CWE-400 · Uncontrolled Resource Consumption (page 19)
Page 19 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40591 | High | 7.5 | 2023-09-06 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory w… |
CVE-2023-28188 | Medium | 6.5 | 2023-09-06 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. A remote user may be able to cause a denial-… |
CVE-2023-4162 | Medium | 4.4 | 2023-08-31 | A segmentation fault can occur in Brocade Fabric OS after Brocade Fabric OS v9.0 and before Brocade Fabric OS v9.2.0a through the passwdcfg command. This c… |
CVE-2023-40594 | Medium | 6.5 | 2023-08-30 | In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against t… |
CVE-2023-40593 | Medium | 6.3 | 2023-08-30 | In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/sa… |
CVE-2023-41121 | High | 7.5 | 2023-08-25 | Array AG OS before 9.4.0.499 allows denial of service: remote attackers can cause system service processes to crash through abnormal HTTP operations. |
CVE-2023-40586 | High | 7.5 | 2023-08-25 | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed a… |
CVE-2023-40583 | High | 7.5 | 2023-08-25 | libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer… |
CVE-2023-41173 | High | 7.5 | 2023-08-25 | AdGuard DNS before 2.2 allows remote attackers to cause a denial of service via malformed UDP packets. |
CVE-2023-4418 | High | 7.5 | 2023-08-24 | A remote unprivileged attacker can sent multiple packages to the LMS5xx to disrupt its availability through a TCP SYN-based denial-of-service (DDoS) attack. B… |
CVE-2023-40710 | Medium | 6.8 | 2023-08-24 | An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web… |
CVE-2023-40709 | Medium | 6.8 | 2023-08-24 | An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have… |
CVE-2023-37379 | High | 8.1 | 2023-08-23 | Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privile… |
CVE-2022-48571 | High | 7.5 | 2023-08-22 | memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP. |
CVE-2022-48564 | Medium | 6.5 | 2023-08-22 | read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property Li… |
CVE-2022-48063 | Medium | 5.5 | 2023-08-22 | GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The at… |
CVE-2022-47696 | High | 7.8 | 2023-08-22 | An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols. |
CVE-2022-47695 | High | 7.8 | 2023-08-22 | An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_s… |
CVE-2022-37050 | Medium | 6.5 | 2023-08-22 | In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in… |
CVE-2020-26652 | High | 7.5 | 2023-08-22 | An issue was discovered in function nl80211_send_chandef in rtl8812au v5.6.4.2 allows attackers to cause a denial of service. |
CVE-2020-20813 | High | 7.5 | 2023-08-22 | Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet. |
CVE-2020-19726 | High | 8.8 | 2023-08-22 | An issue was discovered in binutils libbfd.c 2.36 relating to the auxiliary symbol data allows attackers to read or write to system memory or cause a denial of… |
CVE-2020-18770 | Medium | 5.5 | 2023-08-22 | An issue was discovered in function zzip_disk_entry_to_file_header in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service. |
CVE-2023-39748 | High | 7.5 | 2023-08-21 | An issue in the component /userRpm/NetworkCfgRpm of TP-Link TL-WR1041N V2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request. |
CVE-2023-4394 | Medium | 6.7 | 2023-08-17 | A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volumes.c in btrfs file-system in the Linux Kernel. This flaw allows a local attack… |
CVE-2023-38737 | Medium | 5.9 | 2023-08-16 | IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remo… |
CVE-2023-21280 | Medium | 5.5 | 2023-08-14 | In setMediaButtonBroadcastReceiver of MediaSessionRecord.java, there is a possible permanent DoS due to resource exhaustion. This could lead to local denial of… |
CVE-2023-38741 | High | 7.5 | 2023-08-14 | IBM TXSeries for Multiplatforms 8.1, 8.2, and 9.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read opera… |
CVE-2021-29057 | Medium | 6.5 | 2023-08-11 | An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service. |
CVE-2023-28938 | Low | 3.4 | 2023-08-11 | Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of… |
CVE-2023-38210 | Medium | 5.5 | 2023-08-10 | Adobe XMP Toolkit versions 2022.06 is affected by a Uncontrolled Resource Consumption vulnerability. An unauthenticated attacker could leverage this vulnerabil… |
CVE-2023-38180 | High | 7.5 | 2023-08-08 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2023-38178 | High | 7.5 | 2023-08-08 | .NET Core and Visual Studio Denial of Service Vulnerability |
CVE-2023-29409 | Medium | 5.3 | 2023-08-02 | Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys tr… |
CVE-2023-3825 | High | 7.5 | 2023-07-31 | PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption… |
CVE-2023-34872 | Medium | 5.5 | 2023-07-31 | A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in Outlin… |
CVE-2023-38498 | Medium | 4.3 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-37900 | Low | 3.4 | 2023-07-27 | Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privi… |
CVE-2023-3637 | Medium | 4.3 | 2023-07-25 | An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for a… |
CVE-2023-38200 | High | 7.5 | 2023-07-24 | A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This fla… |
CVE-2023-3782 | Medium | 5.9 | 2023-07-19 | DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb… |
CVE-2023-37143 | Medium | 5.5 | 2023-07-18 | ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function BackwardPass::IsEmptyLoopAfterMemOp(). |
CVE-2023-37142 | Medium | 5.5 | 2023-07-18 | ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::HasInlinees(). |
CVE-2023-37141 | Medium | 5.5 | 2023-07-18 | ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray(). |
CVE-2023-37140 | Medium | 5.5 | 2023-07-18 | ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::DiagScopeVariablesWalker::GetChildrenCount(). |
CVE-2023-37788 | High | 7.5 | 2023-07-18 | goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors. |
CVE-2023-37481 | Low | 2.7 | 2023-07-18 | Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of… |
CVE-2023-37480 | Low | 2.7 | 2023-07-18 | Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of… |
CVE-2023-2263 | High | 7.5 | 2023-07-18 | The Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A is vulnerable to CIP fuzzing. The new ENIP connections cannot be established if impacted by… |
CVE-2022-30858 | Medium | 6.5 | 2023-07-17 | An issue was discovered in ngiflib 0.4. There is SEGV in SDL_LoadAnimatedGif when use SDLaffgif. poc : ./SDLaffgif CA_file2_0 |
CVE-2023-37475 | High | 7.5 | 2023-07-17 | Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's `github.com… |
CVE-2023-3614 | Medium | 4.3 | 2023-07-17 | Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsiv… |
CVE-2023-3593 | Medium | 4.3 | 2023-07-17 | Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input. |
CVE-2023-3585 | Medium | 4.3 | 2023-07-17 | Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link. |
CVE-2022-4952 | Low | 3.5 | 2023-07-17 | A vulnerability has been found in OmniSharp csharp-language-server-protocol up to 0.19.6 and classified as problematic. This vulnerability affects the function… |
CVE-2023-36818 | Medium | 6.5 | 2023-07-14 | Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This… |
CVE-2023-35945 | High | 7.5 | 2023-07-13 | Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_S… |
CVE-2023-37463 | Medium | 6.4 | 2023-07-13 | cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time… |
CVE-2023-34458 | High | 7.1 | 2023-07-13 | mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transac… |
CVE-2023-26597 | High | 7.5 | 2023-07-13 | Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recomm… |
CVE-2023-29449 | Medium | 5.9 | 2023-07-13 | JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configu… |
CVE-2023-21240 | Medium | 5.5 | 2023-07-13 | In Policy of Policy.java, there is a possible boot loop due to resource exhaustion. This could lead to local denial of service with no additional execution pri… |
CVE-2020-20021 | High | 7.5 | 2023-07-12 | An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon. |
CVE-2023-35339 | High | 7.5 | 2023-07-11 | Windows CryptoAPI Denial of Service Vulnerability |
CVE-2023-35329 | Medium | 6.5 | 2023-07-11 | Windows Authentication Denial of Service Vulnerability |
CVE-2023-35298 | High | 7.5 | 2023-07-11 | HTTP.sys Denial of Service Vulnerability |
CVE-2023-3108 | Medium | 6.2 | 2023-07-11 | A flaw was found in the subsequent get_user_pages_fast in the Linux kernel’s interface for symmetric key cipher algorithms in the skcipher_recvmsg of crypto/al… |
CVE-2023-35921 | High | 7.5 | 2023-07-11 | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4… |
CVE-2023-35920 | High | 7.5 | 2023-07-11 | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4… |
CVE-2023-26509 | High | 7.5 | 2023-07-03 | AnyDesk 7.0.8 allows remote Denial of Service. |
CVE-2023-1206 | Medium | 5.7 | 2023-06-30 | A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack… |
CVE-2023-21176 | Medium | 4.4 | 2023-06-28 | In list_key_entries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local denial of service wit… |
CVE-2023-3398 | High | 7.5 | 2023-06-26 | Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3. |
CVE-2023-35925 | Medium | 6.2 | 2023-06-23 | FastAsyncWorldEdit (FAWE) is designed for efficient world editing. This vulnerability enables the attacker to select a region with the `Infinity` keyword (case… |
CVE-2023-33141 | High | 7.5 | 2023-06-23 | Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability |
CVE-2023-34462 | Medium | 6.5 | 2023-06-22 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `Sni… |
CVE-2023-2990 | High | 7.5 | 2023-06-22 | Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause… |
CVE-2023-26434 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 serv… |
CVE-2023-26433 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue IMAP serv… |
CVE-2023-26432 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP serv… |
CVE-2023-34166 | High | 7.5 | 2023-06-19 | Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the system to restart. |
CVE-2023-2831 | Medium | 4.3 | 2023-06-16 | Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a la… |
CVE-2023-2793 | Medium | 6.5 | 2023-06-16 | Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by… |
CVE-2023-2785 | Medium | 4.3 | 2023-06-16 | Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files wh… |
CVE-2023-2683 | Medium | 5.3 | 2023-06-15 | A memory leak in the EFR32 Bluetooth LE stack 5.1.0 through 5.1.1 allows an attacker to send an invalid pairing message and cause future legitimate connection… |
CVE-2023-32229 | Medium | 4.9 | 2023-06-15 | Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when en… |
CVE-2022-33168 | High | 7.5 | 2023-06-15 | IBM Security Directory Suite VA 8.0.1 could allow an attacker to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 228588. |
CVE-2023-29331 | High | 7.5 | 2023-06-14 | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
CVE-2023-32013 | Medium | 5.3 | 2023-06-14 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2023-2778 | High | 7.5 | 2023-06-13 | A denial-of-service vulnerability exists in Rockwell Automation FactoryTalk Transaction Manager. This vulnerability can be exploited by sending a modified pac… |
CVE-2023-35053 | High | 7.5 | 2023-06-12 | In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms |
CVE-2023-29767 | Medium | 5.5 | 2023-06-09 | An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files. |
CVE-2023-3163 | Low | 3.5 | 2023-06-08 | A vulnerability was found in y_project RuoYi up to 4.7.7. It has been classified as problematic. Affected is the function filterKeyword. The manipulation of th… |
CVE-2023-34109 | Medium | 6.5 | 2023-06-07 | zxcvbn-ts is an open source password strength estimator written in typescript. This vulnerability affects users running on the nodeJS platform which are using… |
CVE-2023-33958 | Medium | 5.4 | 2023-06-06 | notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures… |
CVE-2023-33957 | Low | 2.6 | 2023-06-06 | notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures… |
CVE-2023-34104 | High | 7.5 | 2023-06-06 | fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. S… |
CVE-2022-33303 | Medium | 5.5 | 2023-06-06 | Transient DOS due to uncontrolled resource consumption in Linux kernel when malformed messages are sent from the Gunyah Resource Manager message queue. |
CVE-2023-29544 | Medium | 6.5 | 2023-06-02 | If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploi… |
CVE-2023-0616 | Medium | 6.5 | 2023-06-02 | If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause T… |