CWE-400 · Uncontrolled Resource Consumption (page 22)
Page 22 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23492 | High | 7.5 | 2022-12-08 | go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to targeted resource exha… |
CVE-2022-23471 | Medium | 5.7 | 2022-12-07 | containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stre… |
CVE-2022-23487 | High | 7.5 | 2022-12-07 | js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource… |
CVE-2022-23486 | High | 7.5 | 2022-12-07 | libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node t… |
CVE-2022-44608 | High | 7.5 | 2022-12-07 | Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huge storage space, w… |
CVE-2022-35254 | High | 7.5 | 2022-12-05 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R1… |
CVE-2022-30122 | High | 7.5 | 2022-12-05 | A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack. |
CVE-2022-41969 | Low | 2.4 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user… |
CVE-2022-41968 | Low | 3.5 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a dat… |
CVE-2022-41568 | High | 7.5 | 2022-11-29 | LINE client for iOS before 12.17.0 might be crashed by sharing an invalid shared key of e2ee in group chat. |
CVE-2022-39346 | Low | 3.5 | 2022-11-25 | Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a m… |
CVE-2022-45873 | Medium | 5.5 | 2022-11-23 | systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object… |
CVE-2022-41932 | High | 7.5 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create many new schemas an… |
CVE-2022-41952 | Medium | 6.5 | 2022-11-22 | Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection t… |
CVE-2022-38871 | High | 7.5 | 2022-11-18 | In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages. |
CVE-2022-4006 | Low | 3.7 | 2022-11-15 | A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/fra… |
CVE-2022-20854 | High | 7.5 | 2022-11-15 | A vulnerability in the processing of SSH connections of Cisco Firepower Management Center (FMC) and Cisco Firepower Threat Defense (FTD) Software could allow a… |
CVE-2022-40735 | High | 7.5 | 2022-11-14 | The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oo… |
CVE-2022-45199 | High | 7.5 | 2022-11-14 | Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. |
CVE-2022-30691 | Medium | 5.9 | 2022-11-11 | Uncontrolled resource consumption in the Intel(R) Support Android application before version 22.02.28 may allow an authenticated user to potentially enable den… |
CVE-2022-3818 | Medium | 5.3 | 2022-11-10 | An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15… |
CVE-2022-43572 | High | 7.5 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Collector (HEC) protoco… |
CVE-2022-43564 | Medium | 4.9 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user who can create search macros and schedule search reports can cause a denial of serv… |
CVE-2022-20960 | High | 7.5 | 2022-11-04 | A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to cause a denial of service… |
CVE-2022-20937 | Medium | 5.3 | 2022-11-04 | A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker to… |
CVE-2022-43238 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-motion.cc. This vulnerability allows attackers to cause… |
CVE-2022-32927 | High | 7.5 | 2022-11-01 | The issue was addressed with improved memory handling. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16. Joining a malicious Wi-Fi n… |
CVE-2022-39294 | High | 7.5 | 2022-10-31 | conduit-hyper integrates a conduit application with the hyper server. Prior to version 0.4.2, `conduit-hyper` did not check any limit on a request's length bef… |
CVE-2022-2741 | High | 8.2 | 2022-10-31 | The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN… |
CVE-2022-40617 | High | 7.5 | 2022-10-31 | strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) cer… |
CVE-2022-39330 | Medium | 4.8 | 2022-10-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Next… |
CVE-2022-43766 | High | 7.5 | 2022-10-26 | Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with… |
CVE-2022-3639 | Medium | 4.3 | 2022-10-21 | A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all… |
CVE-2022-41833 | High | 7.5 | 2022-10-19 | In all BIG-IP 13.1.x versions, when an iRule containing the HTTP::collect command is configured on a virtual server, undisclosed requests can cause Traffic Man… |
CVE-2022-41806 | High | 7.5 | 2022-10-19 | In versions 16.1.x before 16.1.3.2 and 15.1.x before 15.1.5.1, when BIG-IP AFM Network Address Translation policy with IPv6/IPv4 translation rules is configure… |
CVE-2022-41770 | Medium | 6.5 | 2022-10-19 | In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ all ver… |
CVE-2020-15853 | Medium | 5.3 | 2022-10-18 | supybot-fedora implements the command 'refresh', that refreshes the cache of all users from FAS. This takes quite a while to run, and zodbot stops responding t… |
CVE-2022-3517 | High | 7.5 | 2022-10-17 | A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with… |
CVE-2022-3283 | High | 7.5 | 2022-10-17 | A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all ve… |
CVE-2022-2931 | High | 7.5 | 2022-10-17 | A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions… |
CVE-2022-2455 | Medium | 6.5 | 2022-10-17 | A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting from 15.2 before 15… |
CVE-2022-39128 | Medium | 5.5 | 2022-10-14 | In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-39127 | Medium | 5.5 | 2022-10-14 | In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-39126 | Medium | 5.5 | 2022-10-14 | In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-39125 | Medium | 5.5 | 2022-10-14 | In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-39124 | Medium | 5.5 | 2022-10-14 | In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-39123 | Medium | 5.5 | 2022-10-14 | In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-38687 | Medium | 5.5 | 2022-10-14 | In messaging service, there is a missing permission check. This could lead to local denial of service in messaging service with no additional execution privile… |
CVE-2022-38679 | Medium | 5.5 | 2022-10-14 | In music service, there is a missing permission check. This could lead to local denial of service in music service with no additional execution privileges need… |
CVE-2022-38677 | Medium | 5.5 | 2022-10-14 | In cell service, there is a missing permission check. This could lead to local denial of service in cell service with no additional execution privileges needed. |
CVE-2022-39278 | High | 7.5 | 2022-10-13 | Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1… |
CVE-2022-41404 | High | 7.5 | 2022-10-11 | An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecifie… |
CVE-2022-20425 | Medium | 5.5 | 2022-10-11 | In addAutomaticZenRule of ZenModeHelper.java, there is a possible permanent degradation of performance due to resource exhaustion. This could lead to local den… |
CVE-2022-39271 | High | 7.5 | 2022-10-11 | Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Tr… |
CVE-2022-38371 | High | 7.5 | 2022-10-11 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2022-39280 | Medium | 5.9 | 2022-10-06 | dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial… |
CVE-2022-2529 | High | 7.5 | 2022-09-30 | sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing… |
CVE-2022-34326 | High | 7.5 | 2022-09-27 | In ambiot amb1_sdk (aka SDK for Ameba1) before 2022-06-20 on Realtek RTL8195AM devices before 284241d70308ff2519e40afd7b284ba892c730a3, the timer task and RX t… |
CVE-2022-3204 | High | 7.5 | 2022-09-26 | A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack w… |
CVE-2022-32790 | High | 7.5 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, macOS Big Sur 11.6… |
CVE-2022-3257 | Low | 3.1 | 2022-09-23 | Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows auth… |
CVE-2022-23951 | Medium | 5.5 | 2022-09-21 | In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs. |
CVE-2022-28639 | High | 8.8 | 2022-09-20 | A remote potential adjacent denial of service (DoS) and potential adjacent arbitrary code execution vulnerability that could potentially lead to a loss of conf… |
CVE-2022-37884 | High | 7.5 | 2022-09-20 | A vulnerability exists in the ClearPass Policy Manager Guest User Interface that can allow an unauthenticated attacker to send specific operations which result… |
CVE-2022-28204 | High | 7.5 | 2022-09-19 | A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere&target=Property%3AP31&namesp… |
CVE-2022-40150 | Medium | 6.5 | 2022-09-16 | Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input… |
CVE-2022-39209 | High | 7.5 | 2022-09-15 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexit… |
CVE-2022-36114 | Medium | 4.8 | 2022-09-14 | Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed archives… |
CVE-2022-2962 | High | 7.8 | 2022-09-13 | A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn'… |
CVE-2022-38013 | High | 7.5 | 2022-09-13 | .NET Core and Visual Studio Denial of Service Vulnerability |
CVE-2022-38100 | High | 7.5 | 2022-09-13 | The CMS800 device fails while attempting to parse malformed network data sent by a threat actor. A threat actor with network access can remotely issue a specia… |
CVE-2022-39158 | Medium | 5.3 | 2022-09-13 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RU… |
CVE-2022-31006 | High | 7.5 | 2022-09-09 | indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions of indy-node, an att… |
CVE-2022-3147 | Low | 3.1 | 2022-09-09 | Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to… |
CVE-2022-36083 | Medium | 5.3 | 2022-09-07 | JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers… |
CVE-2022-36049 | High | 7.7 | 2022-09-07 | Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to d… |
CVE-2022-35913 | Medium | 4.3 | 2022-09-06 | Samourai Wallet Stonewallx2 0.99.98e allows a denial of service via a P2P coinjoin. The attacker and victim must follow each other's paynym. Then, the victim m… |
CVE-2022-36064 | Medium | 5.9 | 2022-09-06 | Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts users that use Shescape to escape argumen… |
CVE-2020-29260 | High | 7.5 | 2022-09-02 | libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup(). |
CVE-2022-22101 | Medium | 6.2 | 2022-09-02 | Denial of service in multimedia due to uncontrolled resource consumption while parsing an incoming HAB message in Snapdragon Auto |
CVE-2022-39194 | Medium | 4.9 | 2022-09-02 | An issue was discovered in the MediaWiki through 1.38.2. The community configuration pages for the GrowthExperiments extension could cause a site to become una… |
CVE-2022-2764 | Medium | 4.9 | 2022-09-01 | A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations. |
CVE-2022-1677 | Medium | 6.3 | 2022-09-01 | In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster… |
CVE-2020-35534 | Medium | 5.5 | 2022-09-01 | In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files. |
CVE-2022-36055 | Medium | 6.5 | 2022-09-01 | Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Fuzz testing, provided by the CNCF, identified input to functio… |
CVE-2022-2004 | High | 7.5 | 2022-08-31 | AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devi… |
CVE-2022-1325 | Medium | 5.5 | 2022-08-31 | A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick… |
CVE-2022-1259 | High | 7.5 | 2022-08-31 | A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the s… |
CVE-2022-36034 | High | 7.5 | 2022-08-29 | nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of `{{` and with many repetitions of `{{|`. This issue has been patched in… |
CVE-2022-0669 | Medium | 6.5 | 2022-08-29 | A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD… |
CVE-2021-3735 | Medium | 4.4 | 2022-08-26 | A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS… |
CVE-2021-3669 | Medium | 5.5 | 2022-08-26 | A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource… |
CVE-2021-4022 | Medium | 5.5 | 2022-08-25 | A vulnerability was found in rizin. The bug involves an ELF64 binary for the HPPA architecture. When a specially crafted binarygets analysed by rizin, it cause… |
CVE-2021-42521 | High | 7.5 | 2022-08-25 | There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value… |
CVE-2021-4040 | Medium | 5.3 | 2022-08-24 | A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw a… |
CVE-2022-24375 | High | 7.5 | 2022-08-24 | The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multi… |
CVE-2022-33142 | High | 7.7 | 2022-08-23 | Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress. |
CVE-2021-3764 | Medium | 5.5 | 2022-08-23 | A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is si… |
CVE-2021-3759 | Medium | 5.5 | 2022-08-23 | A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple… |
CVE-2021-3690 | High | 7.5 | 2022-08-23 | A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denia… |