CWE-307
700 CVEs • Abstraction: Base
Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
CVEs (700)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a specific parameter. |
1Siemens 4Simatic Hmi Basic Panels 2nd Generation Firmware Simatic Hmi Comfort Panels FirmwareSimatic Hmi Mobile Panels Firmware+1 moreJun 17, 2026 Sep 9, 2020 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions <= V16), SIMATIC HMI Mobile Pa...Show more |
1Schneider Electric 2Spacelynk Firmware Wiser For Knx FirmwareJun 17, 2026 Aug 31, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk and Wiser for KNX (formerly homeLYnk) which could allow an attacker to guess a password when brute forc...Show more |
1Open Xchange 1Open Xchange Appsuite Jun 17, 2026 Aug 31, 2020 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption. |
1Mitel 116863 Firmware 6865 Firmware6867 Firmware+8 moreJun 17, 2026 Aug 26, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker to expose sensitive information due to improper memory handling during failed l...Show more |
Umanni RH 1.0 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page. |
1Nextcloud 1Preferred Providers Jun 17, 2026 Jul 30, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Improper check of inputs in Nextcloud Preferred Providers app v1.6.0 allowed to perform a denial of service attack when using a very long password. |
1Nec 2Um4730 Firmware Um8000 FirmwareJun 17, 2026 Jul 29, 2020 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 NEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may permit an infinite number of login attempts in the telephone user interface (TUI), effectively allowing brute force attacks. |
1Ibm 1Security Key Lifecycle Manager Jun 17, 2026 Jul 29, 2020 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 184156. |
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 179478. |
1Openclinic Ga Project 1Openclinic Ga Jun 17, 2026 Jul 20, 2020 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect against brute force attacks, which may allow unauthorized users to...Show more |
1Openclinic Ga Project 1Openclinic Ga Jun 17, 2026 Jul 20, 2020 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute force password attacks. |
1Ufactory 1Xarm 5 Lite Firmware Jun 17, 2026 Jul 15, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The authentication implementation on the xArm controller has very low entropy, making it vulnerable to a brute-force attack. There is no mechanism in place to mitigate or lockout automated attempts to gain access. |
Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page. |
An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA. |
1Schneider Electric 1Easergy T300 Firmware Jun 17, 2026 Jun 16, 2020 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to gain full access by brute force. |
Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach. |
An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. The Gatekeeper Trustlet allows a brute-force attack on user credentials. The Samsung ID is SVE-2020-16908 (June 2020). |
1Foxitsoftware 2Phantompdf ReaderJun 17, 2026 Jun 4, 2020 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has brute-force attack mishandling because the CAS service lacks a limit on login failures. |
IBM Security Guardium 11.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 174857. |