CWE-307 · Improper Restriction of Excessive Authentication Attempts (page 7)
Page 7 of 7 — CVEs classified under CWE-307, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-10849 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos7885, Exynos8895, and Exynos9810 chipsets) software. The Gatekeeper t… |
CVE-2019-18917 | Medium | 6.5 | 2020-03-16 | A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout. |
CVE-2019-14299 | Critical | 9.8 | 2020-03-13 | Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did not implement account lockout. Therefore… |
CVE-2019-13166 | High | 7.5 | 2020-03-13 | Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement account lockout. Local account credentials may be extracted from the device via… |
CVE-2017-16900 | Medium | 5.5 | 2020-02-27 | Incorrect Access Control in Hunesion i-oneNet 3.0.6042.1200 allows the local user to access other user's information which is unauthorized via brute force. |
CVE-2009-5140 | High | 8.8 | 2020-02-12 | The SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a response to an invalid authentication challenge, which makes it ea… |
CVE-2014-2875 | Medium | 6.1 | 2020-02-06 | The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitra… |
CVE-2013-1895 | High | 7.5 | 2020-01-28 | The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple auth… |
CVE-2013-4441 | Critical | 9.8 | 2020-01-27 | The Phonemes mode in Pwgen 2.06 generates predictable passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force… |
CVE-2020-7995 | Critical | 9.8 | 2020-01-26 | The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts. |
CVE-2020-7057 | Medium | 5.3 | 2020-01-14 | Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depe… |
CVE-2019-15577 | Medium | 4.3 | 2019-12-18 | An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups bro… |
CVE-2019-18261 | Critical | 9.8 | 2019-12-16 | In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implement sufficient meas… |
CVE-2019-16670 | Critical | 9.8 | 2019-12-06 | An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. The… |
CVE-2013-2228 | High | 8.1 | 2019-12-03 | SaltStack RSA Key Generation allows remote users to decrypt communications |
CVE-2019-5309 | Medium | 4.6 | 2019-11-29 | Honor play smartphones with versions earlier than 9.1.0.333(C00E333R1P1T8) have an information disclosure vulnerability in certain Huawei . An attacker could v… |
CVE-2019-5263 | Medium | 5.5 | 2019-11-29 | HiSuite with 9.1.0.305 and earlier versions and 9.1.0.305(MAC) and earlier versions and HwBackup with earlier versions before 9.1.1.308 have a brute forcing en… |
CVE-2019-18986 | High | 7.5 | 2019-11-15 | Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for in… |
CVE-2019-18985 | Critical | 9.8 | 2019-11-15 | Pimcore before 6.2.2 lacks brute force protection for the 2FA token. |
CVE-2013-2257 | High | 7.5 | 2019-11-04 | Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force Weakness |
CVE-2019-12941 | Critical | 9.8 | 2019-10-14 | AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi network… |
CVE-2019-17240 | Critical | 9.8 | 2019-10-06 | bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Cl… |
CVE-2019-17215 | Critical | 9.8 | 2019-10-06 | An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no bruteforce protection (e.g., lockout) establishe… |
CVE-2019-4520 | High | 7.5 | 2019-10-02 | IBM Security Directory Server 6.4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-For… |
CVE-2019-3766 | Critical | 9.8 | 2019-09-27 | Dell EMC ECS versions prior to 3.4.0.0 contain an improper restriction of excessive authentication attempts vulnerability. An unauthenticated remote attacker m… |
CVE-2019-3746 | High | 8.8 | 2019-09-27 | Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote… |
CVE-2019-13918 | Critical | 9.8 | 2019-09-13 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no means to prevent password guessing atta… |
CVE-2019-5035 | Critical | 9.0 | 2019-08-20 | An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of special… |
CVE-2019-4310 | High | 7.5 | 2019-08-20 | IBM Security Guardium Big Data Intelligence 4.0 (SonarG) uses an inadequate account lockout setting that could allow a remote attacker to brute force account c… |
CVE-2019-14951 | High | 7.5 | 2019-08-12 | The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the au… |
CVE-2019-14351 | High | 8.8 | 2019-07-28 | EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time us… |
CVE-2019-1126 | Medium | 5.3 | 2019-07-15 | A security feature bypass vulnerability exists in Active Directory Federation Services (ADFS) which could allow an attacker to bypass the extranet lockout poli… |
CVE-2019-4336 | Critical | 9.8 | 2019-07-01 | IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account… |
CVE-2019-4068 | High | 7.5 | 2019-06-07 | IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the system. IBM X-Force… |
CVE-2019-5217 | Medium | 4.6 | 2019-06-04 | There is an information disclosure vulnerability on Mate 9 Pro Huawei smartphones versions earlier than LON-AL00B9.0.1.150 (C00E61R1P8T8). An attacker could vi… |
CVE-2019-0039 | High | 8.1 | 2019-04-10 | If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an at… |
CVE-2019-5421 | Critical | 9.8 | 2019-04-03 | Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specif… |
CVE-2018-19879 | High | 7.1 | 2019-03-28 | An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX (e.g., RUT950) R_31.04.89 before R_00.05.00.5 devices. The authentication functionality is not pro… |
CVE-2019-6524 | Critical | 9.8 | 2019-03-05 | Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to discover passwords via… |
CVE-2018-19021 | Medium | 6.5 | 2019-01-25 | A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6… |
CVE-2018-19548 | Critical | 9.8 | 2018-11-26 | index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm[username] and LoginForm[password] parameters, which might make… |
CVE-2018-15759 | Critical | 9.1 | 2018-11-19 | Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthenticated malicious us… |
CVE-2018-14657 | High | 8.1 | 2018-11-13 | A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce it… |
CVE-2018-11082 | Medium | 6.6 | 2018-10-05 | Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthen… |
CVE-2018-16703 | Medium | 5.3 | 2018-09-07 | A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help… |
CVE-2018-12993 | Critical | 9.8 | 2018-06-29 | onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms_username and onefilecms_password fields. |
CVE-2018-12649 | Critical | 9.8 | 2018-06-22 | An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method ins… |
CVE-2018-1475 | Critical | 9.8 | 2018-04-27 | IBM BigFix Platform 9.2 and 9.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force I… |
CVE-2018-5469 | Critical | 9.8 | 2018-03-06 | An Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOP… |
CVE-2018-1373 | High | 7.5 | 2018-03-02 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account c… |
CVE-2017-12316 | High | 7.5 | 2017-11-16 | A vulnerability in the Guest Portal login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform multiple logi… |
CVE-2017-15887 | Critical | 9.8 | 2017-11-07 | An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server before 6.0.7-0085 allows remote attackers… |
CVE-2017-14423 | High | 7.5 | 2017-09-13 | htdocs/parentalcontrols/bind.php on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices does not prevent unauthenticated nonce-guessin… |
CVE-2017-7673 | Critical | 9.8 | 2017-07-17 | Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing br… |
CVE-2017-10604 | Medium | 5.3 | 2017-07-17 | When the device is configured to perform account lockout with a defined period of time, any unauthenticated user attempting to log in as root with an incorrect… |
CVE-2017-11187 | Critical | 9.8 | 2017-07-12 | phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly. |
CVE-2017-7898 | Critical | 9.8 | 2017-06-30 | An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic contr… |
CVE-2017-1197 | Critical | 9.8 | 2017-06-15 | IBM BigFix Compliance (TEMA SUAv1 SCA SCM) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IB… |
CVE-2017-7915 | Critical | 9.8 | 2017-05-29 | An Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, O… |
CVE-2016-9124 | Critical | 9.8 | 2017-03-28 | Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to passwor… |
CVE-2016-9366 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-9361 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2014-5414 | Critical | 9.1 | 2016-10-05 | Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components do not restrict the number of authentication attempt… |
CVE-2002-0628 | High | 7.5 | 2003-01-07 | The Telnet service for Polycom ViewStation before 7.2.4 does not restrict the number of failed login attempts, which makes it easier for remote attackers to gu… |
CVE-2001-1291 | Critical | 9.8 | 2001-07-12 | The telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect remote attackers who provide an incorrect username or password, whi… |
CVE-2001-0395 | Critical | 9.8 | 2001-07-02 | Lightwave ConsoleServer 3200 does not disconnect users after unsuccessful login attempts, which could allow remote attackers to conduct brute force password gu… |
CVE-2001-1339 | Critical | 9.8 | 2001-05-24 | Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users from the service when bad passwords are entered, which makes it easier for remote atta… |
CVE-1999-1324 | Critical | 9.8 | 1999-12-31 | VAXstations running Open VMS 5.3 through 5.5-2 with VMS DECwindows or MOTIF do not properly disable access to user accounts that exceed the break-in limit thre… |
CVE-1999-1152 | High | 7.5 | 1998-06-03 | Compaq/Microcom 6000 Access Integrator does not disconnect a client after a certain number of failed login attempts, which allows remote attackers to guess use… |