CWE-400 · Uncontrolled Resource Consumption (page 20)
Page 20 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-29735 | Medium | 5.5 | 2023-05-30 | An issue found in edjing Mix v.7.09.01 for Android allows a local attacker to cause a denial of service via the database files. |
CVE-2023-30570 | High | 7.5 | 2023-05-29 | pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The e… |
CVE-2023-28320 | Medium | 5.9 | 2023-05-26 | A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build tim… |
CVE-2023-1981 | Medium | 5.5 | 2023-05-26 | A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash. |
CVE-2023-20883 | High | 7.5 | 2023-05-26 | In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-servic… |
CVE-2023-20882 | Medium | 5.9 | 2023-05-26 | In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hoste… |
CVE-2023-33720 | Medium | 6.5 | 2023-05-26 | mp4v2 v2.1.2 was discovered to contain a memory leak via the class MP4BytesProperty. |
CVE-2022-39374 | Medium | 6.5 | 2023-05-26 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the s… |
CVE-2023-32067 | High | 7.5 | 2023-05-25 | c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP… |
CVE-2023-2798 | High | 7.5 | 2023-05-25 | Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an a… |
CVE-2023-33980 | High | 7.5 | 2023-05-24 | Bramble Synchronisation Protocol (BSP) in Briar before 1.4.22 allows attackers to cause a denial of service (repeated application crashes) via a series of long… |
CVE-2023-26595 | Medium | 6.5 | 2023-05-23 | Denial-of-service (DoS) vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote authenticated attacker to cause a denial of service condition. |
CVE-2023-33297 | High | 7.5 | 2023-05-22 | Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-… |
CVE-2022-36326 | Medium | 4.4 | 2023-05-18 | An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventua… |
CVE-2023-2295 | High | 7.5 | 2023-05-17 | A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto a… |
CVE-2023-26044 | Medium | 5.3 | 2023-05-17 | react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. Previous versions of ReactPHP's HTTP server component contain a p… |
CVE-2023-21110 | High | 7.8 | 2023-05-15 | In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion. This could lead to local escalatio… |
CVE-2023-20930 | Medium | 5.5 | 2023-05-15 | In pushDynamicShortcut of ShortcutPackage.java, there is a possible way to get the device into a boot loop due to resource exhaustion. This could lead to local… |
CVE-2023-32787 | High | 7.5 | 2023-05-15 | The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no l… |
CVE-2023-31409 | Medium | 5.3 | 2023-05-15 | Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote… |
CVE-2023-23447 | High | 7.5 | 2023-05-15 | Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivi… |
CVE-2023-28356 | High | 7.5 | 2023-05-11 | A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enter a hot loop on one… |
CVE-2022-36329 | Medium | 4.4 | 2023-05-10 | An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cl… |
CVE-2023-25568 | High | 8.2 | 2023-05-10 | Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able alloca… |
CVE-2023-25179 | Medium | 5.0 | 2023-05-10 | Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authenticated user to potentially enable denial o… |
CVE-2022-46645 | Medium | 5.0 | 2023-05-10 | Uncontrolled resource consumption in the Intel(R) Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable den… |
CVE-2022-41801 | Medium | 5.0 | 2023-05-10 | Uncontrolled resource consumption in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated user to potentially enable denia… |
CVE-2022-4008 | Medium | 5.5 | 2023-05-10 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service |
CVE-2023-29333 | Low | 3.3 | 2023-05-09 | Microsoft Access Denial of Service Vulnerability |
CVE-2023-22874 | Medium | 5.5 | 2023-05-05 | IBM MQ Clients 9.2 CD, 9.3 CD, and 9.3 LTS are vulnerable to a denial of service attack when processing configuration files. IBM X-Force ID: 244216. |
CVE-2023-24594 | Medium | 5.3 | 2023-05-03 | When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization. Note: Soft… |
CVE-2023-28882 | High | 7.5 | 2023-04-28 | Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in t… |
CVE-2023-30408 | Medium | 5.5 | 2023-04-24 | Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry. |
CVE-2023-30406 | Medium | 5.5 | 2023-04-24 | Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c. |
CVE-2023-29479 | Medium | 5.3 | 2023-04-24 | Ribose RNP before 0.16.3 may hang when the input is malformed. |
CVE-2023-30798 | High | 7.5 | 2023-04-21 | There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number o… |
CVE-2023-27652 | Medium | 5.5 | 2023-04-20 | An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _d… |
CVE-2022-24109 | Medium | 6.5 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. To attack an intent installed by a normal user, a remote attacker can install a duplicate intent with a different key, a… |
CVE-2022-24035 | High | 7.5 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. The purge-requested intent remains on the list, but it does not respond to changes in topology (e.g., link failure). In… |
CVE-2023-0384 | Medium | 6.5 | 2023-04-20 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption for a scheduled… |
CVE-2023-0383 | High | 7.5 | 2023-04-20 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption. |
CVE-2023-21090 | Medium | 5.0 | 2023-04-19 | In parseUsesPermission of ParsingPackageUtils.java, there is a possible boot loop due to resource exhaustion. This could lead to local denial of service with n… |
CVE-2023-28440 | Low | 2.7 | 2023-04-18 | Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a… |
CVE-2023-26048 | Medium | 5.3 | 2023-04-18 | Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `H… |
CVE-2023-21996 | High | 7.5 | 2023-04-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.3.0… |
CVE-2023-21964 | High | 7.5 | 2023-04-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2023-21925 | Medium | 5.3 | 2023-04-18 | Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Supported versions that are affected are… |
CVE-2023-30769 | Critical | 9.1 | 2023-04-17 | Vulnerability discovered is related to the peer-to-peer (p2p) communications, attackers can craft consensus messages, send it to individual nodes and take them… |
CVE-2022-40946 | High | 7.5 | 2023-04-16 | On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a Denial of Service via the sys_token parameter in a cgi-bin/web… |
CVE-2021-39295 | High | 7.5 | 2023-04-15 | In OpenBMC 2.9, crafted IPMI messages allow an attacker to cause a denial of service to the BMC via the netipmid (IPMI lan+) interface. |
CVE-2023-29013 | High | 7.5 | 2023-04-14 | Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP… |
CVE-2023-27643 | High | 7.5 | 2023-04-14 | An issue found in POWERAMP 925-bundle-play and Poweramp 954-uni allows a remote attacker to cause a denial of service via the Rescan button in Queue and Select… |
CVE-2023-30635 | High | 7.5 | 2023-04-13 | TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error) upon an attempt to get a timestamp from the Placement Driver. |
CVE-2023-20863 | Medium | 6.5 | 2023-04-13 | In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may c… |
CVE-2023-1994 | Medium | 6.3 | 2023-04-12 | GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file |
CVE-2023-24545 | High | 7.5 | 2023-04-12 | On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malf… |
CVE-2023-1992 | Medium | 6.3 | 2023-04-12 | RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file |
CVE-2023-28217 | High | 7.5 | 2023-04-11 | Windows Network Address Translation (NAT) Denial of Service Vulnerability |
CVE-2023-24860 | High | 7.5 | 2023-04-11 | Microsoft Defender Denial of Service Vulnerability |
CVE-2023-29185 | Medium | 5.3 | 2023-04-11 | SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated… |
CVE-2023-28763 | Medium | 6.5 | 2023-04-11 | SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a non-administrati… |
CVE-2023-27191 | High | 7.5 | 2023-04-11 | An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files. |
CVE-2023-24534 | High | 7.5 | 2023-04-06 | HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual… |
CVE-2023-1787 | Medium | 4.3 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A search timeo… |
CVE-2023-1071 | Low | 3.1 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting fro… |
CVE-2023-1733 | Medium | 5.8 | 2023-04-05 | A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.1… |
CVE-2023-28342 | High | 7.5 | 2023-04-05 | Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API. |
CVE-2023-20051 | Medium | 5.8 | 2023-04-05 | A vulnerability in the Vector Packet Processor (VPP) of Cisco Packet Data Network Gateway (PGW) could allow an unauthenticated, remote attacker to stop ICMP tr… |
CVE-2023-0382 | Medium | 6.5 | 2023-04-05 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption. |
CVE-2023-27734 | Medium | 5.5 | 2023-04-04 | An issue found in Eteran edb-debugger v.1.3.0 allows a local attacker to causea denial of service via the collect_symbols function in plugins/BinaryInfo/symbol… |
CVE-2023-26437 | Low | 3.4 | 2023-04-04 | Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through… |
CVE-2020-19850 | Medium | 6.5 | 2023-04-04 | An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests. |
CVE-2023-28837 | Medium | 4.9 | 2023-04-03 | Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of… |
CVE-2023-1580 | High | 7.5 | 2023-04-02 | Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and earlier allows an attacker to cause a denial of service by filling… |
CVE-2023-26485 | Medium | 5.3 | 2023-03-31 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to u… |
CVE-2023-24824 | Medium | 5.3 | 2023-03-31 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to u… |
CVE-2022-4899 | High | 7.5 | 2023-03-31 | A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun. |
CVE-2023-29139 | Medium | 6.5 | 2023-03-31 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. When a user with checkuserlog permissions makes many CheckUserLog API requests… |
CVE-2023-28846 | Medium | 5.9 | 2023-03-30 | Unpoly is a JavaScript framework for server-side web applications. There is a possible Denial of Service (DoS) vulnerability in the `unpoly-rails` gem that imp… |
CVE-2023-28644 | Medium | 5.7 | 2023-03-30 | Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server p… |
CVE-2023-28507 | Critical | 9.8 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a memory-exhaustio… |
CVE-2023-28626 | Medium | 5.3 | 2023-03-28 | comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be u… |
CVE-2022-48351 | High | 7.5 | 2023-03-27 | The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect availability. |
CVE-2023-1654 | High | 7.8 | 2023-03-27 | Denial of Service in GitHub repository gpac/gpac prior to 2.4.0. |
CVE-2023-21061 | High | 7.5 | 2023-03-24 | Product: AndroidVersions: Android kernelAndroid ID: A-229255400References: N/A |
CVE-2023-21033 | Medium | 5.5 | 2023-03-24 | In addNetwork of WifiManager.java, there is a possible way to trigger a persistent DoS due to resource exhaustion. This could lead to local denial of service w… |
CVE-2023-20911 | High | 7.8 | 2023-03-24 | In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due to resource exhaustion. This could lead… |
CVE-2023-20910 | Medium | 5.5 | 2023-03-24 | In add of WifiNetworkSuggestionsManager.java, there is a possible way to trigger permanent DoS due to resource exhaustion. This could lead to local denial of s… |
CVE-2023-20861 | Medium | 6.5 | 2023-03-23 | In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provid… |
CVE-2023-0056 | Medium | 6.5 | 2023-03-23 | An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote atta… |
CVE-2023-1605 | High | 7.5 | 2023-03-23 | Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6. |
CVE-2022-45003 | High | 7.5 | 2023-03-22 | Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus. |
CVE-2023-24862 | Medium | 5.5 | 2023-03-14 | Windows Secure Channel Denial of Service Vulnerability |
CVE-2023-23411 | Medium | 6.5 | 2023-03-14 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2023-23396 | Medium | 6.5 | 2023-03-14 | Microsoft Excel Denial of Service Vulnerability |
CVE-2023-27270 | Medium | 6.5 | 2023-03-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulne… |
CVE-2023-25618 | Medium | 6.5 | 2023-03-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulne… |
CVE-2023-27530 | High | 7.5 | 2023-03-10 | A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to… |
CVE-2023-1072 | Medium | 4.3 | 2023-03-09 | An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions star… |
CVE-2023-27484 | Medium | 6.2 | 2023-03-09 | crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions an already highly p… |