CWE-400 · Uncontrolled Resource Consumption (page 14)
Page 14 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43789 | High | 7.5 | 2024-10-07 | Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them all at once. This can… |
CVE-2024-47850 | High | 7.5 | 2024-10-04 | CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer… |
CVE-2024-47554 | Medium | 4.3 | 2024-10-03 | Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resour… |
CVE-2024-20502 | Medium | 5.8 | 2024-10-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remo… |
CVE-2024-20500 | Medium | 5.8 | 2024-10-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remo… |
CVE-2024-9358 | Medium | 5.3 | 2024-10-01 | A vulnerability has been found in ThingsBoard up to 3.7.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the comp… |
CVE-2024-8454 | Medium | 5.3 | 2024-09-30 | The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have a Denial-of-Service vulnerability in the swctrl… |
CVE-2024-8451 | High | 7.5 | 2024-09-30 | Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, allowing unauthorize… |
CVE-2024-38809 | Medium | 5.3 | 2024-09-27 | Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to th… |
CVE-2024-37125 | High | 7.5 | 2024-09-26 | Dell SmartFabric OS10 Software, versions 10.5.6.x, 10.5.5.x, 10.5.4.x,10.5.3.x, contains an Uncontrolled Resource Consumption vulnerability. A remote unauthent… |
CVE-2024-47003 | Low | 3.1 | 2024-09-26 | Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a… |
CVE-2024-31146 | High | 7.5 | 2024-09-25 | When multiple devices share resources and one of them is to be passed through to a guest, security of the entire system and of respective guests individually c… |
CVE-2024-31145 | High | 7.5 | 2024-09-25 | Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapp… |
CVE-2024-47210 | High | 8.8 | 2024-09-21 | Gladys Assistant before 4.45.1 allows Privilege Escalation (a user changing their own role) because req.body.role can be used in updateMySelf in server/api/con… |
CVE-2024-7254 | High | 7.5 | 2024-09-19 | Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the… |
CVE-2023-28451 | High | 7.5 | 2024-09-18 | An issue was discovered in Technitium 11.0.2. There is a vulnerability (called BadDNS) in DNS resolving software, which triggers a resolver to ignore valid res… |
CVE-2024-8892 | Medium | 5.3 | 2024-09-18 | Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/passw… |
CVE-2024-8939 | Medium | 6.2 | 2024-09-17 | A vulnerability was found in the ilab model serve component, where improper handling of the best_of parameter in the vllm JSON web API can lead to a Denial of… |
CVE-2024-44183 | Medium | 5.5 | 2024-09-17 | A logic error was addressed with improved error handling. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma… |
CVE-2024-44176 | Medium | 5.5 | 2024-09-17 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia… |
CVE-2024-44169 | Medium | 5.5 | 2024-09-17 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14… |
CVE-2024-44160 | Medium | 5.5 | 2024-09-17 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. Processing… |
CVE-2024-44154 | Medium | 5.5 | 2024-09-17 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. Processing a maliciously… |
CVE-2024-40841 | Medium | 5.5 | 2024-09-17 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. Processing a maliciously… |
CVE-2024-27874 | High | 7.5 | 2024-09-17 | This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. A remote attacker may be able to cause a denial-of-ser… |
CVE-2024-38236 | High | 7.5 | 2024-09-10 | DHCP Server Service Denial of Service Vulnerability |
CVE-2024-43647 | High | 7.5 | 2024-09-10 | A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0) (A… |
CVE-2024-8418 | High | 7.5 | 2024-09-04 | A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit th… |
CVE-2024-41434 | Medium | 4.3 | 2024-09-03 | PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component (*Column).GetDecimal. This allows attackers to cause a Denial of Service (DoS… |
CVE-2024-21658 | Medium | 4.3 | 2024-08-30 | discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is… |
CVE-2024-8182 | High | 7.5 | 2024-08-27 | An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise version 1.8.2 leading to a complete crash of the instance running a vulnerable versi… |
CVE-2024-43806 | Medium | 6.5 | 2024-08-26 | Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using `rustix::fs::Dir` using the `linux_raw` backend, it's possible for the iterator to "get stu… |
CVE-2024-43105 | Medium | 4.3 | 2024-08-23 | Mattermost Plugin Channel Export versions <=1.0.0 fail to restrict concurrent runs of the /export command which allows a user to consume excessive resource by… |
CVE-2024-8041 | Medium | 6.5 | 2024-08-22 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1. A d… |
CVE-2024-39810 | Medium | 4.9 | 2024-08-22 | Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a Sy… |
CVE-2024-45166 | Critical | 9.8 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction… |
CVE-2024-45163 | Critical | 9.1 | 2024-08-22 | The Mirai botnet through 2024-08-19 mishandles simultaneous TCP connections to the CNC (command and control) server. Unauthenticated sessions remain open, caus… |
CVE-2024-7592 | High | 7.5 | 2024-08-19 | There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backsla… |
CVE-2024-43380 | Medium | 5.3 | 2024-08-19 | fugit contains time tools for flor and the floraison group. The fugit "natural" parser, that turns "every wednesday at 5pm" into "0 17 * * 3", accepted any len… |
CVE-2024-42849 | Medium | 6.5 | 2024-08-16 | An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function. |
CVE-2024-42981 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function. This vulnerability allows att… |
CVE-2024-42980 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the frmL7ImForm function. This vulnerability allows attackers to… |
CVE-2024-42969 | High | 7.5 | 2024-08-15 | Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeUrlFilter function. This vulnerability allows attack… |
CVE-2024-42951 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the mit_pptpusrpw parameter in the fromWizardHandle function. This vulnerability al… |
CVE-2024-42950 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the Go parameter in the fromSafeClientFilter function. This vulnerability allows at… |
CVE-2024-42943 | High | 7.5 | 2024-08-15 | Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function. This vulnerability allow… |
CVE-2024-41727 | High | 7.5 | 2024-08-14 | In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an inc… |
CVE-2024-7567 | | 2024-08-13 | A denial-of-service vulnerability exists via the CIP/Modbus port in the Rockwell Automation Micro850/870 (2080 -L50E/2080 -L70E). If exploited, the CIP/Modbus… | |
CVE-2024-38168 | High | 7.5 | 2024-08-13 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2023-31348 | High | 7.3 | 2024-08-13 | A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. |
CVE-2024-42481 | High | 7.5 | 2024-08-12 | Skyport Daemon (skyportd) is the daemon for the Skyport Panel. By making thousands of folders & files (easy due to skyport's lack of rate limiting on createFol… |
CVE-2024-0115 | Medium | 6.1 | 2024-08-12 | NVIDIA CV-CUDA for Ubuntu 20.04, Ubuntu 22.04, and Jetpack contains a vulnerability in Python APIs where a user may cause an uncontrolled resource consumption… |
CVE-2024-7610 | Medium | 4.3 | 2024-08-08 | A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2… |
CVE-2024-5423 | Medium | 6.5 | 2024-08-08 | Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 pr… |
CVE-2024-4210 | Medium | 6.5 | 2024-08-08 | A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 12.6 before 17.0.6, 17.1 prior to 17.1.4, and 17.2… |
CVE-2024-41989 | High | 7.5 | 2024-08-07 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when giv… |
CVE-2024-42399 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these v… |
CVE-2024-42398 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these v… |
CVE-2024-42397 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful explo… |
CVE-2024-30170 | Critical | 9.1 | 2024-08-06 | PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major ve… |
CVE-2024-3056 | High | 7.7 | 2024-08-02 | A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least… |
CVE-2024-41946 | Medium | 5.3 | 2024-08-01 | REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser AP… |
CVE-2024-41123 | Medium | 5.3 | 2024-08-01 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as white… |
CVE-2022-4003 | Low | 2.7 | 2024-07-31 | A denial-of-service vulnerability could allow an authenticated user to trigger an internal service restart via a specially crafted API request. |
CVE-2024-37281 | Medium | 6.5 | 2024-07-30 | An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted request… |
CVE-2024-37299 | Medium | 4.9 | 2024-07-30 | Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, crafting requests to submit very long tag group names can reduce the availabil… |
CVE-2024-27862 | Low | 2.4 | 2024-07-29 | A logic issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.6. Enabling Lockdown Mode while setting up a Mac may cause F… |
CVE-2024-41818 | High | 7.5 | 2024-07-29 | fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1. |
CVE-2024-40575 | Medium | 5.5 | 2024-07-24 | An issue in Huawei Technologies opengauss (openGauss 5.0.0 build) v.7.3.0 allows a local attacker to cause a denial of service via the modification of table at… |
CVE-2024-3297 | Medium | 6.5 | 2024-07-24 | An issue in the Certificate Authenticated Session Establishment (CASE) protocol for establishing secure sessions between two devices, as implemented in the Mat… |
CVE-2024-40634 | High | 7.5 | 2024-07-22 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated att… |
CVE-2024-32007 | High | 7.5 | 2024-07-19 | An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service a… |
CVE-2024-21185 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38, 8.4.1 and 9.0.0. Easily explo… |
CVE-2024-21177 | Medium | 6.5 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0… |
CVE-2024-21173 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior… |
CVE-2024-21171 | Medium | 6.5 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0… |
CVE-2024-21163 | Medium | 5.5 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0… |
CVE-2024-21161 | Medium | 5.5 | 2024-07-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.20. Easily… |
CVE-2024-21142 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.37 and prior… |
CVE-2024-21130 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0… |
CVE-2024-21127 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and p… |
CVE-2024-21126 | Medium | 5.8 | 2024-07-16 | Vulnerability in the Oracle Database Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.23 and 21.3-2… |
CVE-2024-20996 | Medium | 4.9 | 2024-07-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior… |
CVE-2024-5795 | High | 7.7 | 2024-07-16 | A Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause unbounded resource exhaustion by sending a large… |
CVE-2024-39908 | Medium | 4.3 | 2024-07-16 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`… |
CVE-2024-38360 | Medium | 4.9 | 2024-07-15 | Discourse is an open source platform for community discussion. In affected versions by creating replacement words with an almost unlimited number of characters… |
CVE-2023-39329 | Medium | 6.5 | 2024-07-13 | A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of se… |
CVE-2023-39327 | Medium | 4.3 | 2024-07-13 | A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the termi… |
CVE-2024-39551 | High | 7.5 | 2024-07-11 | An Uncontrolled Resource Consumption vulnerability in the H.323 ALG (Application Layer Gateway) of Juniper Networks Junos OS on SRX Series and MX Series with… |
CVE-2024-39548 | High | 7.5 | 2024-07-11 | An Uncontrolled Resource Consumption vulnerability in the aftmand process of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacke… |
CVE-2024-6036 | Critical | 9.1 | 2024-07-10 | A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?… |
CVE-2024-39557 | Medium | 6.5 | 2024-07-10 | An Uncontrolled Resource Consumption vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS Evolved allows an unauthenti… |
CVE-2024-39693 | High | 7.5 | 2024-07-10 | Next.js is a React framework. A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availab… |
CVE-2024-21526 | High | 7.5 | 2024-07-10 | All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels property of the Speaker obj… |
CVE-2024-21523 | High | 7.5 | 2024-07-10 | All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different functions. This makes… |
CVE-2024-21521 | High | 7.5 | 2024-07-10 | All versions of the package @discordjs/opus are vulnerable to Denial of Service (DoS) due to providing an input object with a property toString to several diff… |
CVE-2024-6501 | Low | 3.1 | 2024-07-09 | A flaw was found in NetworkManager. When a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, a maliciou… |
CVE-2024-29153 | High | 8.1 | 2024-07-09 | A vulnerability was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with versions Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exyn… |
CVE-2024-5652 | Medium | 6.1 | 2024-07-09 | In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through the exec-path Docker daemon co… |
CVE-2024-38068 | High | 7.5 | 2024-07-09 | Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability |