CWE-400 · Uncontrolled Resource Consumption (page 23)
Page 23 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-39748 | High | 7.5 | 2023-08-21 | An issue in the component /userRpm/NetworkCfgRpm of TP-Link TL-WR1041N V2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request. |
CVE-2023-4394 | Medium | 6.7 | 2023-08-17 | A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volumes.c in btrfs file-system in the Linux Kernel. This flaw allows a local attack… |
CVE-2023-38737 | Medium | 5.9 | 2023-08-16 | IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remo… |
CVE-2023-21280 | Medium | 5.5 | 2023-08-14 | In setMediaButtonBroadcastReceiver of MediaSessionRecord.java, there is a possible permanent DoS due to resource exhaustion. This could lead to local denial of… |
CVE-2023-38741 | High | 7.5 | 2023-08-14 | IBM TXSeries for Multiplatforms 8.1, 8.2, and 9.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read opera… |
CVE-2021-29057 | Medium | 6.5 | 2023-08-11 | An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service. |
CVE-2023-28938 | Low | 3.4 | 2023-08-11 | Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of… |
CVE-2023-38210 | Medium | 5.5 | 2023-08-10 | Adobe XMP Toolkit versions 2022.06 is affected by a Uncontrolled Resource Consumption vulnerability. An unauthenticated attacker could leverage this vulnerabil… |
CVE-2023-38180 | High | 7.5 | 2023-08-08 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2023-38178 | High | 7.5 | 2023-08-08 | .NET Core and Visual Studio Denial of Service Vulnerability |
CVE-2023-29409 | Medium | 5.3 | 2023-08-02 | Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys tr… |
CVE-2023-3825 | High | 7.5 | 2023-07-31 | PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resource consumption… |
CVE-2023-34872 | Medium | 5.5 | 2023-07-31 | A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file in Outlin… |
CVE-2023-38498 | Medium | 4.3 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-37900 | Low | 3.4 | 2023-07-27 | Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privi… |
CVE-2023-3637 | Medium | 4.3 | 2023-07-25 | An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for a… |
CVE-2023-38200 | High | 7.5 | 2023-07-24 | A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This fla… |
CVE-2023-3782 | Medium | 5.9 | 2023-07-19 | DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb… |
CVE-2023-37143 | Medium | 5.5 | 2023-07-18 | ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function BackwardPass::IsEmptyLoopAfterMemOp(). |
CVE-2023-37142 | Medium | 5.5 | 2023-07-18 | ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::HasInlinees(). |
CVE-2023-37141 | Medium | 5.5 | 2023-07-18 | ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray(). |
CVE-2023-37140 | Medium | 5.5 | 2023-07-18 | ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::DiagScopeVariablesWalker::GetChildrenCount(). |
CVE-2023-37788 | High | 7.5 | 2023-07-18 | goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors. |
CVE-2023-37481 | Low | 2.7 | 2023-07-18 | Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of… |
CVE-2023-37480 | Low | 2.7 | 2023-07-18 | Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of… |
CVE-2023-2263 | High | 7.5 | 2023-07-18 | The Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A is vulnerable to CIP fuzzing. The new ENIP connections cannot be established if impacted by… |
CVE-2022-30858 | Medium | 6.5 | 2023-07-17 | An issue was discovered in ngiflib 0.4. There is SEGV in SDL_LoadAnimatedGif when use SDLaffgif. poc : ./SDLaffgif CA_file2_0 |
CVE-2023-37475 | High | 7.5 | 2023-07-17 | Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to avro's `github.com… |
CVE-2023-3614 | Medium | 4.3 | 2023-07-17 | Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsiv… |
CVE-2023-3593 | Medium | 4.3 | 2023-07-17 | Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input. |
CVE-2023-3585 | Medium | 4.3 | 2023-07-17 | Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link. |
CVE-2022-4952 | Low | 3.5 | 2023-07-17 | A vulnerability has been found in OmniSharp csharp-language-server-protocol up to 0.19.6 and classified as problematic. This vulnerability affects the function… |
CVE-2023-36818 | Medium | 6.5 | 2023-07-14 | Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This… |
CVE-2023-35945 | High | 7.5 | 2023-07-13 | Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_S… |
CVE-2023-37463 | Medium | 6.4 | 2023-07-13 | cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Three polynomial time… |
CVE-2023-34458 | High | 7.1 | 2023-07-13 | mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transac… |
CVE-2023-26597 | High | 7.5 | 2023-07-13 | Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recomm… |
CVE-2023-29449 | Medium | 5.9 | 2023-07-13 | JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configu… |
CVE-2023-21240 | Medium | 5.5 | 2023-07-13 | In Policy of Policy.java, there is a possible boot loop due to resource exhaustion. This could lead to local denial of service with no additional execution pri… |
CVE-2020-20021 | High | 7.5 | 2023-07-12 | An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon. |
CVE-2023-35339 | High | 7.5 | 2023-07-11 | Windows CryptoAPI Denial of Service Vulnerability |
CVE-2023-35329 | Medium | 6.5 | 2023-07-11 | Windows Authentication Denial of Service Vulnerability |
CVE-2023-35298 | High | 7.5 | 2023-07-11 | HTTP.sys Denial of Service Vulnerability |
CVE-2023-3108 | Medium | 6.2 | 2023-07-11 | A flaw was found in the subsequent get_user_pages_fast in the Linux kernel’s interface for symmetric key cipher algorithms in the skcipher_recvmsg of crypto/al… |
CVE-2023-35921 | High | 7.5 | 2023-07-11 | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4… |
CVE-2023-35920 | High | 7.5 | 2023-07-11 | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4… |
CVE-2023-26509 | High | 7.5 | 2023-07-03 | AnyDesk 7.0.8 allows remote Denial of Service. |
CVE-2023-1206 | Medium | 5.7 | 2023-06-30 | A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack… |
CVE-2023-21176 | Medium | 4.4 | 2023-06-28 | In list_key_entries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local denial of service wit… |
CVE-2023-3398 | High | 7.5 | 2023-06-26 | Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3. |
CVE-2023-35925 | Medium | 6.2 | 2023-06-23 | FastAsyncWorldEdit (FAWE) is designed for efficient world editing. This vulnerability enables the attacker to select a region with the `Infinity` keyword (case… |
CVE-2023-33141 | High | 7.5 | 2023-06-23 | Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability |
CVE-2023-34462 | Medium | 6.5 | 2023-06-22 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `Sni… |
CVE-2023-2990 | High | 7.5 | 2023-06-22 | Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause… |
CVE-2023-26434 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 serv… |
CVE-2023-26433 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue IMAP serv… |
CVE-2023-26432 | Medium | 4.3 | 2023-06-20 | When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP serv… |
CVE-2023-34166 | High | 7.5 | 2023-06-19 | Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the system to restart. |
CVE-2023-2831 | Medium | 4.3 | 2023-06-16 | Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a la… |
CVE-2023-2793 | Medium | 6.5 | 2023-06-16 | Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by… |
CVE-2023-2785 | Medium | 4.3 | 2023-06-16 | Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files wh… |
CVE-2023-2683 | Medium | 5.3 | 2023-06-15 | A memory leak in the EFR32 Bluetooth LE stack 5.1.0 through 5.1.1 allows an attacker to send an invalid pairing message and cause future legitimate connection… |
CVE-2023-32229 | Medium | 4.9 | 2023-06-15 | Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when en… |
CVE-2022-33168 | High | 7.5 | 2023-06-15 | IBM Security Directory Suite VA 8.0.1 could allow an attacker to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 228588. |
CVE-2023-29331 | High | 7.5 | 2023-06-14 | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
CVE-2023-32013 | Medium | 5.3 | 2023-06-14 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2023-2778 | High | 7.5 | 2023-06-13 | A denial-of-service vulnerability exists in Rockwell Automation FactoryTalk Transaction Manager. This vulnerability can be exploited by sending a modified pac… |
CVE-2023-35053 | High | 7.5 | 2023-06-12 | In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms |
CVE-2023-29767 | Medium | 5.5 | 2023-06-09 | An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files. |
CVE-2023-3163 | Low | 3.5 | 2023-06-08 | A vulnerability was found in y_project RuoYi up to 4.7.7. It has been classified as problematic. Affected is the function filterKeyword. The manipulation of th… |
CVE-2023-34109 | Medium | 6.5 | 2023-06-07 | zxcvbn-ts is an open source password strength estimator written in typescript. This vulnerability affects users running on the nodeJS platform which are using… |
CVE-2023-33958 | Medium | 5.4 | 2023-06-06 | notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures… |
CVE-2023-33957 | Low | 2.6 | 2023-06-06 | notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures… |
CVE-2023-34104 | High | 7.5 | 2023-06-06 | fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. S… |
CVE-2022-33303 | Medium | 5.5 | 2023-06-06 | Transient DOS due to uncontrolled resource consumption in Linux kernel when malformed messages are sent from the Gunyah Resource Manager message queue. |
CVE-2023-29544 | Medium | 6.5 | 2023-06-02 | If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploi… |
CVE-2023-0616 | Medium | 6.5 | 2023-06-02 | If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause T… |
CVE-2023-29735 | Medium | 5.5 | 2023-05-30 | An issue found in edjing Mix v.7.09.01 for Android allows a local attacker to cause a denial of service via the database files. |
CVE-2023-30570 | High | 7.5 | 2023-05-29 | pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The e… |
CVE-2023-28320 | Medium | 5.9 | 2023-05-26 | A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build tim… |
CVE-2023-1981 | Medium | 5.5 | 2023-05-26 | A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash. |
CVE-2023-20883 | High | 7.5 | 2023-05-26 | In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-servic… |
CVE-2023-20882 | Medium | 5.9 | 2023-05-26 | In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hoste… |
CVE-2023-33720 | Medium | 6.5 | 2023-05-26 | mp4v2 v2.1.2 was discovered to contain a memory leak via the class MP4BytesProperty. |
CVE-2022-39374 | Medium | 6.5 | 2023-05-26 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the s… |
CVE-2023-32067 | High | 7.5 | 2023-05-25 | c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP… |
CVE-2023-2798 | High | 7.5 | 2023-05-25 | Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an a… |
CVE-2023-33980 | High | 7.5 | 2023-05-24 | Bramble Synchronisation Protocol (BSP) in Briar before 1.4.22 allows attackers to cause a denial of service (repeated application crashes) via a series of long… |
CVE-2023-26595 | Medium | 6.5 | 2023-05-23 | Denial-of-service (DoS) vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote authenticated attacker to cause a denial of service condition. |
CVE-2023-33297 | High | 7.5 | 2023-05-22 | Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-… |
CVE-2022-36326 | Medium | 4.4 | 2023-05-18 | An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventua… |
CVE-2023-2295 | High | 7.5 | 2023-05-17 | A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto a… |
CVE-2023-26044 | Medium | 5.3 | 2023-05-17 | react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. Previous versions of ReactPHP's HTTP server component contain a p… |
CVE-2023-21110 | High | 7.8 | 2023-05-15 | In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion. This could lead to local escalatio… |
CVE-2023-20930 | Medium | 5.5 | 2023-05-15 | In pushDynamicShortcut of ShortcutPackage.java, there is a possible way to get the device into a boot loop due to resource exhaustion. This could lead to local… |
CVE-2023-32787 | High | 7.5 | 2023-05-15 | The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no l… |
CVE-2023-31409 | Medium | 5.3 | 2023-05-15 | Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an remote… |
CVE-2023-23447 | High | 7.5 | 2023-05-15 | Uncontrolled Resource Consumption in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivi… |
CVE-2023-28356 | High | 7.5 | 2023-05-11 | A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enter a hot loop on one… |
CVE-2022-36329 | Medium | 4.4 | 2023-05-10 | An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in Western Digital My Cl… |