Filtered by CWE-307
Filtered by vendor Subscriptions
Total 418 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-33106 1 Wijungle 2 U250, U250 Firmware 2025-05-16 9.8 Critical
WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account Take Over.
CVE-2024-42176 1 Hcltech 1 Dryice Myxalytics 2025-05-16 2.6 Low
HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are allowed for a single credential allowing an attacker to potentially obtain access to a user's account or sensitive information.
CVE-2022-31228 1 Dell 3 Xtremio Management Server, Xtremio X1, Xtremio X2 2025-05-15 8.1 High
Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability and gain access to an admin account.
CVE-2022-40055 1 Gxgroup 2 Gpon Ont Titanium 2122a, Gpon Ont Titanium 2122a Firmware 2025-05-15 9.8 Critical
An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page.
CVE-2023-34732 2025-05-13 5.4 Medium
An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to execute brute force attacks to discover user passwords.
CVE-2022-3031 1 Gitlab 1 Gitlab 2025-05-13 3.7 Low
An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for an attacker to guess a user's password by brute force by sending crafted requests to a specific endpoint, even if the victim user has 2FA enabled on their account.
CVE-2024-38888 1 Horizoncloud 1 Caterease 2025-05-13 6.8 Medium
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform a Password Brute Forcing attack due to improper restriction of excessive authentication attempts.
CVE-2025-46739 2025-05-12 8.1 High
An unauthenticated user could discover account credentials via a brute-force attack without rate limiting
CVE-2022-3741 1 Chatwoot 1 Chatwoot 2025-05-09 9.8 Critical
Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output Status Code to separate accounts that are generated and waiting for email verification. \n\nFor the sign in directories, it is possible to brute force login attempts to either login portal, which could lead to account compromise.
CVE-2025-20196 2025-05-08 5.3 Medium
A vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the Cisco IOx application hosting environment to stop responding, resulting in a denial of service (DoS) condition. This vulnerability is due to the improper handling of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to cause the Cisco IOx application hosting environment to stop responding. The IOx process will need to be manually restarted to recover services.
CVE-2025-3709 1 Flowring 1 Agentflow 2025-05-07 9.8 Critical
Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perform password brute force attack.
CVE-2022-44022 1 Pwndoc Project 1 Pwndoc 2025-05-07 5.3 Medium
PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts.
CVE-2023-27172 1 Xpand-it 1 Write-back Manager 2025-05-06 9.1 Critical
Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows attackers to easily obtain the secret key used to sign JWT tokens via a bruteforce attack.
CVE-2024-1104 1 Areal-topkapi 1 Webserv2 2025-05-06 7.5 High
An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users.
CVE-2024-38176 1 Microsoft 1 Groupme 2025-05-05 8.1 High
An improper restriction of excessive authentication attempts in GroupMe allows a unauthenticated attacker to elevate privileges over a network.
CVE-2022-27516 1 Citrix 3 Application Delivery Controller, Application Delivery Controller Firmware, Gateway 2025-05-01 5.3 Medium
User login brute force protection functionality bypass
CVE-2024-39874 1 Siemens 1 Sinema Remote Connect Server 2025-05-01 7.5 High
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force protection against user credentials in its Client Communication component. This could allow an attacker to learn user credentials that are vulnerable to brute force attacks.
CVE-2024-39873 1 Siemens 1 Sinema Remote Connect Server 2025-05-01 7.5 High
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force protection against user credentials in its web API. This could allow an attacker to learn user credentials that are vulnerable to brute force attacks.
CVE-2022-3945 1 Kavitareader 1 Kavita 2025-04-30 5.3 Medium
Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.
CVE-2022-40903 1 Aiphone 8 Gt-db-vn, Gt-db-vn Firmware, Gt-dmb and 5 more 2025-04-30 6.5 Medium
Aiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access attempts, which allows an attacker to gain administrative privileges.