CWE-400 · Uncontrolled Resource Consumption (page 21)
Page 21 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-30999 | High | 7.5 | 2024-02-03 | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10… |
CVE-2024-23824 | Medium | 4.7 | 2024-02-02 | mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the pa… |
CVE-2023-45028 | Medium | 5.5 | 2024-02-02 | An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could al… |
CVE-2024-24752 | Medium | 6.5 | 2024-02-01 | Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lam… |
CVE-2024-1014 | Medium | 6.2 | 2024-01-29 | Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availabi… |
CVE-2024-22233 | High | 7.5 | 2024-01-22 | In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) co… |
CVE-2024-23744 | High | 7.5 | 2024-01-21 | An issue was discovered in Mbed TLS 3.5.1. There is persistent handshake denial if a client sends a TLS 1.3 ClientHello without extensions. |
CVE-2023-6450 | Medium | 5.5 | 2024-01-19 | An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resulting in a denial of… |
CVE-2024-20985 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and p… |
CVE-2024-20983 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploita… |
CVE-2024-20981 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and p… |
CVE-2024-20977 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20971 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20965 | Medium | 4.9 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20961 | Medium | 6.5 | 2024-01-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0… |
CVE-2024-20959 | Medium | 4.4 | 2024-01-16 | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily expl… |
CVE-2023-22512 | High | 7.5 | 2024-01-16 | This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this v… |
CVE-2024-0581 | Medium | 4.0 | 2024-01-16 | An Uncontrolled Resource Consumption vulnerability has been found on Sandsprite Scdbg.exe, affecting version 1.0. This vulnerability allows an attacker to send… |
CVE-2023-52098 | High | 7.5 | 2024-01-16 | Denial of Service (DoS) vulnerability in the DMS module. Successful exploitation of this vulnerability will affect availability. |
CVE-2023-52113 | High | 7.5 | 2024-01-16 | launchAnyWhere vulnerability in the ActivityManagerService module. Successful exploitation of this vulnerability will affect availability. |
CVE-2024-22362 | High | 7.5 | 2024-01-16 | Drupal contains a vulnerability with improper handling of structural elements. If this vulnerability is exploited, an attacker may be able to cause a denial-of… |
CVE-2024-21655 | Medium | 4.3 | 2024-01-12 | Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause… |
CVE-2023-48297 | High | 8.6 | 2024-01-12 | Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very… |
CVE-2023-34061 | High | 7.5 | 2024-01-12 | Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack. An unauthenticated attacker can use this vulnerability to for… |
CVE-2023-49295 | Medium | 6.4 | 2024-01-10 | quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large num… |
CVE-2023-42941 | Medium | 4.8 | 2024-01-10 | The issue was addressed with improved checks. This issue is fixed in iOS 17.2 and iPadOS 17.2. An attacker in a privileged network position may be able to perf… |
CVE-2024-0348 | Medium | 4.3 | 2024-01-09 | A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been classified as problematic. Affected is an unknown function of the componen… |
CVE-2024-20672 | High | 7.5 | 2024-01-09 | .NET Denial of Service Vulnerability |
CVE-2024-20661 | High | 7.5 | 2024-01-09 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2024-22164 | Medium | 4.3 | 2024-01-09 | In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigatio… |
CVE-2024-21651 | High | 7.5 | 2024-01-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A user able to attach a file to a page can post a malf… |
CVE-2023-50121 | Medium | 5.7 | 2024-01-06 | Autel EVO NANO drone flight control firmware version 1.6.5 is vulnerable to denial of service (DoS). |
CVE-2023-34324 | Medium | 4.9 | 2024-01-05 | Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen consol… |
CVE-2024-0241 | High | 7.5 | 2024-01-04 | encoded_id-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might ca… |
CVE-2023-42358 | High | 7.7 | 2024-01-03 | An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via… |
CVE-2023-49557 | Medium | 5.5 | 2024-01-03 | An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the yasm_section_bcs_first function in the libyasm/section.c componen… |
CVE-2023-49555 | Medium | 5.5 | 2024-01-03 | An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_smacro function in the modules/preprocs/nasm/nasm-pp.c com… |
CVE-2023-49550 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component. |
CVE-2023-50020 | High | 7.5 | 2024-01-02 | An issue was discovered in open5gs v2.6.6. SIGPIPE can be used to crash AMF. |
CVE-2023-50019 | Medium | 5.9 | 2024-01-02 | An issue was discovered in open5gs v2.6.6. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of Nudm… |
CVE-2023-26157 | Medium | 5.5 | 2024-01-02 | Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in deco… |
CVE-2023-50730 | High | 7.5 | 2023-12-22 | Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form… |
CVE-2023-46131 | Medium | 6.5 | 2023-12-21 | Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of… |
CVE-2023-50249 | High | 7.5 | 2023-12-20 | Sentry-Javascript is official Sentry SDKs for JavaScript. A ReDoS (Regular expression Denial of Service) vulnerability has been identified in Sentry's Astro SD… |
CVE-2023-50707 | Critical | 9.6 | 2023-12-20 | Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device. |
CVE-2023-46104 | Medium | 6.5 | 2023-12-19 | Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vu… |
CVE-2023-41151 | High | 7.5 | 2023-12-14 | An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to crash when the server wa… |
CVE-2023-6193 | Medium | 5.3 | 2023-12-12 | quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consum… |
CVE-2023-49713 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in NetBIOS service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to… |
CVE-2023-49143 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in rfe service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to spec… |
CVE-2023-49140 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in commplex-link service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packe… |
CVE-2023-41963 | High | 7.5 | 2023-12-12 | Denial-of-service (DoS) vulnerability exists in FTP service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to spec… |
CVE-2023-49809 | Medium | 4.3 | 2023-12-12 | Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and mak… |
CVE-2023-45847 | Medium | 4.3 | 2023-12-12 | Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and cr… |
CVE-2023-5870 | Low | 2.2 | 2023-12-10 | A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum wor… |
CVE-2023-49800 | High | 7.5 | 2023-12-09 | `nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on w… |
CVE-2023-4486 | High | 7.5 | 2023-12-07 | Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines pri… |
CVE-2023-35909 | Medium | 5.3 | 2023-12-07 | Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This i… |
CVE-2023-48840 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion. |
CVE-2023-48834 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion. |
CVE-2023-48833 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhaustion. |
CVE-2023-48831 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion. |
CVE-2023-6180 | Medium | 5.3 | 2023-12-05 | The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exha… |
CVE-2023-39248 | High | 7.5 | 2023-12-05 | Dell OS10 Networking Switches running 10.5.2.x and above contain an Uncontrolled Resource Consumption (Denial of Service) vulnerability, when switches are con… |
CVE-2023-49290 | Medium | 5.3 | 2023-12-05 | lestrrat-go/jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. A p2c parameter set too high in JWE's algo… |
CVE-2023-47633 | High | 7.5 | 2023-12-04 | Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an autom… |
CVE-2023-40692 | Medium | 5.9 | 2023-12-04 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, 11.5 is vulnerable to denial of service under extreme stress conditions. IBM X-F… |
CVE-2023-5915 | Medium | 5.3 | 2023-12-01 | A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation. This vulnerability may allow to… |
CVE-2023-48951 | High | 7.5 | 2023-11-29 | An issue in the box_equal function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. |
CVE-2023-48713 | Medium | 6.5 | 2023-11-28 | Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to… |
CVE-2023-48369 | Medium | 4.3 | 2023-11-27 | Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow th… |
CVE-2023-48268 | Medium | 4.3 | 2023-11-27 | Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excess… |
CVE-2023-40703 | Medium | 4.3 | 2023-11-27 | Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resource… |
CVE-2023-6277 | Medium | 6.5 | 2023-11-24 | An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft… |
CVE-2023-33202 | Medium | 5.5 | 2023-11-23 | Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This c… |
CVE-2023-41102 | High | 7.5 | 2023-11-17 | An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may l… |
CVE-2023-47025 | Medium | 5.5 | 2023-11-16 | An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component. |
CVE-2023-38043 | High | 7.8 | 2023-11-15 | A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulne… |
CVE-2023-45622 | High | 7.5 | 2023-11-14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitation of these vulner… |
CVE-2023-45621 | High | 7.5 | 2023-11-14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabiliti… |
CVE-2023-36038 | High | 8.2 | 2023-11-14 | ASP.NET Core Denial of Service Vulnerability |
CVE-2023-25949 | Medium | 5.5 | 2023-11-14 | Uncontrolled resource consumption in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable denial of serv… |
CVE-2023-36042 | Medium | 6.2 | 2023-11-14 | Visual Studio Denial of Service Vulnerability |
CVE-2023-44321 | Low | 2.7 | 2023-11-14 | Affected devices do not properly validate the length of inputs when performing certain configuration changes in the web interface allowing an authenticated att… |
CVE-2023-42813 | Medium | 6.1 | 2023-11-13 | Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. T… |
CVE-2023-45167 | Medium | 6.2 | 2023-11-10 | IBM AIX's 7.3 Python implementation could allow a non-privileged local user to exploit a vulnerability to cause a denial of service. IBM X-Force ID: 267965. |
CVE-2023-5759 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified. Reported by Jason Geffner. |
CVE-2023-45319 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was identified. Reported by Jason Geffner. |
CVE-2023-35767 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Jason Geffner… |
CVE-2023-46737 | Low | 3.1 | 2023-11-07 | Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls… |
CVE-2023-5969 | Medium | 5.3 | 2023-11-06 | Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_lo… |
CVE-2023-41378 | High | 7.5 | 2023-11-06 | In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake… |
CVE-2023-42669 | Medium | 6.5 | 2023-11-06 | A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability ste… |
CVE-2023-42670 | Medium | 6.5 | 2023-11-03 | A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC se… |
CVE-2023-29046 | Medium | 4.3 | 2023-11-02 | Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Som… |
CVE-2023-5876 | Low | 3.1 | 2023-11-02 | Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Servic… |
CVE-2023-20155 | High | 7.5 | 2023-11-01 | A vulnerability in a logging API in Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to cause the device to bec… |
CVE-2023-5625 | Medium | 5.3 | 2023-11-01 | A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419… |
CVE-2023-46278 | Medium | 6.5 | 2023-11-01 | Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.1.0 to 4.1.1 allows a remote authenticated attacker to consume huge storage space or… |
CVE-2023-39610 | Medium | 6.5 | 2023-10-31 | An issue in TP-Link Tapo C100 v1.1.15 Build 211130 Rel.15378n(4555) and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted web… |