CWE-799: Improper Control of Interaction Frequency, page 2
Filter
The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
What the weakness is: CWE-799 at MITRE
Ask an AI about CWE-799
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-799: Improper Control of Interaction Frequency and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/799.html and https://cve.bz/cve/cwe/799?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 2.9CVE-2025-8927EPSS 0.6%
A vulnerability was determined in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality of the file /email/send_code of the component Verification Code Handler. The manipulation of the argument email leads to improp…
- 6.3CVE-2025-8742EPSS 0.6%
A vulnerability was found in macrozheng mall 1.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Admin Login. The manipulation leads to improper restriction of excessive authentica…
- 1.3CVE-2025-7882EPSS 0.3%
A vulnerability was found in Mercusys MW301R 1.0.2 Build 190726 Rel.59423n. It has been rated as problematic. This issue affects some unknown processing of the component Login. The manipulation leads to improper restriction of excessive au…
- 2.7CVE-2024-47065EPSS 0.3%
Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given that there are SNR measurements attributed to each received transmission, this is a guaranteed way…
- 4.2CVE-2025-52880EPSS 0.3%
Komga is a media server for comics, mangas, BDs, magazines and eBooks. A Cross-Site Scripting (XSS) vulnerability has been discovered in versions 1.8.0 through 1.21.3 when serving EPUB resources, either directly from the API, or when readi…
- 1.7CVE-2025-52570EPSS 0.4%
Letmein is an authenticating port knocker. Prior to version 10.2.1, The connection limiter is implemented incorrectly. It allows an arbitrary amount of simultaneously incoming connections (TCP, UDP and Unix socket) for the services letmein…
- 2.9CVE-2025-5864EPSS 0.5%
A vulnerability was found in Tenda TDSEE App up to 1.7.12. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /app/ConfirmSmsCode of the component Password Reset Confirmation Code Ha…
- 4.3CVE-2025-48016EPSS 0.2%
OpenFlow discovery protocol can exhaust resources because it is not rate limited
- 6.3CVE-2025-3556EPSS 1.0%
A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/login.php. The manipulation leads to improper restriction of …
- 6.3CVE-2025-3555EPSS 1.0%
A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected is an unknown function of the file /login.php. The manipulation leads to improper restriction of excessive authentication att…
- 6.9CVE-2025-32378EPSS 0.3%
Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt…
- 8.2CVE-2025-29998EPSS 0.4%
This vulnerability exists in the CAP back office application due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnera…
- 5.1CVE-2025-1629EPSS 0.2%
A vulnerability was found in Excitel Broadband Private my Excitel App 3.13.0 on Android. It has been classified as problematic. Affected is an unknown function of the component One-Time Password Handler. The manipulation leads to improper …
- 5.1CVE-2025-26524EPSS 0.4%
This vulnerability exists in RupeeWeb trading platform due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnera…
- 6.3CVE-2024-57603EPSS 0.4%
An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting.
- 5.3CVE-2024-13274EPSS 0.4%
Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.
- 6.5CVE-2024-8475EPSS 0.4%
Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled Variables. This issue affects WiFiBurada: before 1.0.5.
- 2.3CVE-2024-11126EPSS 0.3%
A vulnerability was found in Digistar AG-30 Plus 2.6b. It has been classified as problematic. Affected is an unknown function of the component Login Page. The manipulation leads to improper restriction of excessive authentication attempts.…
- 7.1CVE-2024-51557EPSS 0.5%
This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint wh…
- 5.9CVE-2024-48942EPSS 0.5%
The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofactor/public/pinvalidation endpoint. The last 30 and the next 3…
- 7.1CVE-2024-47654EPSS 0.5%
This vulnerability exists in Shilpi Client Dashboard due to lack of rate limiting and Captcha protection for OTP requests in certain API endpoint. An unauthenticated remote attacker could exploit this vulnerability by sending multiple OTP …
- 7.5CVE-2024-9199EPSS 0.3%
Rate limit vulnerability in Clibo Manager v1.1.9.2 that could allow an attacker to send a large number of emails to the victim in a short time, affecting availability and leading to a denial of service (DoS).
- 8.7CVE-2024-45788EPSS 0.5%
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vul…
- 8.8CVE-2024-6890EPSS 0.7%
Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.
- 8.7CVE-2024-35246EPSS 0.5%
An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly.
- 8.7CVE-2024-32943EPSS 0.5%
An attacker may be able to cause a denial-of-service condition by sending many SSH packets repeatedly.
- 5.5CVE-2024-0094EPSS 0.1%
NVIDIA vGPU software for Linux contains a vulnerability in the Virtual GPU Manager, where an untrusted guest VM can cause improper control of the interaction frequency in the host. A successful exploit of this vulnerability might lead to d…
- 5.3CVE-2023-51544EPSS 0.3%
Improper Control of Interaction Frequency vulnerability in Metagauss RegistrationMagic allows Functionality Misuse.This issue affects RegistrationMagic: from n/a through 5.2.5.0.
- 6.5CVE-2023-40673EPSS 0.4%
: Improper Control of Interaction Frequency vulnerability in cartpauj Cartpauj Register Captcha allows Functionality Misuse.This issue affects Cartpauj Register Captcha: from n/a through 1.0.02.
- 9.8CVE-2023-40332EPSS 0.4%
Improper Control of Interaction Frequency vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Functionality Misuse.This issue affects WP-PostRatings: from n/a through 1.91.
- 5.3CVE-2024-24873EPSS 0.4%
: Improper Control of Interaction Frequency vulnerability in CodePeople CP Polls allows Flooding.This issue affects CP Polls: from n/a through 1.0.71.
- 6.3CVE-2024-34695EPSS 0.8%
WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation prompt before the modal closes, which triggers sending several post creation API requests at once. D…
- 6.5CVE-2023-27279EPSS 0.7%
IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a user to cause a denial of service due to missing API rate limiting. IBM X-Force ID: 248533.
- 7.5CVE-2023-35621EPSS 2.3%
Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability
- 7.3CVE-2023-38068EPSS 0.5%
In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms
- 5.3CVE-2023-2758EPSS 1.0%
A denial of service vulnerability exists in Contec CONPROSYS HMI System versions 3.5.2 and prior. When there is a time-zone mismatch in certain configuration files, a remote, unauthenticated attacker may deny logins for an extended period …
- 5.3CVE-2021-37910EPSS 2.1%
ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users' connections by sending specially crafted SAE aut…
- 8.1CVE-2021-41177EPSS 1.6%
Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (…
- 4.3CVE-2021-37191EPSS 0.4%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attacker in the same network of the affected system could brute force the usernames from the affected software.
- 5.3CVE-2021-32741EPSS 1.3%
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate p…
- 7.5CVE-2021-32705EPSS 1.7%
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially va…
- 5.3CVE-2021-32703EPSS 1.5%
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially val…
- 5.3CVE-2021-32678EPSS 1.4%
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteF…
- 6.5CVE-2020-5141EPSS 1.2%
A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.1…
- 5.9CVE-2016-6543EPSS 2.1%
A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data, which can allow unauthenticated parties to track the device.