CVE-2020-1616

MEDIUM Year: 2020
CVSS v3 Score
5.3
Medium
CVSS v2 Score
5.0
Medium
Weakness Type
CWE-307
View all →

Vulnerability Description

Due to insufficient server-side login attempt limit enforcement, a vulnerability in the SSH login service of Juniper Networks Juniper Advanced Threat Prevention (JATP) Series and Virtual JATP (vJATP) devices allows an unauthenticated, remote attacker to perform multiple login attempts in excess of the configured login attempt limit. Successful exploitation will allow the attacker to perform brute-force password attacks on the SSH service. This issue affects: Juniper Networks JATP and vJATP versions prior to 5.0.6.0.

Related Vulnerabilities

CVE-2017-10604

MEDIUM
CVSS:5.3(Medium)

When the device is configured to perform account lockout with a defined period of time, any unauthenticated user attempting to log in as root with an incorrect password can trigger a lockout of the ro...

CWE-3072017

CVE-2018-16703

MEDIUM
CVSS:5.3(Medium)

A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help an attacker to perform login attempts in...

CWE-3072018

CVE-2019-0039

MEDIUM
CVSS:5.3(Medium)

If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using adv...

CWE-3072019

CVE-2019-1126

MEDIUM
CVSS:5.3(Medium)

A security feature bypass vulnerability exists in Active Directory Federation Services (ADFS) which could allow an attacker to bypass the extranet lockout policy.To exploit this vulnerability, an atta...

CWE-3072019

CVE-2020-4232

MEDIUM
CVSS:5.3(Medium)

IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid login credentials which could be used to attempt further attacks against the system...

CWE-3072020

CVE-2020-7057

MEDIUM
CVSS:5.3(Medium)

Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on whether the user account exists,...

CWE-3072020