CWE-307 CVEs
11 CVEs
Overview 11 matches · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
1
9.1%
No exploit published
10
90.9%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
11
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
1
9.1%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
10
90.9%
split by
peak 3 / year
20171
No exploit published1
Critical1
not blocked1
No public exploit1
20181
No exploit published1
High1
not blocked1
No public exploit1
20190
20200
20211
No exploit published1
Medium1
not blocked1
No public exploit1
20220
20231
No exploit published1
High1
not blocked1
No public exploit1
20241
No exploit published1
Medium1
not blocked1
No public exploit1
20253
No exploit published3
High1
Medium2
not blocked3
No public exploit3
20263
Mitigation candidate1
No exploit published2
Critical1
Medium2
not blocked3
Working exploit published1
No public exploit2
2017201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-2323 | Medium | 2026-10-20 | No exploit published | No public exploit | The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise. |
| CVE-2026-88770 | Medium | 2026-09-10 | No exploit published | No public exploit | A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a locked account, they can complete the device login process and receive new security tokens. This allows the attacker to maintain access to the account even when it should be temporarily disabled to prevent unauthorized entry. |
| CVE-2026-44596 | Critical | 2026-07-16 | Mitigation candidate | Working exploit published | Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0. |
| CVE-2025-62257 | Medium | 2025-10-30 | No exploit published | No public exploit | Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack. |
| CVE-2024-9342 | Medium | 2025-07-16 | No exploit published | No public exploit | In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection . |
| CVE-2025-23368 | High | 2025-03-04 | No exploit published | No public exploit | A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI. |
| CVE-2024-4629 | Medium | 2024-09-03 | No exploit published | No public exploit | A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems. |
| CVE-2023-26476 | High | 2023-03-02 | No exploit published | No public exploit | XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version >= 3.2M3 by applying the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`. |
| CVE-2021-29842 | Medium | 2021-09-16 | No exploit published | No public exploit | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202. |
| CVE-2018-14657 | High | 2018-11-13 | No exploit published | No public exploit | A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures. |
| CVE-2017-7673 | Critical | 2017-07-17 | No exploit published | No public exploit | Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection. |