#cwe-307

共收录 183 条相关情报。

漏洞预警2026-10-13 发布INFO

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

CVE-2026-18318

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to i

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-10-12 发布INFO

Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-ac...

CVE-2026-53997

Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in i

历史摘要 · 未重新核验 · NVD

#cve #cwe-307 #cwe-640

漏洞预警2026-10-10 发布INFO

AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers...

CVE-2026-108580

AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

安全公告2026-10-10 发布INFO

AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login

CVE-2026-108580

AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-307

漏洞预警2026-10-10 发布INFO

Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthentica...

CVE-2026-108163

Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

安全公告2026-10-10 发布INFO

Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL

CVE-2026-108162 · CVE-2026-108163

Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-307

安全公告2026-10-09 发布INFO

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

CVE-2026-91973

### Summary The `/dav`, `/.well-known`, and `/feeds` groups are registered on the root Echo instance with only BasicAuth

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-307 #severity:medium

安全公告2026-10-09 发布INFO

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

CVE-2026-91972

### Summary `registerAPIRoutesV2` never applies the unconditional pre-auth rate-limit floor (`unauthRateLimit()`) to the

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-307 #severity:high

漏洞预警2026-10-09 发布INFO

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attacker...

CVE-2026-108109

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/co

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-10-09 发布INFO

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthent...

CVE-2026-76779

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Exce

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-10-06 发布INFO

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows...

CVE-2026-105866

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions befo

历史摘要 · 未重新核验 · NVD

#cve #cwe-307 #cwe-645

漏洞预警2026-10-06 发布INFO

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication code...

CVE-2026-105835

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowin

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier ...

CVE-2026-105638

Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

安全公告2026-10-05 发布INFO

Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

CVE-2026-105638

Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-307

漏洞预警2026-10-05 发布INFO

A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/Admi...

CVE-2026-105237

A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin

历史摘要 · 未重新核验 · NVD

#cve #cwe-307 #cwe-799

安全公告2026-10-05 发布INFO

linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication

CVE-2026-105237

A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-307 #cwe-799

安全公告2026-10-03 发布INFO

The WebSocket Application Programming Interface lacks restrictions on the number of...

CVE-2026-97363

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-307 #severity:high

漏洞预警2026-10-02 发布INFO

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denia...

CVE-2026-97363

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

漏洞预警2026-09-29 发布INFO

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common...

CVE-2026-102825

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_strea

历史摘要 · 未重新核验 · NVD

#cve #cwe-307

安全公告2026-09-29 发布INFO

Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

CVE-2026-102825

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_strea

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-307