-2022-2650 | Critical | 9.8 | 2022-11-24 | Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2. |
CVE-2022-37772 | High | 7.5 | 2022-11-23 | Maarch RM 2.8.3 solution contains an improper restriction of excessive authentication attempts due to excessive verbose responses from the application. An unau… |
CVE-2022-2166 | Critical | 9.8 | 2022-11-16 | Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0. |
CVE-2022-4006 | Low | 3.7 | 2022-11-15 | A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/fra… |
CVE-2022-40903 | Medium | 6.5 | 2022-11-14 | Aiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access attempts, which allows an attacker to gai… |
CVE-2022-3993 | Critical | 9.4 | 2022-11-14 | Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3. |
CVE-2022-3945 | Medium | 5.3 | 2022-11-11 | Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3. |
CVE-2022-27516 | Medium | 5.3 | 2022-11-08 | User login brute force protection functionality bypass |
CVE-2022-44023 | Medium | 5.3 | 2022-10-30 | PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts. |
CVE-2022-44022 | Medium | 5.3 | 2022-10-30 | PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts. |
CVE-2022-3741 | Critical | 9.8 | 2022-10-28 | Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources… |
CVE-2022-39314 | Low | 3.7 | 2022-10-24 | Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excess… |
CVE-2022-35846 | High | 8.1 | 2022-10-18 | An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0… |
CVE-2022-40055 | Critical | 9.8 | 2022-10-17 | An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page. |
CVE-2022-3031 | Low | 3.7 | 2022-10-17 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15… |
CVE-2022-31228 | High | 8.1 | 2022-10-12 | Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability… |
CVE-2022-33106 | Critical | 9.8 | 2022-10-12 | WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account… |
CVE-2022-36781 | Medium | 5.3 | 2022-09-28 | ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiti… |
CVE-2022-33735 | Medium | 6.5 | 2022-09-20 | There is a password verification vulnerability in WS7200-10 11.0.2.13. Attackers on the LAN may use brute force cracking to obtain passwords, which may cause s… |
CVE-2022-37145 | High | 7.5 | 2022-09-08 | The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication pr… |
CVE-2022-37144 | High | 8.8 | 2022-09-08 | The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of… |
CVE-2022-2822 | High | 7.5 | 2022-08-15 | An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user an… |
CVE-2022-35932 | Low | 3.5 | 2022-08-12 | Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are suscepti… |
CVE-2022-2457 | Critical | 9.8 | 2022-08-10 | A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the applicat… |
CVE-2022-35490 | Critical | 9.8 | 2022-08-08 | Zammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force attacks trying to guess login credentials. After a configurable… |
CVE-2022-31118 | Medium | 6.5 | 2022-08-04 | Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and p… |
CVE-2022-35925 | Medium | 5.3 | 2022-08-02 | BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force at… |
CVE-2021-22640 | High | 7.5 | 2022-07-28 | An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks. |
CVE-2022-31234 | High | 8.1 | 2022-07-21 | Dell EMC PowerStore, contain(s) an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStore Manager GUI. A remote unauthenticated… |
CVE-2022-24689 | Medium | 5.3 | 2022-07-18 | An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information page… |
CVE-2022-22452 | High | 7.5 | 2022-07-14 | IBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM… |
CVE-2022-2321 | Critical | 9.8 | 2022-07-05 | Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks. |
CVE-2022-22496 | Medium | 6.5 | 2022-06-30 | While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSECURITY=TRANSITIONA… |
CVE-2022-22487 | Critical | 9.8 | 2022-06-30 | An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agen… |
CVE-2022-22485 | Critical | 9.8 | 2022-06-17 | In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's inval… |
CVE-2022-31273 | Critical | 9.8 | 2022-06-14 | An issue in TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp allows attackers to perform a brute-force attack via a crafted session_id cookie. |
CVE-2022-28386 | Medium | 4.6 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. The security feature for lockout (e.g., requiring a reformat of the drive after 20 faile… |
CVE-2022-28384 | Medium | 5.5 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they allow an offline brute-force attack for determining the… |
CVE-2022-30235 | High | 8.6 | 2022-06-02 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attacker uses brute forc… |
CVE-2022-29084 | High | 8.1 | 2022-06-02 | Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication attempts in Unisphere GUI. A remote unauthe… |
CVE-2013-10004 | Medium | 6.5 | 2022-05-24 | A vulnerability classified as critical was found in Telecommunication Software SAMwin Contact Center Suite 5.1. This vulnerability affects the function passwor… |
CVE-2022-24044 | High | 7.5 | 2022-05-20 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2022-26519 | Medium | 5.5 | 2022-04-20 | There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Version 3002-19 interface, which allows loca… |
CVE-2022-22561 | High | 8.1 | 2022-04-12 | Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contain an improper restriction of excessive authentication attempts. An unauthenticated remote attacker could p… |
CVE-2021-43958 | Critical | 9.8 | 2022-03-16 | Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not ch… |
CVE-2022-25820 | Medium | 4.2 | 2022-03-10 | A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perform brute force attack on screen lock pa… |
CVE-2022-26314 | Critical | 9.8 | 2022-03-08 | A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix… |
CVE-2022-22810 | Critical | 9.8 | 2022-02-09 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to manipulate the admin after numerous a… |
CVE-2021-22818 | High | 7.5 | 2022-01-28 | A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to the chargi… |
CVE-2021-43298 | Critical | 9.8 | 2022-01-25 | The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that a… |
CVE-2022-22553 | High | 8.1 | 2022-01-21 | Dell EMC AppSync versions 3.9 to 4.3 contain an Improper Restriction of Excessive Authentication Attempts Vulnerability that can be exploited from UI and CLI… |
CVE-2021-41807 | High | 7.5 | 2022-01-18 | Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of… |
CVE-2020-21238 | Critical | 9.8 | 2021-12-27 | An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks. |
CVE-2020-21237 | Critical | 9.8 | 2021-12-27 | An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks. |
CVE-2021-36750 | High | 8.1 | 2021-12-22 | ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across US… |
CVE-2021-37934 | Critical | 9.8 | 2021-12-10 | Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthe… |
CVE-2021-42544 | High | 7.5 | 2021-11-30 | Missing Rate Limiting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on the Login Form allows an unauthenti… |
CVE-2021-38890 | High | 7.5 | 2021-11-23 | IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account crede… |
CVE-2021-41435 | Critical | 9.8 | 2021-11-19 | A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U G… |
CVE-2021-44033 | Medium | 6.8 | 2021-11-19 | In Ionic Identity Vault before 5.0.5, the protection mechanism for invalid unlock attempts can be bypassed. |
CVE-2021-33209 | Medium | 5.3 | 2021-11-03 | An issue was discovered in Fimer Aurora Vision before 2.97.10. The response to a failed login attempt discloses whether the username or password is wrong, help… |
CVE-2021-41171 | Medium | 5.9 | 2021-10-22 | eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force… |
CVE-2021-42096 | Medium | 4.3 | 2021-10-21 | GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting… |
CVE-2021-38474 | Medium | 6.3 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the product. This may a… |
CVE-2021-36285 | Medium | 5.7 | 2021-09-28 | Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this… |
CVE-2021-36284 | Medium | 5.7 | 2021-09-28 | Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this… |
CVE-2021-29842 | Medium | 5.3 | 2021-09-16 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference… |
CVE-2021-28911 | Critical | 9.8 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /tmp path which contains some sensitive data (e.g. device serial… |
CVE-2021-28909 | Critical | 9.8 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a brut… |
CVE-2021-38725 | Medium | 5.3 | 2021-09-09 | Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php |
CVE-2021-22003 | High | 7.5 | 2021-08-31 | VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 ma… |
CVE-2021-29987 | Medium | 6.5 | 2021-08-17 | After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still… |
CVE-2020-18698 | Critical | 9.8 | 2021-08-16 | Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in th… |
CVE-2021-20427 | High | 7.5 | 2021-08-11 | IBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 19… |
CVE-2021-38155 | High | 7.5 | 2021-08-06 | OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account… |
CVE-2021-27943 | High | 7.5 | 2021-08-02 | The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-force attack (again… |
CVE-2021-35472 | High | 8.8 | 2021-07-30 | An issue was discovered in LemonLDAP::NG before 2.0.12. Session cache corruption can lead to authorization bypass or spoofing. By running a loop that makes man… |
CVE-2021-3663 | High | 7.5 | 2021-07-25 | firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts |
CVE-2020-23283 | High | 7.5 | 2021-07-21 | Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's database via brute f… |
CVE-2021-32705 | Medium | 5.3 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the pu… |
CVE-2021-32703 | Medium | 5.3 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the sh… |
CVE-2021-32678 | Low | 3.7 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API res… |
CVE-2021-20415 | High | 7.5 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 4.0.0.4 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IB… |
CVE-2021-32522 | Critical | 9.8 | 2021-07-07 | Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discover users’ credent… |
CVE-2021-28127 | High | 7.5 | 2021-07-01 | An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur. |
CVE-2021-22915 | Critical | 9.8 | 2021-06-11 | Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations… |
CVE-2021-33190 | Medium | 5.3 | 2021-06-08 | In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network acces… |
CVE-2021-3412 | High | 7.3 | 2021-06-01 | It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access p… |
CVE-2021-22737 | Critical | 9.8 | 2021-05-26 | Insufficiently Protected Credentials vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cause unauthorized access of whe… |
CVE-2020-26556 | High | 7.5 | 2021-05-24 | Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on an insufficiently… |
CVE-2021-29023 | Medium | 5.3 | 2021-05-17 | InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable. |
CVE-2021-31646 | Critical | 9.8 | 2021-04-26 | Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). The affected component is the file forgot_pwd.php - it uses… |
CVE-2021-29648 | Medium | 5.5 | 2021-03-30 | An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolved_ids and resolved_sizes are intentionally… |
CVE-2021-28248 | High | 7.5 | 2021-03-26 | CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is able to perform an arb… |
CVE-2019-18235 | Critical | 9.8 | 2021-03-17 | Advantech Spectre RT ERT351 Versions 5.1.3 and prior has insufficient login authentication parameters required for the web application may allow an attacker to… |
CVE-2020-4891 | Medium | 5.5 | 2021-03-16 | IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could allow a local user er to brute force R… |
CVE-2021-25676 | High | 7.5 | 2021-03-15 | A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions >= V2.1 and < V2.1.3… |