CWE-307 · Improper Restriction of Excessive Authentication Attempts (page 6)
Page 6 of 7 — CVEs classified under CWE-307, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22553 | High | 8.1 | 2022-01-21 | Dell EMC AppSync versions 3.9 to 4.3 contain an Improper Restriction of Excessive Authentication Attempts Vulnerability that can be exploited from UI and CLI… |
CVE-2021-41807 | High | 7.5 | 2022-01-18 | Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of… |
CVE-2020-21238 | Critical | 9.8 | 2021-12-27 | An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks. |
CVE-2020-21237 | Critical | 9.8 | 2021-12-27 | An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks. |
CVE-2021-36750 | High | 8.1 | 2021-12-22 | ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across US… |
CVE-2021-37934 | Critical | 9.8 | 2021-12-10 | Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthe… |
CVE-2021-42544 | High | 7.5 | 2021-11-30 | Missing Rate Limiting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on the Login Form allows an unauthenti… |
CVE-2021-38890 | High | 7.5 | 2021-11-23 | IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account crede… |
CVE-2021-41435 | Critical | 9.8 | 2021-11-19 | A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U G… |
CVE-2021-44033 | Medium | 6.8 | 2021-11-19 | In Ionic Identity Vault before 5.0.5, the protection mechanism for invalid unlock attempts can be bypassed. |
CVE-2021-33209 | Medium | 5.3 | 2021-11-03 | An issue was discovered in Fimer Aurora Vision before 2.97.10. The response to a failed login attempt discloses whether the username or password is wrong, help… |
CVE-2021-41171 | Medium | 5.9 | 2021-10-22 | eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force… |
CVE-2021-42096 | Medium | 4.3 | 2021-10-21 | GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting… |
CVE-2021-38474 | Medium | 6.3 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the product. This may a… |
CVE-2021-36285 | Medium | 5.7 | 2021-09-28 | Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this… |
CVE-2021-36284 | Medium | 5.7 | 2021-09-28 | Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this… |
CVE-2021-29842 | Medium | 5.3 | 2021-09-16 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference… |
CVE-2021-28911 | Critical | 9.8 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /tmp path which contains some sensitive data (e.g. device serial… |
CVE-2021-28909 | Critical | 9.8 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a brut… |
CVE-2021-38725 | Medium | 5.3 | 2021-09-09 | Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php |
CVE-2021-22003 | High | 7.5 | 2021-08-31 | VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 ma… |
CVE-2021-29987 | Medium | 6.5 | 2021-08-17 | After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still… |
CVE-2020-18698 | Critical | 9.8 | 2021-08-16 | Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in th… |
CVE-2021-20427 | High | 7.5 | 2021-08-11 | IBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 19… |
CVE-2021-38155 | High | 7.5 | 2021-08-06 | OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account… |
CVE-2021-27943 | High | 7.5 | 2021-08-02 | The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-force attack (again… |
CVE-2021-35472 | High | 8.8 | 2021-07-30 | An issue was discovered in LemonLDAP::NG before 2.0.12. Session cache corruption can lead to authorization bypass or spoofing. By running a loop that makes man… |
CVE-2021-3663 | High | 7.5 | 2021-07-25 | firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts |
CVE-2020-23283 | High | 7.5 | 2021-07-21 | Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's database via brute f… |
CVE-2021-32705 | Medium | 5.3 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the pu… |
CVE-2021-32703 | Medium | 5.3 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the sh… |
CVE-2021-32678 | Low | 3.7 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API res… |
CVE-2021-20415 | High | 7.5 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 4.0.0.4 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IB… |
CVE-2021-32522 | Critical | 9.8 | 2021-07-07 | Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discover users’ credent… |
CVE-2021-28127 | High | 7.5 | 2021-07-01 | An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur. |
CVE-2021-22915 | Critical | 9.8 | 2021-06-11 | Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations… |
CVE-2021-33190 | Medium | 5.3 | 2021-06-08 | In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network acces… |
CVE-2021-3412 | High | 7.3 | 2021-06-01 | It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access p… |
CVE-2021-22737 | Critical | 9.8 | 2021-05-26 | Insufficiently Protected Credentials vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cause unauthorized access of whe… |
CVE-2020-26556 | High | 7.5 | 2021-05-24 | Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on an insufficiently… |
CVE-2021-29023 | Medium | 5.3 | 2021-05-17 | InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable. |
CVE-2021-31646 | Critical | 9.8 | 2021-04-26 | Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). The affected component is the file forgot_pwd.php - it uses… |
CVE-2021-29648 | Medium | 5.5 | 2021-03-30 | An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolved_ids and resolved_sizes are intentionally… |
CVE-2021-28248 | High | 7.5 | 2021-03-26 | CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is able to perform an arb… |
CVE-2019-18235 | Critical | 9.8 | 2021-03-17 | Advantech Spectre RT ERT351 Versions 5.1.3 and prior has insufficient login authentication parameters required for the web application may allow an attacker to… |
CVE-2020-4891 | Medium | 5.5 | 2021-03-16 | IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could allow a local user er to brute force R… |
CVE-2021-25676 | High | 7.5 | 2021-03-15 | A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions >= V2.1 and < V2.1.3… |
CVE-2021-25309 | Critical | 9.8 | 2021-03-02 | The telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does not implement any lockout or throttling functionality. This situ… |
CVE-2021-27514 | Critical | 9.8 | 2021-02-22 | EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-force authentication bypass (such as in… |
CVE-2020-35565 | Critical | 9.8 | 2021-02-16 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default. |
CVE-2021-27188 | High | 7.5 | 2021-02-12 | The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service (access suspended for five hours) by making f… |
CVE-2021-20635 | Medium | 6.5 | 2021-02-12 | Improper restriction of excessive authentication attempts in LOGITEC LAN-WH450N/GR allows an attacker in the wireless range of the device to recover PIN and ac… |
CVE-2021-3138 | High | 7.5 | 2021-01-14 | In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms. |
CVE-2021-1311 | Medium | 5.4 | 2021-01-13 | A vulnerability in the reclaim host role feature of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an authenticated, remote attacker to take… |
CVE-2020-35586 | High | 7.5 | 2020-12-23 | In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via the /Config/service/initModel?password= S… |
CVE-2020-35585 | High | 7.5 | 2020-12-23 | In Solstice Pod before 3.3.0 (or Open4.3), the screen key can be enumerated using brute-force attacks via the /lookin/info Solstice Open Control API because th… |
CVE-2020-25196 | Critical | 9.8 | 2020-12-23 | The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to… |
CVE-2020-35590 | Critical | 9.8 | 2020-12-21 | LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Fo… |
CVE-2020-28206 | Medium | 6.5 | 2020-12-02 | An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attem… |
CVE-2020-29136 | Medium | 6.5 | 2020-11-27 | In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575). |
CVE-2020-29042 | Low | 3.7 | 2020-11-26 | An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that… |
CVE-2020-28212 | Critical | 9.8 | 2020-11-19 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all… |
CVE-2020-27423 | High | 7.5 | 2020-11-16 | Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user… |
CVE-2020-27747 | Medium | 6.8 | 2020-10-29 | An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system has assigned himself a PIN code for entering from a mobile de… |
CVE-2020-15906 | Critical | 9.8 | 2020-10-22 | tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts. |
CVE-2020-5141 | Medium | 6.5 | 2020-10-12 | A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service. This vulnerability… |
CVE-2020-8228 | Medium | 5.3 | 2020-10-05 | A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times. |
CVE-2020-25827 | High | 7.5 | 2020-09-27 | An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/clust… |
CVE-2020-15770 | Medium | 5.5 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2018.5. An attacker can potentially make repeated attempts to guess a local user's password, due to lack of lock-o… |
CVE-2020-13312 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a spec… |
CVE-2020-15786 | Critical | 9.8 | 2020-09-09 | A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl… |
CVE-2020-7525 | High | 7.5 | 2020-08-31 | Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk and Wiser for KNX (formerly homeLYnk) whic… |
CVE-2020-12645 | Critical | 9.8 | 2020-08-31 | OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory c… |
CVE-2020-13617 | High | 7.5 | 2020-08-26 | The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker to expose sensitiv… |
CVE-2020-24007 | Critical | 9.8 | 2020-08-26 | Umanni RH 1.0 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authenticati… |
CVE-2020-8202 | Medium | 5.3 | 2020-07-30 | Improper check of inputs in Nextcloud Preferred Providers app v1.6.0 allowed to perform a denial of service attack when using a very long password. |
CVE-2019-20031 | Critical | 9.1 | 2020-07-29 | NEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may permit an infinite number of login attempts in the telephone use… |
CVE-2020-4567 | Critical | 9.8 | 2020-07-29 | IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials… |
CVE-2020-4400 | High | 7.5 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM… |
CVE-2020-14494 | Critical | 9.8 | 2020-07-20 | OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect agains… |
CVE-2020-14484 | Critical | 9.8 | 2020-07-20 | OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute force password attac… |
CVE-2020-10285 | Critical | 9.8 | 2020-07-15 | The authentication implementation on the xArm controller has very low entropy, making it vulnerable to a brute-force attack. There is no mechanism in place to… |
CVE-2020-15367 | Critical | 9.8 | 2020-07-07 | Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-forc… |
CVE-2019-20881 | High | 7.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA. |
CVE-2020-7508 | Critical | 9.8 | 2020-06-16 | A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow a… |
CVE-2020-13872 | High | 8.8 | 2020-06-09 | Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach. |
CVE-2020-13835 | Critical | 9.8 | 2020-06-04 | An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. The Gatekeeper Trustlet allows a brute-force attack on user credentials… |
CVE-2020-13805 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has brute-force attack mishandling because the CAS service lacks a limit on login failu… |
CVE-2020-4193 | Critical | 9.8 | 2020-06-04 | IBM Security Guardium 11.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 17… |
CVE-2020-4232 | High | 7.5 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid login credentials which could be used to a… |
CVE-2020-12752 | High | 7.5 | 2020-05-11 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. Attackers can determine user credentials via a brute-force a… |
CVE-2020-11052 | High | 8.3 | 2020-05-07 | In Sorcery before 0.15.0, there is a brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will preven… |
CVE-2020-8790 | Critical | 9.8 | 2020-05-04 | The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has weak password requirements combined with improper restriction of excess… |
CVE-2020-10876 | High | 7.5 | 2020-05-04 | The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-digit verification cod… |
CVE-2019-17525 | High | 8.8 | 2020-04-21 | The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks. |
CVE-2020-11650 | High | 7.5 | 2020-04-08 | An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication… |
CVE-2020-8827 | High | 7.5 | 2020-04-08 | As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers ca… |
CVE-2020-1616 | Medium | 5.3 | 2020-04-08 | Due to insufficient server-side login attempt limit enforcement, a vulnerability in the SSH login service of Juniper Networks Juniper Advanced Threat Preventio… |
CVE-2019-4393 | Critical | 9.8 | 2020-04-07 | HCL AppScan Standard is vulnerable to excessive authorization attempts |
CVE-2020-6852 | Critical | 9.8 | 2020-04-02 | CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any… |