CWE-307 · Improper Restriction of Excessive Authentication Attempts (page 6)
Page 6 of 7 — CVEs classified under CWE-307, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25309 | Critical | 9.8 | 2021-03-02 | The telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does not implement any lockout or throttling functionality. This situ… |
CVE-2021-27514 | Critical | 9.8 | 2021-02-22 | EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-force authentication bypass (such as in… |
CVE-2020-35565 | Critical | 9.8 | 2021-02-16 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default. |
CVE-2021-27188 | High | 7.5 | 2021-02-12 | The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service (access suspended for five hours) by making f… |
CVE-2021-20635 | Medium | 6.5 | 2021-02-12 | Improper restriction of excessive authentication attempts in LOGITEC LAN-WH450N/GR allows an attacker in the wireless range of the device to recover PIN and ac… |
CVE-2021-3138 | High | 7.5 | 2021-01-14 | In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms. |
CVE-2021-1311 | Medium | 5.4 | 2021-01-13 | A vulnerability in the reclaim host role feature of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an authenticated, remote attacker to take… |
CVE-2020-35586 | High | 7.5 | 2020-12-23 | In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via the /Config/service/initModel?password= S… |
CVE-2020-35585 | High | 7.5 | 2020-12-23 | In Solstice Pod before 3.3.0 (or Open4.3), the screen key can be enumerated using brute-force attacks via the /lookin/info Solstice Open Control API because th… |
CVE-2020-25196 | Critical | 9.8 | 2020-12-23 | The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to… |
CVE-2020-35590 | Critical | 9.8 | 2020-12-21 | LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Fo… |
CVE-2020-28206 | Medium | 6.5 | 2020-12-02 | An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attem… |
CVE-2020-29136 | Medium | 6.5 | 2020-11-27 | In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575). |
CVE-2020-29042 | Low | 3.7 | 2020-11-26 | An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that… |
CVE-2020-28212 | Critical | 9.8 | 2020-11-19 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all… |
CVE-2020-27423 | High | 7.5 | 2020-11-16 | Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user… |
CVE-2020-27747 | Medium | 6.8 | 2020-10-29 | An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system has assigned himself a PIN code for entering from a mobile de… |
CVE-2020-15906 | Critical | 9.8 | 2020-10-22 | tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts. |
CVE-2020-5141 | Medium | 6.5 | 2020-10-12 | A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service. This vulnerability… |
CVE-2020-8228 | Medium | 5.3 | 2020-10-05 | A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times. |
CVE-2020-25827 | High | 7.5 | 2020-09-27 | An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/clust… |
CVE-2020-15770 | Medium | 5.5 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2018.5. An attacker can potentially make repeated attempts to guess a local user's password, due to lack of lock-o… |
CVE-2020-13312 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a spec… |
CVE-2020-15786 | Critical | 9.8 | 2020-09-09 | A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl… |
CVE-2020-7525 | High | 7.5 | 2020-08-31 | Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk and Wiser for KNX (formerly homeLYnk) whic… |
CVE-2020-12645 | Critical | 9.8 | 2020-08-31 | OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory c… |
CVE-2020-13617 | High | 7.5 | 2020-08-26 | The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker to expose sensitiv… |
CVE-2020-24007 | Critical | 9.8 | 2020-08-26 | Umanni RH 1.0 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authenticati… |
CVE-2020-8202 | Medium | 5.3 | 2020-07-30 | Improper check of inputs in Nextcloud Preferred Providers app v1.6.0 allowed to perform a denial of service attack when using a very long password. |
CVE-2019-20031 | Critical | 9.1 | 2020-07-29 | NEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may permit an infinite number of login attempts in the telephone use… |
CVE-2020-4567 | Critical | 9.8 | 2020-07-29 | IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials… |
CVE-2020-4400 | High | 7.5 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM… |
CVE-2020-14494 | Critical | 9.8 | 2020-07-20 | OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect agains… |
CVE-2020-14484 | Critical | 9.8 | 2020-07-20 | OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute force password attac… |
CVE-2020-10285 | Critical | 9.8 | 2020-07-15 | The authentication implementation on the xArm controller has very low entropy, making it vulnerable to a brute-force attack. There is no mechanism in place to… |
CVE-2020-15367 | Critical | 9.8 | 2020-07-07 | Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-forc… |
CVE-2019-20881 | High | 7.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA. |
CVE-2020-7508 | Critical | 9.8 | 2020-06-16 | A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow a… |
CVE-2020-13872 | High | 8.8 | 2020-06-09 | Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach. |
CVE-2020-13835 | Critical | 9.8 | 2020-06-04 | An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. The Gatekeeper Trustlet allows a brute-force attack on user credentials… |
CVE-2020-13805 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has brute-force attack mishandling because the CAS service lacks a limit on login failu… |
CVE-2020-4193 | Critical | 9.8 | 2020-06-04 | IBM Security Guardium 11.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 17… |
CVE-2020-4232 | High | 7.5 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid login credentials which could be used to a… |
CVE-2020-12752 | High | 7.5 | 2020-05-11 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. Attackers can determine user credentials via a brute-force a… |
CVE-2020-11052 | High | 8.3 | 2020-05-07 | In Sorcery before 0.15.0, there is a brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will preven… |
CVE-2020-8790 | Critical | 9.8 | 2020-05-04 | The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has weak password requirements combined with improper restriction of excess… |
CVE-2020-10876 | High | 7.5 | 2020-05-04 | The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-digit verification cod… |
CVE-2019-17525 | High | 8.8 | 2020-04-21 | The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks. |
CVE-2020-11650 | High | 7.5 | 2020-04-08 | An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication… |
CVE-2020-8827 | High | 7.5 | 2020-04-08 | As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers ca… |
CVE-2020-1616 | Medium | 5.3 | 2020-04-08 | Due to insufficient server-side login attempt limit enforcement, a vulnerability in the SSH login service of Juniper Networks Juniper Advanced Threat Preventio… |
CVE-2019-4393 | Critical | 9.8 | 2020-04-07 | HCL AppScan Standard is vulnerable to excessive authorization attempts |
CVE-2020-6852 | Critical | 9.8 | 2020-04-02 | CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any… |
CVE-2020-10849 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos7885, Exynos8895, and Exynos9810 chipsets) software. The Gatekeeper t… |
CVE-2019-18917 | Medium | 6.5 | 2020-03-16 | A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout. |
CVE-2019-14299 | Critical | 9.8 | 2020-03-13 | Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did not implement account lockout. Therefore… |
CVE-2019-13166 | High | 7.5 | 2020-03-13 | Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement account lockout. Local account credentials may be extracted from the device via… |
CVE-2017-16900 | Medium | 5.5 | 2020-02-27 | Incorrect Access Control in Hunesion i-oneNet 3.0.6042.1200 allows the local user to access other user's information which is unauthorized via brute force. |
CVE-2009-5140 | High | 8.8 | 2020-02-12 | The SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a response to an invalid authentication challenge, which makes it ea… |
CVE-2014-2875 | Medium | 6.1 | 2020-02-06 | The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitra… |
CVE-2013-1895 | High | 7.5 | 2020-01-28 | The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple auth… |
CVE-2013-4441 | Critical | 9.8 | 2020-01-27 | The Phonemes mode in Pwgen 2.06 generates predictable passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force… |
CVE-2020-7995 | Critical | 9.8 | 2020-01-26 | The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts. |
CVE-2020-7057 | Medium | 5.3 | 2020-01-14 | Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depe… |
CVE-2019-15577 | Medium | 4.3 | 2019-12-18 | An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups bro… |
CVE-2019-18261 | Critical | 9.8 | 2019-12-16 | In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implement sufficient meas… |
CVE-2019-16670 | Critical | 9.8 | 2019-12-06 | An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. The… |
CVE-2013-2228 | High | 8.1 | 2019-12-03 | SaltStack RSA Key Generation allows remote users to decrypt communications |
CVE-2019-5309 | Medium | 4.6 | 2019-11-29 | Honor play smartphones with versions earlier than 9.1.0.333(C00E333R1P1T8) have an information disclosure vulnerability in certain Huawei . An attacker could v… |
CVE-2019-5263 | Medium | 5.5 | 2019-11-29 | HiSuite with 9.1.0.305 and earlier versions and 9.1.0.305(MAC) and earlier versions and HwBackup with earlier versions before 9.1.1.308 have a brute forcing en… |
CVE-2019-18986 | High | 7.5 | 2019-11-15 | Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for in… |
CVE-2019-18985 | Critical | 9.8 | 2019-11-15 | Pimcore before 6.2.2 lacks brute force protection for the 2FA token. |
CVE-2013-2257 | High | 7.5 | 2019-11-04 | Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force Weakness |
CVE-2019-12941 | Critical | 9.8 | 2019-10-14 | AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi network… |
CVE-2019-17240 | Critical | 9.8 | 2019-10-06 | bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Cl… |
CVE-2019-17215 | Critical | 9.8 | 2019-10-06 | An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no bruteforce protection (e.g., lockout) establishe… |
CVE-2019-4520 | High | 7.5 | 2019-10-02 | IBM Security Directory Server 6.4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-For… |
CVE-2019-3766 | Critical | 9.8 | 2019-09-27 | Dell EMC ECS versions prior to 3.4.0.0 contain an improper restriction of excessive authentication attempts vulnerability. An unauthenticated remote attacker m… |
CVE-2019-3746 | High | 8.8 | 2019-09-27 | Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote… |
CVE-2019-13918 | Critical | 9.8 | 2019-09-13 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no means to prevent password guessing atta… |
CVE-2019-5035 | Critical | 9.0 | 2019-08-20 | An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of special… |
CVE-2019-4310 | High | 7.5 | 2019-08-20 | IBM Security Guardium Big Data Intelligence 4.0 (SonarG) uses an inadequate account lockout setting that could allow a remote attacker to brute force account c… |
CVE-2019-14951 | High | 7.5 | 2019-08-12 | The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the au… |
CVE-2019-14351 | High | 8.8 | 2019-07-28 | EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time us… |
CVE-2019-1126 | Medium | 5.3 | 2019-07-15 | A security feature bypass vulnerability exists in Active Directory Federation Services (ADFS) which could allow an attacker to bypass the extranet lockout poli… |
CVE-2019-4336 | Critical | 9.8 | 2019-07-01 | IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account… |
CVE-2019-4068 | High | 7.5 | 2019-06-07 | IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the system. IBM X-Force… |
CVE-2019-5217 | Medium | 4.6 | 2019-06-04 | There is an information disclosure vulnerability on Mate 9 Pro Huawei smartphones versions earlier than LON-AL00B9.0.1.150 (C00E61R1P8T8). An attacker could vi… |
CVE-2019-0039 | High | 8.1 | 2019-04-10 | If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an at… |
CVE-2019-5421 | Critical | 9.8 | 2019-04-03 | Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specif… |
CVE-2018-19879 | High | 7.1 | 2019-03-28 | An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX (e.g., RUT950) R_31.04.89 before R_00.05.00.5 devices. The authentication functionality is not pro… |
CVE-2019-6524 | Critical | 9.8 | 2019-03-05 | Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to discover passwords via… |
CVE-2018-19021 | Medium | 6.5 | 2019-01-25 | A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6… |
CVE-2018-19548 | Critical | 9.8 | 2018-11-26 | index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm[username] and LoginForm[password] parameters, which might make… |
CVE-2018-15759 | Critical | 9.1 | 2018-11-19 | Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious us… |
CVE-2018-14657 | High | 8.1 | 2018-11-13 | A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce it… |
CVE-2018-11082 | Medium | 6.6 | 2018-10-05 | Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthen… |
CVE-2018-16703 | Medium | 5.3 | 2018-09-07 | A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help… |
CVE-2018-12993 | Critical | 9.8 | 2018-06-29 | onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms_username and onefilecms_password fields. |
CVE-2018-12649 | Critical | 9.8 | 2018-06-22 | An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method ins… |