CWE-400 · Uncontrolled Resource Consumption (page 17)
Page 17 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25112 | Medium | 5.5 | 2024-02-12 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found in Exi… |
CVE-2023-6681 | Medium | 5.3 | 2024-02-12 | A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary… |
CVE-2023-41707 | Medium | 6.5 | 2024-02-12 | Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the… |
CVE-2023-41706 | Medium | 6.5 | 2024-02-12 | Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. Availability of OX Ap… |
CVE-2023-41705 | Medium | 6.5 | 2024-02-12 | Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the… |
CVE-2024-25718 | Critical | 9.8 | 2024-02-11 | In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Sam… |
CVE-2024-23323 | Medium | 4.3 | 2024-02-09 | Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased reques… |
CVE-2024-1402 | Medium | 4.3 | 2024-02-09 | Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, a… |
CVE-2024-25452 | Medium | 5.5 | 2024-02-09 | Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_UrlAtom::AP4_UrlAtom() function. |
CVE-2024-25451 | Medium | 6.5 | 2024-02-09 | Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_DataBuffer::ReallocateBuffer() function. |
CVE-2024-0842 | High | 7.5 | 2024-02-09 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 1.2.6. This is… |
CVE-2024-22332 | Medium | 6.5 | 2024-02-09 | The IBM Integration Bus for z/OS 10.1 through 10.1.0.2 AdminAPI is vulnerable to a denial of service due to file system exhaustion. IBM X-Force ID: 279972. |
CVE-2023-32341 | Medium | 6.5 | 2024-02-09 | IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 could allow an authenticated user to cause a denial of service due to uncontrol… |
CVE-2024-24575 | High | 7.5 | 2024-02-06 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2024-24943 | Medium | 5.3 | 2024-02-06 | In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image |
CVE-2023-22819 | Medium | 4.9 | 2024-02-05 | An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventua… |
CVE-2024-24762 | High | 7.5 | 2024-02-05 | `python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Ty… |
CVE-2023-52425 | High | 7.5 | 2024-02-04 | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multi… |
CVE-2023-31006 | Medium | 6.5 | 2024-02-03 | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10… |
CVE-2023-30999 | High | 7.5 | 2024-02-03 | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10… |
CVE-2024-23824 | Medium | 4.7 | 2024-02-02 | mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the pa… |
CVE-2023-45028 | Medium | 5.5 | 2024-02-02 | An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could al… |
CVE-2024-24752 | Medium | 6.5 | 2024-02-01 | Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lam… |
CVE-2024-1014 | Medium | 6.2 | 2024-01-29 | Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availabi… |
CVE-2024-22233 | High | 7.5 | 2024-01-22 | In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) co… |
CVE-2024-23744 | High | 7.5 | 2024-01-21 | An issue was discovered in Mbed TLS 3.5.1. There is persistent handshake denial if a client sends a TLS 1.3 ClientHello without extensions. |
CVE-2023-6450 | Medium | 5.5 | 2024-01-19 | An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resulting in a denial of… |
CVE-2024-20985 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and p… |
CVE-2024-20983 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploita… |
CVE-2024-20981 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and p… |
CVE-2024-20977 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20971 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20965 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20961 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20959 | Medium | 4.4 | 2024-01-16 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily expl… |
CVE-2023-22512 | High | 7.5 | 2024-01-16 | This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this v… |
CVE-2024-0581 | Medium | 4.0 | 2024-01-16 | An Uncontrolled Resource Consumption vulnerability has been found on Sandsprite Scdbg.exe, affecting version 1.0. This vulnerability allows an attacker to send… |
CVE-2023-52098 | High | 7.5 | 2024-01-16 | Denial of Service (DoS) vulnerability in the DMS module. Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52113 | High | 7.5 | 2024-01-16 | launchAnyWhere vulnerability in the ActivityManagerService module. Successful exploitation of this vulnerability will affect availability. |
CVE-2024-22362 | High | 7.5 | 2024-01-16 | Drupal contains a vulnerability with improper handling of structural elements. If this vulnerability is exploited, an attacker may be able to cause a denial-of… |
CVE-2024-21655 | Medium | 4.3 | 2024-01-12 | Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause… |
CVE-2023-48297 | High | 8.6 | 2024-01-12 | Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very… |
CVE-2023-34061 | High | 7.5 | 2024-01-12 | Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this vulnerability to for… |
CVE-2023-49295 | Medium | 6.4 | 2024-01-10 | quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large num… |
CVE-2023-42941 | Medium | 4.8 | 2024-01-10 | The issue was addressed with improved checks. This issue is fixed in iOS 17.2 and iPadOS 17.2. An attacker in a privileged network position may be able to perf… |
CVE-2024-0348 | Medium | 4.3 | 2024-01-09 | A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been classified as problematic. Affected is an unknown function of the componen… |
CVE-2024-20672 | High | 7.5 | 2024-01-09 | .NET Denial of Service Vulnerability |
CVE-2024-20661 | High | 7.5 | 2024-01-09 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2024-22164 | Medium | 4.3 | 2024-01-09 | In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigatio… |
CVE-2024-21651 | High | 7.5 | 2024-01-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a page can post a malf… |
CVE-2023-50121 | Medium | 5.7 | 2024-01-06 | Autel EVO NANO drone flight control firmware version 1.6.5 is vulnerable to denial of service (DoS). |
CVE-2023-34324 | Medium | 4.9 | 2024-01-05 | Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen consol… |
CVE-2024-0241 | High | 7.5 | 2024-01-04 | encoded_id-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might ca… |
CVE-2023-42358 | High | 7.7 | 2024-01-03 | An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via… |
CVE-2023-49557 | Medium | 5.5 | 2024-01-03 | An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the yasm_section_bcs_first function in the libyasm/section.c componen… |
CVE-2023-49555 | Medium | 5.5 | 2024-01-03 | An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_smacro function in the modules/preprocs/nasm/nasm-pp.c com… |
CVE-2023-49550 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component. |
CVE-2023-50020 | High | 7.5 | 2024-01-02 | An issue was discovered in open5gs v2.6.6. SIGPIPE can be used to crash AMF. |
CVE-2023-50019 | Medium | 5.9 | 2024-01-02 | An issue was discovered in open5gs v2.6.6. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of Nudm… |
CVE-2023-26157 | Medium | 5.5 | 2024-01-02 | Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in deco… |
CVE-2023-50730 | High | 7.5 | 2023-12-22 | Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form… |
CVE-2023-46131 | Medium | 6.5 | 2023-12-21 | Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of… |
CVE-2023-50249 | High | 7.5 | 2023-12-20 | Sentry-Javascript is official Sentry SDKs for JavaScript. A ReDoS (Regular expression Denial of Service) vulnerability has been identified in Sentry's Astro SD… |
CVE-2023-50707 | Critical | 9.6 | 2023-12-20 | Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device. |
CVE-2023-46104 | Medium | 6.5 | 2023-12-19 | Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vu… |
CVE-2023-41151 | High | 7.5 | 2023-12-14 | An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to crash when the server wa… |
CVE-2023-6193 | Medium | 5.3 | 2023-12-12 | quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consum… |
CVE-2023-49713 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in NetBIOS service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to… |
CVE-2023-49143 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in rfe service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to spec… |
CVE-2023-49140 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in commplex-link service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packe… |
CVE-2023-41963 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in FTP service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to spec… |
CVE-2023-49809 | Medium | 4.3 | 2023-12-12 | Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and mak… |
CVE-2023-45847 | Medium | 4.3 | 2023-12-12 | Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and cr… |
CVE-2023-5870 | Low | 2.2 | 2023-12-10 | A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum wor… |
CVE-2023-49800 | High | 7.5 | 2023-12-09 | `nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on w… |
CVE-2023-4486 | High | 7.5 | 2023-12-07 | Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines pri… |
CVE-2023-35909 | Medium | 5.3 | 2023-12-07 | Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This i… |
CVE-2023-48840 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion. |
CVE-2023-48834 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion. |
CVE-2023-48833 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhaustion. |
CVE-2023-48831 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion. |
CVE-2023-6180 | Medium | 5.3 | 2023-12-05 | The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exha… |
CVE-2023-39248 | High | 7.5 | 2023-12-05 | Dell OS10 Networking Switches running 10.5.2.x and above contain an Uncontrolled Resource Consumption (Denial of Service) vulnerability, when switches are con… |
CVE-2023-49290 | Medium | 5.3 | 2023-12-05 | lestrrat-go/jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. A p2c parameter set too high in JWE's algo… |
CVE-2023-47633 | High | 7.5 | 2023-12-04 | Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an autom… |
CVE-2023-40692 | Medium | 5.9 | 2023-12-04 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, 11.5 is vulnerable to denial of service under extreme stress conditions. IBM X-F… |
CVE-2023-5915 | Medium | 5.3 | 2023-12-01 | A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation. This vulnerability may allow to… |
CVE-2023-48951 | High | 7.5 | 2023-11-29 | An issue in the box_equal function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. |
CVE-2023-48713 | Medium | 6.5 | 2023-11-28 | Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to… |
CVE-2023-48369 | Medium | 4.3 | 2023-11-27 | Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow th… |
CVE-2023-48268 | Medium | 4.3 | 2023-11-27 | Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excess… |
CVE-2023-40703 | Medium | 4.3 | 2023-11-27 | Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resource… |
CVE-2023-6277 | Medium | 6.5 | 2023-11-24 | An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft… |
CVE-2023-33202 | Medium | 5.5 | 2023-11-23 | Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This c… |
CVE-2023-41102 | High | 7.5 | 2023-11-17 | An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may l… |
CVE-2023-47025 | Medium | 5.5 | 2023-11-16 | An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component. |
CVE-2023-38043 | High | 7.8 | 2023-11-15 | A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulne… |
CVE-2023-45622 | High | 7.5 | 2023-11-14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitation of these vulner… |
CVE-2023-45621 | High | 7.5 | 2023-11-14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabiliti… |
CVE-2023-36038 | High | 8.2 | 2023-11-14 | ASP.NET Core Denial of Service Vulnerability |