CWE-400 · Uncontrolled Resource Consumption (page 18)
Page 18 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25949 | Medium | 5.5 | 2023-11-14 | Uncontrolled resource consumption in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable denial of serv… |
CVE-2023-36042 | Medium | 6.2 | 2023-11-14 | Visual Studio Denial of Service Vulnerability |
CVE-2023-44321 | Low | 2.7 | 2023-11-14 | Affected devices do not properly validate the length of inputs when performing certain configuration changes in the web interface allowing an authenticated att… |
CVE-2023-42813 | Medium | 6.1 | 2023-11-13 | Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. T… |
CVE-2023-45167 | Medium | 6.2 | 2023-11-10 | IBM AIX's 7.3 Python implementation could allow a non-privileged local user to exploit a vulnerability to cause a denial of service. IBM X-Force ID: 267965. |
CVE-2023-5759 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified. Reported by Jason Geffner. |
CVE-2023-45319 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was identified. Reported by Jason Geffner. |
CVE-2023-35767 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Jason Geffner… |
CVE-2023-46737 | Low | 3.1 | 2023-11-07 | Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls… |
CVE-2023-5969 | Medium | 5.3 | 2023-11-06 | Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_lo… |
CVE-2023-41378 | High | 7.5 | 2023-11-06 | In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake… |
CVE-2023-42669 | Medium | 6.5 | 2023-11-06 | A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability ste… |
CVE-2023-42670 | Medium | 6.5 | 2023-11-03 | A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC se… |
CVE-2023-29046 | Medium | 4.3 | 2023-11-02 | Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Som… |
CVE-2023-5876 | Low | 3.1 | 2023-11-02 | Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Servic… |
CVE-2023-20155 | High | 7.5 | 2023-11-01 | A vulnerability in a logging API in Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to cause the device to bec… |
CVE-2023-5625 | Medium | 5.3 | 2023-11-01 | A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419… |
CVE-2023-46278 | Medium | 6.5 | 2023-11-01 | Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.1.0 to 4.1.1 allows a remote authenticated attacker to consume huge storage space or… |
CVE-2023-39610 | Medium | 6.5 | 2023-10-31 | An issue in TP-Link Tapo C100 v1.1.15 Build 211130 Rel.15378n(4555) and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted web… |
CVE-2023-45955 | High | 7.5 | 2023-10-31 | An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commands. |
CVE-2023-46361 | Medium | 6.5 | 2023-10-31 | Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c. |
CVE-2023-45956 | High | 7.5 | 2023-10-30 | An issue discovered in Govee LED Strip v3.00.42 allows attackers to cause a denial of service via crafted Move and MoveWithOnoff commands. |
CVE-2023-21339 | High | 7.5 | 2023-10-30 | In Minikin, there is a possible way to trigger ANR by showing a malicious message due to resource exhaustion. This could lead to remote denial of service with… |
CVE-2023-31418 | High | 7.5 | 2023-10-26 | An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to e… |
CVE-2023-40408 | Medium | 5.3 | 2023-10-25 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadO… |
CVE-2023-5724 | High | 7.5 | 2023-10-25 | Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. This vulnerability affects Firefox < 119… |
CVE-2023-46136 | High | 8.0 | 2023-10-25 | Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a… |
CVE-2023-46120 | Medium | 4.9 | 2023-10-25 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when recei… |
CVE-2023-46118 | Medium | 4.9 | 2023-10-25 | RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (D… |
CVE-2023-42031 | Medium | 4.9 | 2023-10-25 | IBM TXSeries for Multiplatforms, 8.1, 8.2, and 9.1, CICS TX Standard CICS TX Advanced 10.1 and 11.1 could allow a privileged user to cause a denial of service… |
CVE-2023-39219 | High | 7.5 | 2023-10-25 | PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests |
CVE-2022-3698 | Medium | 4.4 | 2023-10-25 | A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics versions prior to 4.45 … |
CVE-2022-0353 | Medium | 4.4 | 2023-10-25 | A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics versions prior to 4.45 … |
CVE-2023-43622 | High | 7.5 | 2023-10-23 | An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. Th… |
CVE-2023-45810 | Medium | 5.3 | 2023-10-17 | OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a de… |
CVE-2023-5522 | Medium | 4.3 | 2023-10-17 | Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and… |
CVE-2022-43893 | Low | 2.7 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a privileged user to cause by using a malicious payload. IBM X-Force ID: 240634. |
CVE-2023-44388 | High | 7.5 | 2023-10-16 | Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the ser… |
CVE-2023-45150 | Medium | 4.3 | 2023-10-16 | Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any len… |
CVE-2023-40180 | High | 7.5 | 2023-10-16 | silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Dist… |
CVE-2023-5595 | Medium | 5.5 | 2023-10-16 | Denial of Service in GitHub repository gpac/gpac prior to 2.3.0-DEV. |
CVE-2022-43740 | High | 7.5 | 2023-10-14 | IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 238… |
CVE-2023-38251 | Medium | 5.3 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Res… |
CVE-2023-36841 | High | 7.5 | 2023-10-12 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows a… |
CVE-2023-27314 | High | 7.5 | 2023-10-12 | ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote unauthenti… |
CVE-2023-25774 | High | 7.5 | 2023-10-12 | A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02. A set of specially crafted network connection… |
CVE-2023-36703 | High | 7.5 | 2023-10-10 | DHCP Server Service Denial of Service Vulnerability |
CVE-2023-36606 | High | 7.5 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2023-36579 | High | 7.5 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2023-36435 | High | 7.5 | 2023-10-10 | Microsoft QUIC Denial of Service Vulnerability |
CVE-2023-36431 | High | 7.5 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2023-36478 | High | 7.5 | 2023-10-10 | Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer ove… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2023-43786 | Medium | 5.5 | 2023-10-10 | A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system re… |
CVE-2023-37195 | Medium | 4.4 | 2023-10-10 | A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All ver… |
CVE-2023-5333 | Medium | 4.3 | 2023-10-09 | Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sending a specia… |
CVE-2023-5330 | Medium | 4.3 | 2023-10-09 | Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4… |
CVE-2023-21253 | Medium | 5.5 | 2023-10-06 | In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion. This could lead to local denial of service with no… |
CVE-2023-43810 | High | 7.5 | 2023-10-06 | OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting t… |
CVE-2023-20259 | High | 8.6 | 2023-10-04 | A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilizat… |
CVE-2023-3153 | Medium | 5.3 | 2023-10-04 | A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of se… |
CVE-2023-33026 | High | 7.5 | 2023-10-03 | Transient DOS in WLAN Firmware while parsing a NAN management frame. |
CVE-2023-26151 | Medium | 5.3 | 2023-10-03 | Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the… |
CVE-2023-5196 | Medium | 6.5 | 2023-09-29 | Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notification_prop result… |
CVE-2023-20268 | Medium | 4.7 | 2023-09-27 | A vulnerability in the packet processing functionality of Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to exhaust resourc… |
CVE-2023-20176 | Medium | 5.8 | 2023-09-27 | A vulnerability in the networking component of Cisco access point (AP) software could allow an unauthenticated, remote attacker to cause a temporary disruption… |
CVE-2023-5157 | High | 7.5 | 2023-09-27 | A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service. |
CVE-2023-43775 | Medium | 4.7 | 2023-09-27 | Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of the automation platf… |
CVE-2023-43646 | High | 8.6 | 2023-09-27 | get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regu… |
CVE-2023-41310 | Low | 3.3 | 2023-09-27 | Keep-alive vulnerability in the sticky broadcast mechanism. Successful exploitation of this vulnerability may cause malicious apps to run continuously in the b… |
CVE-2023-40441 | Medium | 6.5 | 2023-09-27 | A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content… |
CVE-2023-41294 | Critical | 9.8 | 2023-09-25 | The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services. |
CVE-2023-43771 | Medium | 5.5 | 2023-09-22 | In nqptp-message-handlers.c in nqptp before 1.2.3, crafted packets received on the control port could crash the program. |
CVE-2023-43767 | High | 7.5 | 2023-09-22 | Certain WithSecure products allow Denial of Service via the aepack archive unpack handler. This affects WithSecure Client Security 15, WithSecure Server Securi… |
CVE-2023-42457 | High | 7.5 | 2023-09-21 | plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when… |
CVE-2023-26144 | Medium | 5.3 | 2023-09-20 | Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanB… |
CVE-2020-24089 | Medium | 5.5 | 2023-09-20 | An issue was discovered in ImfHpRegFilter.sys in IOBit Malware Fighter version 8.0.2, allows local attackers to cause a denial of service (DoS). |
CVE-2022-47556 | Medium | 6.5 | 2023-09-19 | Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a… |
CVE-2023-42523 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via unpacking of a PE file. This affects WithSecure Client Security 15, WithSecure Server… |
CVE-2023-42522 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. This affects WithSecure Client Security… |
CVE-2023-42521 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via processing of a compressed file. This affects WithSecure Client Security 15, WithSecu… |
CVE-2023-42526 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via decompression of crafted data files. This affects WithSecure Client Security 15, With… |
CVE-2023-42520 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via unpacking of crafted data files. This affects WithSecure Client Security 15, WithSecu… |
CVE-2023-37263 | Medium | 6.8 | 2023-09-15 | Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title… |
CVE-2023-32665 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leadin… |
CVE-2023-32636 | Medium | 4.7 | 2023-09-14 | A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resol… |
CVE-2023-32611 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial… |
CVE-2023-29499 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service. |
CVE-2023-42503 | Medium | 5.5 | 2023-09-14 | Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress… |
CVE-2023-26141 | High | 7.5 | 2023-09-14 | Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker… |
CVE-2023-38162 | High | 7.5 | 2023-09-12 | DHCP Server Service Denial of Service Vulnerability |
CVE-2023-38149 | High | 7.5 | 2023-09-12 | Windows TCP/IP Denial of Service Vulnerability |
CVE-2023-36799 | Medium | 6.5 | 2023-09-12 | .NET Core and Visual Studio Denial of Service Vulnerability |
CVE-2022-4896 | High | 8.2 | 2023-09-12 | Cyber Control, in its 1.650 version, is affected by a vulnerability in the generation on the server of pop-up windows with the messages "PNTMEDIDAS", "PEDIR"… |
CVE-2022-48475 | High | 8.2 | 2023-09-12 | Buffer Overflow vulnerability in Control de Ciber version 1.650, in the printing function. Sending a modified request by the attacker could cause a Buffer Over… |
CVE-2022-48474 | High | 8.2 | 2023-09-12 | Control de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the version function. Sending a malicious request could cause the… |
CVE-2022-23382 | High | 8.1 | 2023-09-11 | Shenzhen Hichip Vision Technology IP Camera Firmware V11.4.8.1.1-20170926 has a denial of service vulnerability through sending a crafted multicast message in… |
CVE-2023-36161 | High | 7.5 | 2023-09-11 | An issue was discovered in Qubo Smart Plug 10A version HSP02_01_01_14_SYSTEM-10A, allows attackers to cause a denial of service (DoS) via Wi-Fi deauthenticatio… |
CVE-2023-39321 | High | 7.5 | 2023-09-08 | Processing an incomplete post-handshake message for a QUIC connection can cause a panic. |
CVE-2023-40584 | Medium | 6.5 | 2023-09-07 | Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is v… |