CWE-400 · Uncontrolled Resource Consumption (page 16)
Page 16 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-26976 | High | 7.8 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async #PF workqueue when vCPU is being destroyed Always flush the per-v… |
CVE-2024-34045 | High | 7.5 | 2024-04-30 | The O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo->counters[IN_INITI][MSG_COUNTER][ProcedureCode_id… |
CVE-2023-31889 | Medium | 5.5 | 2024-04-29 | An issue discovered in httpd in ASUS RT-AC51U with firmware version up to and including 3.0.0.4.380.8591 allows local attackers to cause a denial of service vi… |
CVE-2024-32269 | High | 7.5 | 2024-04-29 | An issue in Yonganda YAD-LOJ V3.0.561 allows a remote attacker to cause a denial of service via a crafted packet. |
CVE-2024-2757 | High | 7.5 | 2024-04-29 | In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space… |
CVE-2024-33259 | Medium | 5.5 | 2024-04-26 | Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component scanner_seek at jerry-core/parser/js/js-scanner-util.c. |
CVE-2024-4183 | Medium | 4.3 | 2024-04-26 | Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows a… |
CVE-2024-22091 | Low | 3.1 | 2024-04-26 | Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs whic… |
CVE-2024-33664 | Medium | 5.3 | 2024-04-26 | python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token wi… |
CVE-2024-3508 | Medium | 4.3 | 2024-04-25 | A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fiel… |
CVE-2023-6596 | High | 7.5 | 2024-04-25 | An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers. |
CVE-2024-28717 | Medium | 4.9 | 2024-04-22 | An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component. |
CVE-2024-31994 | Medium | 6.5 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, an attacker can point the image request to an arbitrarily large file. Mealie will atte… |
CVE-2024-31992 | Medium | 6.5 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a r… |
CVE-2024-21062 | Medium | 4.9 | 2024-04-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0… |
CVE-2024-21057 | Medium | 4.9 | 2024-04-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior. Easily ex… |
CVE-2024-21055 | Medium | 4.9 | 2024-04-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior. Easily ex… |
CVE-2024-21051 | Medium | 4.9 | 2024-04-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploita… |
CVE-2024-21050 | Medium | 4.9 | 2024-04-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploita… |
CVE-2024-21013 | Medium | 4.4 | 2024-04-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0… |
CVE-2024-21008 | Medium | 4.4 | 2024-04-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0… |
CVE-2024-3872 | Low | 3.1 | 2024-04-16 | Mattermost Mobile app versions 2.13.0 and earlier use a regular expression with polynomial complexity to parse certain deeplinks, which allows an unauthenticat… |
CVE-2024-1569 | High | 7.5 | 2024-04-16 | parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_c… |
CVE-2024-0157 | Medium | 5.9 | 2024-04-12 | Dell Storage Resource Manager, 4.9.0.0 and below, contain(s) a Session Fixation Vulnerability in SRM Windows Host Agent. An adjacent network unauthenticated at… |
CVE-2024-30915 | Medium | 4.3 | 2024-04-11 | An issue was discovered in OpenDDS commit b1c534032bb62ad4ae32609778de6b8d6c823a66, allows a local attacker to cause a denial of service and obtain sensitive i… |
CVE-2024-3569 | High | 7.5 | 2024-04-10 | A Denial of Service (DoS) vulnerability exists in the mintplex-labs/anything-llm repository when the application is running in 'just me' mode with a password… |
CVE-2024-26215 | High | 7.5 | 2024-04-09 | DHCP Server Service Denial of Service Vulnerability |
CVE-2024-26212 | High | 7.5 | 2024-04-09 | DHCP Server Service Denial of Service Vulnerability |
CVE-2021-47208 | Medium | 4.3 | 2024-04-08 | The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service. |
CVE-2024-28949 | Medium | 4.3 | 2024-04-05 | Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which all… |
CVE-2024-31209 | Medium | 5.3 | 2024-04-04 | oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:g… |
CVE-2024-26723 | High | 7.8 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: lan966x: Fix crash when adding interface under a lag There is a crash when adding one of… |
CVE-2024-29893 | Medium | 6.5 | 2024-03-29 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server com… |
CVE-2024-23450 | Medium | 4.9 | 2024-03-27 | A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash. |
CVE-2023-47150 | High | 7.5 | 2024-03-26 | IBM Common Cryptographic Architecture (CCA) 7.0.0 through 7.5.36 could allow a remote user to cause a denial of service due to incorrect data handling for cert… |
CVE-2024-21914 | Medium | 5.3 | 2024-03-25 | A vulnerability exists in the affected product that allows a malicious user to restart the Rockwell Automation PanelView™ Plus 7 terminal remotely without sec… |
CVE-2018-25100 | Medium | 5.3 | 2024-03-24 | The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies for the same domain. This affects Mojo… |
CVE-2023-5685 | High | 7.5 | 2024-03-22 | A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can… |
CVE-2023-4063 | Medium | 5.3 | 2024-03-22 | Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request. |
CVE-2024-29186 | Medium | 5.3 | 2024-03-22 | Bref is an open-source project that helps users go serverless on Amazon Web Services with PHP. When Bref prior to version 2.1.17 is used with the Event-Driven… |
CVE-2024-28863 | Medium | 6.5 | 2024-03-21 | node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker wh… |
CVE-2023-49837 | Medium | 6.5 | 2024-03-21 | Uncontrolled Resource Consumption vulnerability in David Artiss Code Embed.This issue affects Code Embed: from n/a through 2.3.6. |
CVE-2023-50967 | High | 7.5 | 2024-03-20 | latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. |
CVE-2023-50966 | Medium | 5.3 | 2024-03-19 | erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) va… |
CVE-2024-26369 | High | 7.5 | 2024-03-19 | An issue in the HistoryQosPolicy component of FastDDS v2.12.x, v2.11.x, v2.10.x, and v2.6.x leads to a SIGABRT (signal abort) upon receiving DataWriter's data. |
CVE-2024-27100 | Medium | 6.5 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files… |
CVE-2024-27085 | Medium | 6.5 | 2024-03-15 | Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data i… |
CVE-2024-24827 | Medium | 5.3 | 2024-03-15 | Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry… |
CVE-2024-28854 | High | 7.5 | 2024-03-15 | tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4… |
CVE-2024-2446 | Medium | 4.3 | 2024-03-15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per me… |
CVE-2024-28053 | Low | 3.1 | 2024-03-15 | Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker t… |
CVE-2024-24975 | Low | 3.5 | 2024-03-15 | Uncontrolled Resource Consumption in Mattermost Mobile versions before 2.13.0 fails to limit the size of the code block that will be processed by the syntax hi… |
CVE-2023-35191 | Medium | 6.8 | 2024-03-14 | Uncontrolled resource consumption for some Intel(R) SPS firmware versions may allow a privileged user to potentially enable denial of service via network acces… |
CVE-2024-1765 | Medium | 5.9 | 2024-03-12 | Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the… |
CVE-2024-1410 | Low | 3.7 | 2024-03-12 | Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resour… |
CVE-2024-26190 | High | 7.5 | 2024-03-12 | Microsoft QUIC Denial of Service Vulnerability |
CVE-2024-21392 | High | 7.5 | 2024-03-12 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2024-28176 | Medium | 4.9 | 2024-03-09 | jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (J… |
CVE-2024-28122 | Medium | 6.8 | 2024-03-09 | JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted pu… |
CVE-2024-23265 | High | 7.8 | 2024-03-08 | A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Mon… |
CVE-2024-23259 | Medium | 6.5 | 2024-03-08 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Processing web… |
CVE-2023-52602 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds Read in dtSearch Currently while searching for current page i… |
CVE-2024-25615 | Medium | 5.3 | 2024-03-05 | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Spectrum service accessed via the PAPI protocol in ArubaOS 8.x. Successful exploitation… |
CVE-2024-25269 | High | 7.5 | 2024-03-05 | libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack. |
CVE-2022-43880 | Medium | 4.4 | 2024-03-03 | IBM QRadar WinCollect Agent 10.0 through 10.1.2 could allow a privileged user to cause a denial of service. IBM X-Force ID: 240151. |
CVE-2024-27355 | High | 7.5 | 2024-03-01 | An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. When processing the ASN.1 object identifier of a certificate… |
CVE-2024-27354 | High | 7.5 | 2024-03-01 | An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can construct a malformed certificate containing… |
CVE-2024-1953 | Medium | 4.3 | 2024-02-29 | Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowi… |
CVE-2024-24988 | Medium | 4.3 | 2024-02-29 | Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string a… |
CVE-2024-20344 | Medium | 5.3 | 2024-02-29 | A vulnerability in system resource management in Cisco UCS 6400 and 6500 Series Fabric Interconnects that are in Intersight Managed Mode (IMM) could allow an u… |
CVE-2024-20321 | High | 8.6 | 2024-02-29 | A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause… |
CVE-2023-51775 | Medium | 6.5 | 2024-02-29 | The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. |
CVE-2023-45874 | Medium | 4.3 | 2024-02-29 | An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (outage of reader threads). |
CVE-2024-26141 | Medium | 5.8 | 2024-02-29 | Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with… |
CVE-2021-47023 | High | 8.2 | 2024-02-28 | In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix port event handling on init For some reason there might be a… |
CVE-2021-47010 | High | 7.8 | 2024-02-28 | In the Linux kernel, the following vulnerability has been resolved: net: Only allow init netns to set default tcp cong to a restricted algo tcp_set_default_c… |
CVE-2021-46939 | Medium | 5.5 | 2024-02-27 | In the Linux kernel, the following vulnerability has been resolved: tracing: Restructure trace_clock_global() to never block It was reported that a fix to th… |
CVE-2024-25398 | High | 7.5 | 2024-02-27 | In Srelay (the SOCKS proxy and Relay) v.0.4.8p3, a specially crafted network payload can trigger a denial of service condition and disrupt the service. |
CVE-2024-27088 | Unrated | | 2024-02-26 | es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTo… |
CVE-2024-23835 | High | 7.5 | 2024-02-26 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.3, excessive memory… |
CVE-2024-22201 | High | 7.5 | 2024-02-26 | Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attack… |
CVE-2024-1635 | High | 7.5 | 2024-02-19 | A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and… |
CVE-2024-25978 | High | 7.5 | 2024-02-19 | Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality. |
CVE-2024-20978 | Medium | 4.9 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20976 | Medium | 4.9 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20972 | Medium | 4.9 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20964 | Medium | 5.3 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.35 and prior… |
CVE-2024-20962 | Medium | 6.5 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-24750 | Medium | 6.5 | 2024-02-16 | Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it… |
CVE-2024-20716 | Medium | 4.9 | 2024-02-15 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to an appli… |
CVE-2024-25617 | Medium | 5.3 | 2024-02-14 | Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerab… |
CVE-2023-50868 | High | 7.5 | 2024-02-14 | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU… |
CVE-2023-29153 | Medium | 4.9 | 2024-02-14 | Uncontrolled resource consumption for some Intel(R) SPS firmware before version SPS_E5_06.01.04.002.0 may allow a privileged user to potentially enable denial… |
CVE-2023-25769 | Medium | 5.5 | 2024-02-14 | Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially ena… |
CVE-2024-23952 | Medium | 6.5 | 2024-02-14 | This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by a… |
CVE-2024-24814 | High | 7.5 | 2024-02-13 | mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Part… |
CVE-2024-21386 | High | 7.5 | 2024-02-13 | .NET Denial of Service Vulnerability |
CVE-2024-21342 | High | 7.5 | 2024-02-13 | Windows DNS Client Denial of Service Vulnerability |
CVE-2024-24781 | High | 7.5 | 2024-02-13 | An unauthenticated remote attacker can use an uncontrolled resource consumption vulnerability to DoS the affected devices through excessive traffic on a single… |
CVE-2024-1309 | Medium | 6.5 | 2024-02-13 | Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affects Niagara Framew… |