CWE-307 in Authentication
- CVEs
- 695
- Exploited
- 0
- Public check
- 2
- Likely
- 6
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2019-4336IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-… | IBM · Robotic Process Automation with Automation Anywhere | Possible | 7.5 | 2.0% | 2019-07-01 |
| CVE-2020-15367Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication att… | Venki · Supravizio Bpm | Possible | – | 2.0% | 2020-07-07 |
| CVE-2023-21709Microsoft Exchange Server Elevation of Privilege Vulnerability | Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23 | Possible | 9.8 | 2.0% | 2023-08-08 |
| CVE-2019-16670An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. The Authentication mecha… | Weidmueller · Ie-Sw-Pl09m-5gc-4gt Firmware | Possible | 9.8 | 2.0% | 2019-12-06 |
| CVE-2013-2228SaltStack RSA Key Generation allows remote users to decrypt communications | SaltStack · SaltStack | Possible | – | 2.0% | 2019-12-03 |
| CVE-2013-2257Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force Weakness | Cryptocat · Cryptocat | Possible | – | 2.0% | 2019-11-04 |
| CVE-2019-3766Dell EMC ECS versions prior to 3.4.0.0 contain an improper restriction of excessive authentication attempts vulnerability. An unauthenticated remote attacker may potentially perfo… | Dell · Elastic Cloud Storage | Possible | 8.1 | 1.9% | 2019-09-27 |
| CVE-2021-41171Bypass bruteforce protection on login form in elabftw | elabftw · elabftw | Possible | 5.9 | 1.9% | 2021-10-22 |
| CVE-2017-15887An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server before 6.0.7-0085 allows remote attackers to obtain user crede… | Synology · Synology CardDAV Server | Possible | – | 1.9% | 2017-11-07 |
| CVE-2001-0395Lightwave ConsoleServer 3200 does not disconnect users after unsuccessful login attempts, which could allow remote attackers to conduct brute force password guessing. | Lightwavemo · Consoleserver 3200 Firmware | Possible | – | 1.9% | 2001-05-24 |
| CVE-2021-27188The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service (access suspended for five hours) by making five invalid login at… | Xn--B1agzlht · Fx Aggregator Terminal Client | Possible | – | 1.8% | 2021-02-12 |
| CVE-2020-25196MOXA NPort IAW5000A-I/O Series | MOXA · NPort IAW5000A-I/O | Possible | 9.8 | 1.8% | 2020-12-23 |
| CVE-2023-26208A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows a remote unauthenticated attacker to par… | Fortinet · FortiAuthenticator | Possible | 3.5 | 1.8% | 2023-03-09 |
| CVE-2022-29056A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before 6.0.9 allows a remo… | Fortinet · FortiMail | Possible | 3.5 | 1.8% | 2023-03-09 |
| CVE-2021-35472An issue was discovered in LemonLDAP::NG before 2.0.12. Session cache corruption can lead to authorization bypass or spoofing. By running a loop that makes many authentication att… | Lemonldap-Ng · Lemonldap::ng | Possible | – | 1.8% | 2021-07-27 |
| CVE-2023-27746BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2 handshake is interce… | Blackvue · Dr750-2ch Lte Firmware | Possible | 9.8 | 1.8% | 2023-04-13 |
| CVE-2023-26209A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows a remote unauthenticated attacker to partiall… | Fortinet · FortiDeceptor | Possible | 3.5 | 1.7% | 2023-03-09 |
| CVE-2018-15759On Demand Services SDK Timing Attack Vulnerability | Pivotal · On Demand Services SDK | Possible | 9.1 | 1.7% | 2018-11-19 |
| CVE-2021-22915Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentia… | Nextcloud · Nextcloud Server | Possible | – | 1.7% | 2021-06-11 |
| CVE-2019-14951The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process… | Telenav · Scout Gps Link | Possible | – | 1.7% | 2019-08-12 |
| CVE-2018-19548index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm[username] and LoginForm[password] parameters, which might make it easier for remot… | Rudrasoftech · Edusec | Possible | – | 1.7% | 2018-11-26 |
| CVE-2020-25827An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via Cent… | Mediawiki · Mediawiki | Possible | – | 1.7% | 2020-09-27 |
| CVE-2020-8790The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has weak password requirements combined with improper restriction of excessive authentication a… | Oklok Project · Oklok | Possible | – | 1.7% | 2020-05-04 |
| CVE-2021-28911BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /tmp path which contains some sensitive data (e.g. device serial number). Having thos… | Bab-Technologie · Eibport Firmware | Possible | – | 1.7% | 2021-09-09 |
| CVE-2017-7673Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection. | Apache Software Foundation · Apache OpenMeetings | Possible | – | 1.6% | 2017-07-14 |
| CVE-2020-24007Umanni RH 1.0 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against th… | Umanni · Human Resources | Possible | – | 1.6% | 2020-08-26 |
| CVE-2020-4400IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 179478. | IBM · Verify Gateway (IVG) | Possible | 7.5 | 1.6% | 2020-07-22 |
| CVE-2014-2875The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitrary sessions via a br… | Keplerproject · Cgilua | Possible | – | 1.6% | 2020-02-06 |
| CVE-2022-3993Improper Restriction of Excessive Authentication Attempts in kareadita/kavita | kareadita · kareadita/kavita | Possible | 9.4 | 1.6% | 2022-11-14 |
| CVE-2017-1197IBM BigFix Compliance (TEMA SUAv1 SCA SCM) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 123672. | IBM · BigFix Compliance Analytics | Possible | – | 1.6% | 2017-06-15 |
| CVE-2020-11052Improper Restriction of Excessive Authentication Attempts in Sorcery | Sorcery · Sorcery | Possible | 8.3 | 1.6% | 2020-05-07 |
| CVE-2024-5716Logsign Unified SecOps Platform Authentication Bypass Vulnerability | Logsign · Unified SecOps Platform | Possible | 8.6 | 1.6% | 2024-11-22 |
| CVE-2022-2321Improper Restriction of Excessive Authentication Attempts in heroiclabs/nakama | heroiclabs · heroiclabs/nakama | Possible | 7.5 | 1.6% | 2022-07-05 |
| CVE-2021-38890IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force… | IBM · Connect:Direct Web Services | Possible | 5.9 | 1.6% | 2021-11-23 |
| CVE-1999-1152Compaq/Microcom 6000 Access Integrator does not disconnect a client after a certain number of failed login attempts, which allows remote attackers to guess usernames or passwords… | Compaq · Microcom 6000 Firmware | Possible | – | 1.6% | 2001-09-12 |
| CVE-2021-37934Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthenticated, remote use… | Huntflow · Huntflow Enterprise | Possible | – | 1.6% | 2021-12-10 |
| CVE-2020-13805An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has brute-force attack mishandling because the CAS service lacks a limit on login failures. | Foxitsoftware · Phantompdf | Possible | – | 1.6% | 2020-06-04 |
| CVE-2019-18235Advantech Spectre RT ERT351 Versions 5.1.3 and prior has insufficient login authentication parameters required for the web application may allow an attacker to gain full access us… | Advantech · Advantech Spectre RT ERT351 Versions 5.1.3 and prior | Possible | – | 1.5% | 2021-03-17 |
| CVE-2017-7915An Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Ve… | Moxa · Moxa OnCell | Possible | – | 1.5% | 2017-05-29 |
| CVE-2018-16703A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help an attacker to perf… | Gleeztech · Gleez Cms | Possible | – | 1.5% | 2018-09-07 |
| CVE-2019-13918A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no means to prevent password guessing attacks. The vulnerabili… | Siemens AG · SINEMA Remote Connect Server | Possible | – | 1.5% | 2019-09-13 |
| CVE-2022-22487An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking th… | IBM · Spectrum Protect Server | Possible | 5.9 | 1.5% | 2022-06-30 |
| CVE-2022-26314A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix 7 compatible) (All… | Siemens · Mendix Forgot Password Appstore module | Possible | – | 1.5% | 2022-03-08 |
| CVE-2020-7525Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk and Wiser for KNX (formerly homeLYnk) which could allow an att… | Schneider-Electric · All hardware versions of spaceLYnk and Wiser for KNX (formerly homeLYnk) | Possible | – | 1.5% | 2020-08-31 |
| CVE-2019-4068IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the system. IBM X-Force ID: 157013. | IBM · Intelligent Operations Center | Possible | 5.9 | 1.5% | 2019-06-07 |
| CVE-2020-15786A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (Al… | Siemens · SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) | Possible | 9.8 | 1.5% | 2020-09-09 |
| CVE-2019-18917A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout. | Hp · HP ENVY 5000 All-in-One Printer series (M2U85A - M2U85B, M2U91A - M2U94B, Z4A54… | Possible | – | 1.5% | 2020-03-16 |
| CVE-2020-7508A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to gain f… | Schneider-Electric · Easergy T300 (Firmware version 1.5.2 and older) | Possible | – | 1.5% | 2020-06-16 |
| CVE-2018-12649An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP… | Misp-Project · Misp | Possible | – | 1.5% | 2018-06-22 |
| CVE-2021-43958Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were be… | Atlassian · Fisheye | Possible | 9.8 | 1.5% | 2022-03-16 |
Data as of 2026-11-15.