CWE-400 · Uncontrolled Resource Consumption (page 21)
Page 21 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-27483 | Medium | 5.9 | 2023-03-09 | crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has… |
CVE-2022-41333 | High | 7.5 | 2023-03-07 | An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allo… |
CVE-2022-3277 | Medium | 6.5 | 2023-03-06 | An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for a… |
CVE-2023-26601 | High | 7.5 | 2023-03-06 | Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow De… |
CVE-2021-36395 | High | 7.5 | 2023-03-06 | In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. |
CVE-2023-27567 | High | 7.5 | 2023-03-03 | In OpenBSD 7.2, a TCP packet with destination port 0 that matches a pf divert-to rule can crash the kernel. |
CVE-2023-26470 | Medium | 5.7 | 2023-03-02 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusable by adding an o… |
CVE-2022-38734 | High | 7.5 | 2023-03-02 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0.8 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploit could l… |
CVE-2023-20014 | High | 7.5 | 2023-03-01 | A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) c… |
CVE-2022-41724 | High | 7.5 | 2023-02-28 | Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respecti… |
CVE-2023-23689 | Medium | 5.3 | 2023-02-28 | Dell PowerScale nodes A200, A2000, H400, H500, H600, H5600, F800, F810 integrated hardware management software contains an uncontrolled resource consumption v… |
CVE-2022-20455 | Medium | 5.5 | 2023-02-28 | In addAutomaticZenRule of ZenModeHelper.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of s… |
CVE-2023-23524 | High | 7.5 | 2023-02-27 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in tvOS 16.3.2, iOS 16.3.1 and iPadOS 16.3.1, watchOS 9.3.1, macOS… |
CVE-2023-26104 | High | 7.5 | 2023-02-25 | All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters th… |
CVE-2023-25816 | Medium | 4.3 | 2023-02-25 | Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can co… |
CVE-2023-23296 | Medium | 6.5 | 2023-02-23 | Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault. |
CVE-2023-23009 | Medium | 6.5 | 2023-02-21 | Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length. |
CVE-2023-0662 | High | 7.5 | 2023-02-16 | In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and e… |
CVE-2023-24580 | High | 7.5 | 2023-02-15 | An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an… |
CVE-2023-0518 | Medium | 4.3 | 2023-02-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versio… |
CVE-2022-3759 | Medium | 4.3 | 2023-02-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versio… |
CVE-2022-3411 | Medium | 6.5 | 2023-02-13 | A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated… |
CVE-2022-47370 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services. |
CVE-2022-47356 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47355 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47354 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-40513 | High | 7.5 | 2023-02-12 | Transient DOS due to uncontrolled resource consumption in WLAN firmware when peer is freed in non qos state. |
CVE-2022-38674 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services. |
CVE-2023-23631 | Medium | 5.9 | 2023-02-09 | github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 tr… |
CVE-2023-23625 | Medium | 5.9 | 2023-02-09 | go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and vi… |
CVE-2023-22799 | High | 7.5 | 2023-02-09 | A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engin… |
CVE-2023-22796 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the… |
CVE-2023-22795 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Mat… |
CVE-2023-22792 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially cr… |
CVE-2022-44572 | High | 7.5 | 2023-02-09 | A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft inp… |
CVE-2022-44571 | High | 7.5 | 2023-02-09 | There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an… |
CVE-2022-44570 | High | 7.5 | 2023-02-09 | A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing componen… |
CVE-2022-44566 | High | 7.5 | 2023-02-09 | A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer… |
CVE-2023-25151 | High | 7.5 | 2023-02-08 | opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelh… |
CVE-2022-40480 | Medium | 6.5 | 2023-02-08 | Nordic Semiconductor, Microchip Technology NRF5340-DK DT100112 was discovered to contain an issue which allows attackers to cause a Denial of Service (DoS) via… |
CVE-2022-42950 | Medium | 4.9 | 2023-02-06 | An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase… |
CVE-2023-23925 | High | 8.6 | 2023-02-03 | Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation (EXIST)… |
CVE-2023-24574 | High | 7.5 | 2023-02-02 | Dell Enterprise SONiC OS, 3.5.3, 4.0.0, 4.0.1, 4.0.2, contains an "Uncontrolled Resource Consumption vulnerability" in authentication component. An unauthenti… |
CVE-2023-23552 | High | 7.5 | 2023-02-01 | On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WA… |
CVE-2023-22664 | High | 7.5 | 2023-02-01 | On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP… |
CVE-2023-23616 | Low | 3.5 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, when… |
CVE-2023-22486 | Low | 3.5 | 2023-01-26 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time com… |
CVE-2023-20922 | Medium | 5.5 | 2023-01-26 | In setMimeGroup of PackageManagerService.java, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no ad… |
CVE-2023-20908 | Medium | 5.5 | 2023-01-26 | In several functions of SettingsState.java, there is a possible system crash loop due to resource exhaustion. This could lead to local denial of service with n… |
CVE-2022-3094 | High | 7.5 | 2023-01-26 | Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free me… |
CVE-2022-27508 | High | 7.5 | 2023-01-26 | Unauthenticated denial of service |
CVE-2022-27507 | Medium | 6.5 | 2023-01-26 | Authenticated denial of service |
CVE-2021-28510 | Medium | 5.3 | 2023-01-26 | For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PT… |
CVE-2023-22484 | Low | 3.5 | 2023-01-23 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial ti… |
CVE-2023-22483 | Low | 3.5 | 2023-01-23 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynom… |
CVE-2022-4816 | Medium | 6.2 | 2023-01-23 | A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the application. |
CVE-2023-20047 | Medium | 6.5 | 2023-01-20 | A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco Webex Room Phone and Cisco Webex Share devices could allow an unauthenticated, adj… |
CVE-2023-21838 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2022-41861 | Medium | 6.5 | 2023-01-17 | A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash. |
CVE-2023-23590 | High | 7.5 | 2023-01-15 | Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated API request. The at… |
CVE-2023-22470 | Low | 3.5 | 2023-01-14 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A database error ca… |
CVE-2023-22400 | High | 7.5 | 2023-01-13 | An Uncontrolled Resource Consumption vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an unauthenticated, n… |
CVE-2023-22396 | High | 7.5 | 2023-01-13 | An Uncontrolled Resource Consumption vulnerability in TCP processing on the Routing Engine (RE) of Juniper Networks Junos OS allows an unauthenticated network-… |
CVE-2022-3613 | Medium | 5.8 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15… |
CVE-2022-4344 | Medium | 6.3 | 2023-01-12 | Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted captu… |
CVE-2022-34335 | Medium | 6.5 | 2023-01-11 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.1 could allow an authenticated user to exhaust server resources which could lead to a denial of… |
CVE-2023-21728 | High | 7.5 | 2023-01-10 | Windows Netlogon Denial of Service Vulnerability |
CVE-2023-21557 | High | 7.5 | 2023-01-10 | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability |
CVE-2023-21547 | High | 7.5 | 2023-01-10 | Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability |
CVE-2023-21543 | High | 8.1 | 2023-01-10 | Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability |
CVE-2021-32821 | Medium | 6.2 | 2023-01-03 | MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulnerable to Regular Expr… |
CVE-2022-46740 | Medium | 6.5 | 2022-12-28 | There is a denial of service vulnerability in the Wi-Fi module of the HUAWEI WS7100-20 Smart WiFi Router.Successful exploit could cause a denial of service (Do… |
CVE-2022-3064 | High | 7.5 | 2022-12-27 | Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory. |
CVE-2019-25072 | High | 7.5 | 2022-12-27 | Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a sig… |
CVE-2022-4767 | High | 7.5 | 2022-12-27 | Denial of Service in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-24118 | Critical | 9.1 | 2022-12-26 | Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration. This affects iNET… |
CVE-2022-47934 | Medium | 6.5 | 2022-12-24 | Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs… |
CVE-2022-47932 | Medium | 6.5 | 2022-12-24 | Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This vulne… |
CVE-2022-28229 | High | 7.5 | 2022-12-23 | The hash functionality in userver before 42059b6319661583b3080cab9b595d4f8ac48128 allows attackers to cause a denial of service via crafted HTTP request, invol… |
CVE-2022-39164 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Fo… |
CVE-2022-39165 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. IBM X-Force ID: 23… |
CVE-2022-40899 | High | 7.5 | 2022-12-23 | An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malici… |
CVE-2020-26302 | High | 7.5 | 2022-12-22 | is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of… |
CVE-2022-42929 | Medium | 6.5 | 2022-12-22 | If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending… |
CVE-2020-36620 | Low | 3.5 | 2022-12-21 | A vulnerability was found in Brondahl EnumStringValues up to 4.0.0. It has been declared as problematic. This vulnerability affects the function GetStringValue… |
CVE-2022-46315 | High | 7.5 | 2022-12-20 | The ProfileSDK has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability. |
CVE-2022-46399 | High | 7.5 | 2022-12-19 | The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZero. |
CVE-2022-23524 | Medium | 5.3 | 2022-12-15 | Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting i… |
CVE-2022-46352 | High | 7.5 | 2022-12-13 | A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HS… |
CVE-2022-46351 | Medium | 5.5 | 2022-12-13 | A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HS… |
CVE-2022-45044 | Medium | 5.3 | 2022-12-13 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.50), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All… |
CVE-2022-31698 | Medium | 5.3 | 2022-12-13 | The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Serv… |
CVE-2022-20482 | Medium | 5.5 | 2022-12-13 | In createNotificationChannel of NotificationManager.java, there is a possible way to make the device unusable and require factory reset due to resource exhaust… |
CVE-2022-43780 | High | 7.5 | 2022-12-12 | Certain HP ENVY, OfficeJet, and DeskJet printers may be vulnerable to a Denial of Service attack. |
CVE-2022-3510 | High | 7.5 | 2022-12-12 | A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 c… |
CVE-2022-3509 | High | 7.5 | 2022-12-12 | A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a… |
CVE-2022-37907 | Medium | 5.8 | 2022-12-12 | A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A su… |
CVE-2022-2794 | High | 7.5 | 2022-12-12 | Certain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack. |
CVE-2021-3821 | Critical | 9.8 | 2022-12-12 | A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Denial of Service when runni… |
CVE-2022-20691 | Medium | 5.3 | 2022-12-12 | A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Adaptive Telephone Adapter firmware could allow an unauthenticated, adjac… |