Filtered by CWE-307
Filtered by vendor Subscriptions
Total 409 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-24767 1 Icewhale 1 Casaos 2025-04-10 9.1 Critical
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.
CVE-2023-23730 1 Brainstormforce 1 Spectra 2025-04-10 5.3 Medium
Improper Restriction of Excessive Authentication Attempts vulnerability in Brainstorm Force Spectra allows Functionality Bypass.This issue affects Spectra: from n/a through 2.3.0.
CVE-2022-4797 1 Usememos 1 Memos 2025-04-10 4.3 Medium
Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.
CVE-2022-38491 1 Easyvista 1 Service Manager 2025-04-09 8.2 High
An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-force attacks. Version 2022.1.133.0 corrects this issue.
CVE-2022-23814 1 Amd 2 Milanpi-sp3, Milanpi-sp3 Firmware 2025-04-09 5.3 Medium
Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confidential compute environment.
CVE-2022-23813 1 Amd 4 Milanpi-sp3, Milanpi-sp3 Firmware, Romepi and 1 more 2025-04-09 5.3 Medium
The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of integrity of guest memory in a confidential compute environment.
CVE-2025-3129 2025-04-07 N/A
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.
CVE-2024-3202 1 Codelyfe 1 Stupid Simple Cms 2025-04-04 3.7 Low
A vulnerability, which was classified as problematic, has been found in codelyfe Stupid Simple CMS 1.2.4. This issue affects some unknown processing of the component Login Page. The manipulation leads to improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-259049 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-21500 1 Authcrunch 1 Caddy-security 2025-04-03 4.8 Medium
All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication (2FA). Although the application blocks the user after several failed attempts to provide 2FA codes, attackers can bypass this blocking mechanism by automating the application’s full multistep 2FA process.
CVE-2002-0628 1 Polycom 8 Viewstation 128, Viewstation 512, Viewstation Dcp and 5 more 2025-04-03 7.5 High
The Telnet service for Polycom ViewStation before 7.2.4 does not restrict the number of failed login attempts, which makes it easier for remote attackers to guess usernames and passwords via a brute force attack.
CVE-2001-1339 1 Anybus 2 Ipc\@chip, Ipc\@chip Firmware 2025-04-03 9.8 Critical
Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users from the service when bad passwords are entered, which makes it easier for remote attackers to conduct brute force password guessing attacks.
CVE-2001-0395 1 Lightwavemo 2 Consoleserver 3200, Consoleserver 3200 Firmware 2025-04-03 9.8 Critical
Lightwave ConsoleServer 3200 does not disconnect users after unsuccessful login attempts, which could allow remote attackers to conduct brute force password guessing.
CVE-2001-1291 1 3com 2 Superstack Ii Ps Hub 40, Superstack Ii Ps Hub 40 Firmware 2025-04-03 9.8 Critical
The telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect remote attackers who provide an incorrect username or password, which makes it easier to break into the server via brute force password guessing.
CVE-1999-1152 1 Compaq 2 Microcom 6000, Microcom 6000 Firmware 2025-04-03 7.5 High
Compaq/Microcom 6000 Access Integrator does not disconnect a client after a certain number of failed login attempts, which allows remote attackers to guess usernames or passwords via a brute force attack.
CVE-1999-1324 1 Hp 1 Openvms Vax 2025-04-03 9.8 Critical
VAXstations running Open VMS 5.3 through 5.5-2 with VMS DECwindows or MOTIF do not properly disable access to user accounts that exceed the break-in limit threshold for failed login attempts, which makes it easier for attackers to conduct brute force password guessing.
CVE-2023-22960 1 Lexmark 256 B2236, B2236 Firmware, B2338 and 253 more 2025-04-02 7.5 High
Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.
CVE-2021-27782 1 Hcltech 1 Bigfix Mobile 2025-04-02 5.4 Medium
HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts.
CVE-2025-25595 1 Iitb 1 Safe 2025-04-01 9.8 Critical
A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack.
CVE-2025-0417 2025-04-01 N/A
Lack of protection against brute force attacks in Valmet DNA visualization in DNA Operate. The possibility to make an arbitrary number of login attempts without any rate limit gives an attacker an increased chance of guessing passwords and then performing switching operations.
CVE-2025-2911 2025-03-28 N/A
Unauthorised access to the call forwarding service system in MeetMe products in versions prior to 2024-09 allows an attacker to identify multiple users and perform brute force attacks via extensions.