CWE-307 Improper Restriction of Excessive Authentication Attempts
baseThe product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (826)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-17240US | critical9.8 | Exploit | ||
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers. | ||||
| CVE-2020-15906US | critical9.8 | Exploit | ||
tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts. | ||||
| CVE-2016-9361US | critical9.8 | Exploit | ||
An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions… | ||||
| CVE-2003-1096US | high10.0 | Exploit | ||
The Cisco LEAP challenge/response authentication mechanism uses passwords in a way that is susceptible to dictionary attacks, which makes it easier for remote attackers to gain pri… | ||||
| CVE-2023-27100US | critical9.8 | Exploit | ||
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to byp… | ||||
| CVE-2001-1291US | critical9.8 | Exploit | ||
The telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect remote attackers who provide an incorrect username or password, which makes it easier to… | ||||
| CVE-2001-1339US | critical9.8 | Exploit | ||
Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users from the service when bad passwords are entered, which makes it easier for remote attackers to conduct brut… | ||||
| CVE-2022-30600US | critical9.8 | Exploit | ||
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. | ||||
| CVE-2020-35590US | critical9.8 | Exploit | ||
LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header ca… | ||||
| CVE-2005-4145US | medium6.5 | Exploit | ||
The MSDE version of Lyris ListManager 5.0 through 8.9b configures the sa account in the database to use a password with a small search space ("lyris" and up to 5 digits, possibly f… | ||||
| CVE-2026-44596US | critical9.8 | Exploit | ||
Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandl… | ||||
| CVE-2023-27746US | critical9.8 | Exploit | ||
BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2 handshake is intercep… | ||||
| CVE-2023-22960US | high7.5 | Exploit | ||
Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. | ||||
| CVE-2020-15367US | critical9.8 | Exploit | ||
Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication atta… | ||||
| CVE-2026-43914US | critical9.8 | Exploit | ||
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protecti… | ||||
| CVE-2023-49792US | critical9.8 | Exploit | ||
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server… | ||||
| CVE-2023-37635US | critical9.8 | Exploit | ||
UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application. | ||||
| CVE-2023-1665US | critical9.8 | Exploit | ||
Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0. | ||||
| CVE-2021-36750US | high8.1 | Exploit | ||
ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under m… | ||||
| CVE-2019-17525US | high8.8 | Exploit | ||
The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks. | ||||
03
Angriffsmuster (7)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan