CWE-400 · Uncontrolled Resource Consumption (page 17)
Page 17 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-24424 | High | 7.5 | 2025-01-21 | A reachable assertion in the decode_access_point_name_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows atta… |
CVE-2025-21549 | High | 7.5 | 2025-01-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.1.0.0. Easi… |
CVE-2025-21548 | Medium | 6.4 | 2025-01-21 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.1.0 and prior. Easily… |
CVE-2025-21547 | Critical | 9.1 | 2025-01-21 | Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected ar… |
CVE-2025-21545 | High | 7.5 | 2025-01-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch). Supported versions that are affected are 8.60 and… |
CVE-2025-21529 | Medium | 4.9 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.40 and prior… |
CVE-2025-23184 | Medium | 5.9 | 2025-01-21 | A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream ins… |
CVE-2018-9447 | Medium | 5.5 | 2025-01-17 | In onCreate of EmergencyCallbackModeExitDialog.java, there is a possible way to crash the emergency callback mode due to a missing null check. This could lead… |
CVE-2024-50953 | High | 7.5 | 2025-01-15 | An issue in XINJE XL5E-16T V3.7.2a allows attackers to cause a Denial of Service (DoS) via a crafted Modbus message. |
CVE-2024-54730 | High | 7.5 | 2025-01-14 | Flatnotes <v5.3.1 is vulnerable to denial of service through the upload image function. |
CVE-2025-21389 | High | 7.5 | 2025-01-14 | Uncontrolled resource consumption in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to deny service over a network. |
CVE-2025-21330 | High | 7.5 | 2025-01-14 | Windows Remote Desktop Services Denial of Service Vulnerability |
CVE-2025-21300 | High | 7.5 | 2025-01-14 | Windows Universal Plug and Play (UPnP) Device Host Denial of Service Vulnerability |
CVE-2025-21290 | High | 7.5 | 2025-01-14 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2025-21289 | High | 7.5 | 2025-01-14 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2025-21270 | High | 7.5 | 2025-01-14 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2025-21251 | High | 7.5 | 2025-01-14 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2025-21231 | High | 7.5 | 2025-01-14 | IP Helper Denial of Service Vulnerability |
CVE-2025-21230 | High | 7.5 | 2025-01-14 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2025-21218 | High | 7.5 | 2025-01-14 | Windows Kerberos Denial of Service Vulnerability |
CVE-2025-21207 | High | 7.5 | 2025-01-14 | Windows Connected Devices Platform Service (Cdpsvc) Denial of Service Vulnerability |
CVE-2024-57655 | High | 7.5 | 2025-01-14 | An issue in the dfe_n_in_order component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2024-47239 | Medium | 6.5 | 2025-01-08 | Dell PowerScale OneFS versions 8.2.2.x through 9.9.0.0 contain an uncontrolled resource consumption vulnerability. A remote low privileged attacker could poten… |
CVE-2025-21614 | High | 7.5 | 2025-01-06 | go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to… |
CVE-2024-55605 | High | 7.5 | 2025-01-06 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a large input buffer to t… |
CVE-2024-53647 | Medium | 6.5 | 2024-12-31 | Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests… |
CVE-2024-13058 | | 2024-12-30 | An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and avai… | |
CVE-2024-56200 | High | 8.6 | 2024-12-19 | Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote… |
CVE-2022-27600 | Medium | 6.8 | 2024-12-19 | An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could al… |
CVE-2024-12698 | Medium | 6.5 | 2024-12-18 | An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated stream… |
CVE-2024-54677 | Medium | 5.3 | 2024-12-17 | Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apa… |
CVE-2024-12601 | Medium | 5.3 | 2024-12-17 | The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited heigh… |
CVE-2024-11835 | High | 7.5 | 2024-12-13 | Uncontrolled Resource Consumption vulnerability in PlexTrac allows WebSocket DoS.This issue affects PlexTrac: from 1.61.3 before 2.8.1. |
CVE-2024-12579 | Medium | 5.3 | 2024-12-13 | The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 2.1.10. This is due to… |
CVE-2024-54113 | Medium | 6.5 | 2024-12-12 | Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulnerability may affect power consumption. |
CVE-2024-49129 | High | 7.5 | 2024-12-12 | Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability |
CVE-2024-49096 | High | 7.5 | 2024-12-12 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2024-49075 | High | 7.5 | 2024-12-12 | Windows Remote Desktop Services Denial of Service Vulnerability |
CVE-2024-42426 | Medium | 4.3 | 2024-12-09 | Dell PowerScale OneFS Versions 9.5.0.x through 9.8.0.x contain an uncontrolled resource consumption vulnerability. A low privilege remote attacker could potent… |
CVE-2024-12254 | High | 7.5 | 2024-12-06 | Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer… |
CVE-2024-11498 | High | 7.5 | 2024-11-25 | There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is p… |
CVE-2024-52804 | High | 7.5 | 2024-11-22 | Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes… |
CVE-2018-9412 | Medium | 5.5 | 2024-11-19 | In removeUnsynchronization of ID3.cpp there is a possible resource exhaustion due to improper input validation. This could lead to denial of service with no ad… |
CVE-2024-45420 | Medium | 4.3 | 2024-11-19 | Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access. |
CVE-2023-39180 | Medium | 4.0 | 2024-11-18 | A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module. The issue results from not releasing memory after its effective lifetime… |
CVE-2024-38828 | Medium | 5.3 | 2024-11-18 | Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack. |
CVE-2024-52520 | Medium | 5.7 | 2024-11-15 | Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigg… |
CVE-2023-20125 | High | 8.6 | 2024-11-15 | A vulnerability in the local interface of Cisco BroadWorks Network Server could allow an unauthenticated, remote attacker to exhaust system resources, causing… |
CVE-2024-48989 | High | 7.5 | 2024-11-13 | A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial of service, renderi… |
CVE-2024-9409 | High | 7.5 | 2024-11-13 | CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become unresponsive resulting in communication loss when a la… |
CVE-2024-47535 | Medium | 5.5 | 2024-11-12 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsaf… |
CVE-2024-46891 | Medium | 5.3 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly restrict the size of generated… |
CVE-2024-10345 | | 2024-11-11 | In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol Więsek. | |
CVE-2024-10344 | | 2024-11-11 | In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified. Reported by Karol Więsek. | |
CVE-2024-10314 | | 2024-11-11 | In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the auto-generation function was identified. Reported by Karol W… | |
CVE-2024-38826 | | 2024-11-11 | Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack aga… | |
CVE-2024-51513 | Medium | 5.5 | 2024-11-05 | Vulnerability of processes not being fully terminated in the VPN module Impact: Successful exploitation of this vulnerability will affect power consumption. |
CVE-2024-10599 | Medium | 5.3 | 2024-10-31 | A vulnerability, which was classified as problematic, has been found in Tongda OA 2017 up to 11.7. This issue affects some unknown processing of the file /inc/… |
CVE-2024-50354 | Medium | 5.5 | 2024-10-31 | gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys all… |
CVE-2024-31152 | Medium | 5.3 | 2024-10-30 | The LevelOne WBR-6012 router with firmware R0.40e6 is vulnerable to improper resource allocation within its web application, where a series of crafted HTTP req… |
CVE-2024-10466 | High | 7.5 | 2024-10-29 | By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability… |
CVE-2024-49767 | High | 7.5 | 2024-10-25 | Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werk… |
CVE-2024-20526 | Medium | 5.3 | 2024-10-23 | A vulnerability in the SSH server of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a denial of serv… |
CVE-2024-20351 | High | 8.6 | 2024-10-23 | A vulnerability in the TCP/IP traffic handling function of the Snort Detection Engine of Cisco Firepower Threat Defense (FTD) Software and Cisco FirePOWER Serv… |
CVE-2024-21536 | High | 7.5 | 2024-10-19 | Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRej… |
CVE-2024-21232 | Low | 2.2 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.4.2 and prior a… |
CVE-2024-21231 | Low | 3.1 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and p… |
CVE-2024-21230 | Medium | 6.5 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and… |
CVE-2024-21219 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior… |
CVE-2024-21218 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and… |
CVE-2024-21207 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38 and prior, 8.4.1 and prior and… |
CVE-2024-21204 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.4.0 and 9.0.1 and prior. Easily… |
CVE-2024-21203 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior… |
CVE-2024-21196 | Medium | 6.5 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and… |
CVE-2024-21194 | Medium | 4.9 | 2024-10-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and… |
CVE-2024-45736 | Medium | 6.5 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privil… |
CVE-2024-8184 | Medium | 5.9 | 2024-10-14 | There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service… |
CVE-2024-6762 | Low | 3.1 | 2024-10-14 | Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory. |
CVE-2024-9823 | Medium | 5.3 | 2024-10-14 | There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the s… |
CVE-2024-47497 | High | 7.5 | 2024-10-11 | An Uncontrolled Resource Consumption vulnerability in the http daemon (httpd) of Juniper Networks Junos OS on SRX Series, QFX Series, MX Series and EX Series a… |
CVE-2024-7294 | High | 7.5 | 2024-10-09 | In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), an HTTP DoS attack is possible on anonymous endpoints without rate limiting. |
CVE-2024-43575 | High | 7.5 | 2024-10-08 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2024-43545 | High | 7.5 | 2024-10-08 | Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability |
CVE-2024-43544 | High | 7.5 | 2024-10-08 | Microsoft Simple Certificate Enrollment Protocol Denial of Service Vulnerability |
CVE-2024-43541 | High | 7.5 | 2024-10-08 | Microsoft Simple Certificate Enrollment Protocol Denial of Service Vulnerability |
CVE-2024-43515 | High | 7.5 | 2024-10-08 | Internet Small Computer Systems Interface (iSCSI) Denial of Service Vulnerability |
CVE-2024-43506 | High | 7.5 | 2024-10-08 | BranchCache Denial of Service Vulnerability |
CVE-2024-38149 | High | 7.5 | 2024-10-08 | BranchCache Denial of Service Vulnerability |
CVE-2024-8626 | High | 7.5 | 2024-10-08 | Due to a memory leak, a denial-of-service vulnerability exists in the Rockwell Automation affected products. A malicious actor could exploit this vulnerability… |
CVE-2024-43789 | High | 7.5 | 2024-10-07 | Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them all at once. This can… |
CVE-2024-47850 | High | 7.5 | 2024-10-04 | CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer… |
CVE-2024-47554 | Medium | 4.3 | 2024-10-03 | Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resour… |
CVE-2024-20502 | Medium | 5.8 | 2024-10-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remo… |
CVE-2024-20500 | Medium | 5.8 | 2024-10-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remo… |
CVE-2024-9358 | Medium | 5.3 | 2024-10-01 | A vulnerability has been found in ThingsBoard up to 3.7.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the comp… |
CVE-2024-8454 | Medium | 5.3 | 2024-09-30 | The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have a Denial-of-Service vulnerability in the swctrl… |
CVE-2024-8451 | High | 7.5 | 2024-09-30 | Certain switch models from PLANET Technology have an SSH service that improperly handles insufficiently authenticated connection requests, allowing unauthorize… |
CVE-2024-38809 | Medium | 5.3 | 2024-09-27 | Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to th… |
CVE-2024-37125 | High | 7.5 | 2024-09-26 | Dell SmartFabric OS10 Software, versions 10.5.6.x, 10.5.5.x, 10.5.4.x,10.5.3.x, contains an Uncontrolled Resource Consumption vulnerability. A remote unauthent… |
CVE-2024-47003 | Low | 3.1 | 2024-09-26 | Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a… |