Fallos del tipo CWE-307

484 resultados

Falta de limitação em tentativas de autenticação

É quando a aplicação não restringe adequadamente quantas vezes um atacante pode tentar adivinhar credenciais (senha, PIN, código MFA). Sem limite de tentativas ou delay entre elas, força bruta fica viável: o atacante testa combinações até encontrar a senha correta.

Ejemplo

Um formulário de login que aceita requisições ilimitadas sem rate limiting — alguém escreve um script que testa 10 mil senhas por segundo contra uma conta específica até acertar. Ou um endpoint de recuperação de senha que valida códigos sem contar quantas tentativas erradas já houve.

Cómo mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em janela de tempo), aumente delay exponencial entre tentativas falhadas, bloqueie a conta ou IP temporariamente após N falhas, e use CAPTCHA ou MFA para dificultar automação. Log de tentativas suspeitas é essencial para detecção.

CVE-2026-21755MEDIUMHCL Hive is affected by a missing rate limitEPSS 0.2%CVE-2025-54998MEDIUMOpenBao Userpass and LDAP User Lockout BypassEPSS 0.2%CVE-2023-34732MEDIUMAn issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to eEPSS 0.2%CVE-2026-36612MEDIUMMercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 aEPSS 0.2%CVE-2022-26519MEDIUMInterlogix Hills ComNav Improper Restriction of Excessive Authentication AttemptsEPSS 0.2%CVE-2024-32771LOWQTS, QuTS heroEPSS 0.2%CVE-2026-35902MEDIUMThe RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling failed Digest authentication attempts. By repeatedlyEPSS 0.2%CVE-2025-14362HIGHGoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain CircumstancesEPSS 0.2%CVE-2024-38888MEDIUMAn issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker toEPSS 0.2%CVE-2026-27824MEDIUMcalibre has IP Ban Bypass via X-Forwarded-For Header SpoofingEPSS 0.2%CVE-2026-1816MEDIUMOTP Bypass in TEİAŞ's Mobile ApplicationEPSS 0.2%CVE-2024-9832CRITICALNo limit on failed login attempts with Clinician Password or Serial Number Clinician Password on Life2000 VentilatorEPSS 0.2%CVE-2025-62313MEDIUMHCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced.EPSS 0.2%CVE-2025-0417HIGHValmet DNA Lack of protection against brute force attacksEPSS 0.2%CVE-2025-62314MEDIUMHCL AION is affected by multiple security vulnerabilities.EPSS 0.1%CVE-2023-3669LOWCODESYS: Missing Brute-Force protection in CODESYS Development SystemEPSS 0.1%CVE-2026-31863LOWImproper Restriction of Excessive Authentication Attempts in github.com/anyproto/anytype-heartEPSS 0.1%CVE-2025-54860MEDIUMCognex In-Sight Explorer and In-Sight Camera Firmware Improper Restriction of Excessive Authentication AttemptsEPSS 0.1%CVE-2026-55977LOWBypass of application rate-limiting mechanismEPSS 0.1%CVE-2025-12896MEDIUMImproper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authoriEPSS 0.1%