CWE-400 · Uncontrolled Resource Consumption (page 22)
Page 22 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-45956 | High | 7.5 | 2023-10-30 | An issue discovered in Govee LED Strip v3.00.42 allows attackers to cause a denial of service via crafted Move and MoveWithOnoff commands. |
CVE-2023-21339 | High | 7.5 | 2023-10-30 | In Minikin, there is a possible way to trigger ANR by showing a malicious message due to resource exhaustion. This could lead to remote denial of service with… |
CVE-2023-31418 | High | 7.5 | 2023-10-26 | An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to e… |
CVE-2023-40408 | Medium | 5.3 | 2023-10-25 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadO… |
CVE-2023-5724 | High | 7.5 | 2023-10-25 | Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. This vulnerability affects Firefox < 119… |
CVE-2023-46136 | High | 8.0 | 2023-10-25 | Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a… |
CVE-2023-46120 | Medium | 4.9 | 2023-10-25 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when recei… |
CVE-2023-46118 | Medium | 4.9 | 2023-10-25 | RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (D… |
CVE-2023-42031 | Medium | 4.9 | 2023-10-25 | IBM TXSeries for Multiplatforms, 8.1, 8.2, and 9.1, CICS TX Standard CICS TX Advanced 10.1 and 11.1 could allow a privileged user to cause a denial of service… |
CVE-2023-39219 | High | 7.5 | 2023-10-25 | PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests |
CVE-2022-3698 | Medium | 4.4 | 2023-10-25 | A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics versions prior to 4.45 … |
CVE-2022-0353 | Medium | 4.4 | 2023-10-25 | A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics versions prior to 4.45 … |
CVE-2023-43622 | High | 7.5 | 2023-10-23 | An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. Th… |
CVE-2023-45810 | Medium | 5.3 | 2023-10-17 | OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a de… |
CVE-2023-5522 | Medium | 4.3 | 2023-10-17 | Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and… |
CVE-2022-43893 | Low | 2.7 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a privileged user to cause by using a malicious payload. IBM X-Force ID: 240634. |
CVE-2023-44388 | High | 7.5 | 2023-10-16 | Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the ser… |
CVE-2023-45150 | Medium | 4.3 | 2023-10-16 | Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any len… |
CVE-2023-40180 | High | 7.5 | 2023-10-16 | silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Dist… |
CVE-2023-5595 | Medium | 5.5 | 2023-10-16 | Denial of Service in GitHub repository gpac/gpac prior to 2.3.0-DEV. |
CVE-2022-43740 | High | 7.5 | 2023-10-14 | IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 238… |
CVE-2023-38251 | Medium | 5.3 | 2023-10-13 | Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Res… |
CVE-2023-36841 | High | 7.5 | 2023-10-12 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows a… |
CVE-2023-27314 | High | 7.5 | 2023-10-12 | ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote unauthenti… |
CVE-2023-25774 | High | 7.5 | 2023-10-12 | A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02. A set of specially crafted network connection… |
CVE-2023-36703 | High | 7.5 | 2023-10-10 | DHCP Server Service Denial of Service Vulnerability |
CVE-2023-36606 | High | 7.5 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2023-36579 | High | 7.5 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2023-36435 | High | 7.5 | 2023-10-10 | Microsoft QUIC Denial of Service Vulnerability |
CVE-2023-36431 | High | 7.5 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
CVE-2023-36478 | High | 7.5 | 2023-10-10 | Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer ove… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2023-43786 | Medium | 5.5 | 2023-10-10 | A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system re… |
CVE-2023-37195 | Medium | 4.4 | 2023-10-10 | A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All ver… |
CVE-2023-5333 | Medium | 4.3 | 2023-10-09 | Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sending a specia… |
CVE-2023-5330 | Medium | 4.3 | 2023-10-09 | Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4… |
CVE-2023-21253 | Medium | 5.5 | 2023-10-06 | In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion. This could lead to local denial of service with no… |
CVE-2023-43810 | High | 7.5 | 2023-10-06 | OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting t… |
CVE-2023-20259 | High | 8.6 | 2023-10-04 | A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilizat… |
CVE-2023-3153 | Medium | 5.3 | 2023-10-04 | A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of se… |
CVE-2023-33026 | High | 7.5 | 2023-10-03 | Transient DOS in WLAN Firmware while parsing a NAN management frame. |
CVE-2023-26151 | Medium | 5.3 | 2023-10-03 | Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the… |
CVE-2023-5196 | Medium | 6.5 | 2023-09-29 | Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notification_prop result… |
CVE-2023-20268 | Medium | 4.7 | 2023-09-27 | A vulnerability in the packet processing functionality of Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to exhaust resourc… |
CVE-2023-20176 | Medium | 5.8 | 2023-09-27 | A vulnerability in the networking component of Cisco access point (AP) software could allow an unauthenticated, remote attacker to cause a temporary disruption… |
CVE-2023-5157 | High | 7.5 | 2023-09-27 | A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service. |
CVE-2023-43775 | Medium | 4.7 | 2023-09-27 | Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of the automation platf… |
CVE-2023-43646 | High | 8.6 | 2023-09-27 | get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regu… |
CVE-2023-41310 | Low | 3.3 | 2023-09-27 | Keep-alive vulnerability in the sticky broadcast mechanism. Successful exploitation of this vulnerability may cause malicious apps to run continuously in the b… |
CVE-2023-40441 | Medium | 6.5 | 2023-09-27 | A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content… |
CVE-2023-41294 | Critical | 9.8 | 2023-09-25 | The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services. |
CVE-2023-43771 | Medium | 5.5 | 2023-09-22 | In nqptp-message-handlers.c in nqptp before 1.2.3, crafted packets received on the control port could crash the program. |
CVE-2023-43767 | High | 7.5 | 2023-09-22 | Certain WithSecure products allow Denial of Service via the aepack archive unpack handler. This affects WithSecure Client Security 15, WithSecure Server Securi… |
CVE-2023-42457 | High | 7.5 | 2023-09-21 | plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when… |
CVE-2023-26144 | Medium | 5.3 | 2023-09-20 | Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanB… |
CVE-2020-24089 | Medium | 5.5 | 2023-09-20 | An issue was discovered in ImfHpRegFilter.sys in IOBit Malware Fighter version 8.0.2, allows local attackers to cause a denial of service (DoS). |
CVE-2022-47556 | Medium | 6.5 | 2023-09-19 | Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a… |
CVE-2023-42523 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via unpacking of a PE file. This affects WithSecure Client Security 15, WithSecure Server… |
CVE-2023-42522 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. This affects WithSecure Client Security… |
CVE-2023-42521 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via processing of a compressed file. This affects WithSecure Client Security 15, WithSecu… |
CVE-2023-42526 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via decompression of crafted data files. This affects WithSecure Client Security 15, With… |
CVE-2023-42520 | High | 7.5 | 2023-09-18 | Certain WithSecure products allow a remote crash of a scanning engine via unpacking of crafted data files. This affects WithSecure Client Security 15, WithSecu… |
CVE-2023-37263 | Medium | 6.8 | 2023-09-15 | Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title… |
CVE-2023-32665 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leadin… |
CVE-2023-32636 | Medium | 4.7 | 2023-09-14 | A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resol… |
CVE-2023-32611 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial… |
CVE-2023-29499 | Medium | 5.5 | 2023-09-14 | A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service. |
CVE-2023-42503 | Medium | 5.5 | 2023-09-14 | Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress… |
CVE-2023-26141 | High | 7.5 | 2023-09-14 | Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker… |
CVE-2023-38162 | High | 7.5 | 2023-09-12 | DHCP Server Service Denial of Service Vulnerability |
CVE-2023-38149 | High | 7.5 | 2023-09-12 | Windows TCP/IP Denial of Service Vulnerability |
CVE-2023-36799 | Medium | 6.5 | 2023-09-12 | .NET Core and Visual Studio Denial of Service Vulnerability |
CVE-2022-4896 | High | 8.2 | 2023-09-12 | Cyber Control, in its 1.650 version, is affected by a vulnerability in the generation on the server of pop-up windows with the messages "PNTMEDIDAS", "PEDIR"… |
CVE-2022-48475 | High | 8.2 | 2023-09-12 | Buffer Overflow vulnerability in Control de Ciber version 1.650, in the printing function. Sending a modified request by the attacker could cause a Buffer Over… |
CVE-2022-48474 | High | 8.2 | 2023-09-12 | Control de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the version function. Sending a malicious request could cause the… |
CVE-2022-23382 | High | 8.1 | 2023-09-11 | Shenzhen Hichip Vision Technology IP Camera Firmware V11.4.8.1.1-20170926 has a denial of service vulnerability through sending a crafted multicast message in… |
CVE-2023-36161 | High | 7.5 | 2023-09-11 | An issue was discovered in Qubo Smart Plug 10A version HSP02_01_01_14_SYSTEM-10A, allows attackers to cause a denial of service (DoS) via Wi-Fi deauthenticatio… |
CVE-2023-39321 | High | 7.5 | 2023-09-08 | Processing an incomplete post-handshake message for a QUIC connection can cause a panic. |
CVE-2023-40584 | Medium | 6.5 | 2023-09-07 | Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is v… |
CVE-2023-40591 | High | 7.5 | 2023-09-06 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory w… |
CVE-2023-28188 | Medium | 6.5 | 2023-09-06 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. A remote user may be able to cause a denial-… |
CVE-2023-4162 | Medium | 4.4 | 2023-08-31 | A segmentation fault can occur in Brocade Fabric OS after Brocade Fabric OS v9.0 and before Brocade Fabric OS v9.2.0a through the passwdcfg command. This c… |
CVE-2023-40594 | Medium | 6.5 | 2023-08-30 | In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against t… |
CVE-2023-40593 | Medium | 6.3 | 2023-08-30 | In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/sa… |
CVE-2023-41121 | High | 7.5 | 2023-08-25 | Array AG OS before 9.4.0.499 allows denial of service: remote attackers can cause system service processes to crash through abnormal HTTP operations. |
CVE-2023-40586 | High | 7.5 | 2023-08-25 | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed a… |
CVE-2023-40583 | High | 7.5 | 2023-08-25 | libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer… |
CVE-2023-41173 | High | 7.5 | 2023-08-25 | AdGuard DNS before 2.2 allows remote attackers to cause a denial of service via malformed UDP packets. |
CVE-2023-4418 | High | 7.5 | 2023-08-24 | A remote unprivileged attacker can sent multiple packages to the LMS5xx to disrupt its availability through a TCP SYN-based denial-of-service (DDoS) attack. B… |
CVE-2023-40710 | Medium | 6.8 | 2023-08-24 | An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web… |
CVE-2023-40709 | Medium | 6.8 | 2023-08-24 | An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have… |
CVE-2023-37379 | High | 8.1 | 2023-08-23 | Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privile… |
CVE-2022-48571 | High | 7.5 | 2023-08-22 | memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP. |
CVE-2022-48564 | Medium | 6.5 | 2023-08-22 | read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property Li… |
CVE-2022-48063 | Medium | 5.5 | 2023-08-22 | GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The at… |
CVE-2022-47696 | High | 7.8 | 2023-08-22 | An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols. |
CVE-2022-47695 | High | 7.8 | 2023-08-22 | An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_s… |
CVE-2022-37050 | Medium | 6.5 | 2023-08-22 | In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in… |
CVE-2020-26652 | High | 7.5 | 2023-08-22 | An issue was discovered in function nl80211_send_chandef in rtl8812au v5.6.4.2 allows attackers to cause a denial of service. |
CVE-2020-20813 | High | 7.5 | 2023-08-22 | Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet. |