CWE-400 · Uncontrolled Resource Consumption (page 23)
Page 23 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3670 | Medium | 6.5 | 2022-08-23 | MaxQueryDuration not honoured in Samba AD DC LDAP |
CVE-2021-20298 | High | 7.5 | 2022-08-23 | A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory acces… |
CVE-2022-35013 | Medium | 6.5 | 2022-08-16 | PNGDec commit 8abf6be was discovered to contain a FPE via SaveBMP at /linux/main.cpp. |
CVE-2022-38150 | High | 7.5 | 2022-08-11 | In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend r… |
CVE-2022-35776 | Medium | 6.2 | 2022-08-09 | Azure Site Recovery Denial of Service Vulnerability |
CVE-2022-35769 | High | 7.5 | 2022-08-09 | Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability |
CVE-2022-34701 | High | 7.5 | 2022-08-09 | Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability |
CVE-2022-28880 | Medium | 4.3 | 2022-08-05 | A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files it is possible… |
CVE-2022-2053 | High | 7.5 | 2022-08-05 | When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes… |
CVE-2022-35241 | Medium | 6.5 | 2022-08-04 | In versions 2.x before 2.3.1 and all versions of 1.x, when NGINX Instance Manager is in use, undisclosed requests can cause an increase in disk resource utiliz… |
CVE-2022-35236 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an HTTP2 profile is configured on a virtual server, undisclos… |
CVE-2022-33203 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when a BIG-IP APM access policy with Service Connect agent is config… |
CVE-2022-35923 | High | 7.5 | 2022-08-02 | v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and… |
CVE-2022-35922 | High | 7.5 | 2022-08-01 | Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory (OOM) p… |
CVE-2022-35915 | Medium | 5.3 | 2022-08-01 | OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas… |
CVE-2022-31173 | High | 7.5 | 2022-08-01 | Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue ha… |
CVE-2021-22642 | High | 7.5 | 2022-07-28 | An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system. |
CVE-2022-24294 | High | 7.5 | 2022-07-24 | A regular expression used in Apache MXNet (incubating) is vulnerable to a potential denial-of-service by excessive resource consumption. The bug could be explo… |
CVE-2020-21405 | High | 7.5 | 2022-07-20 | An issue was discovered in H96 Smart TV Box H96 Pro Plus allows attackers to corrupt files via calls to the saveDeepColorAttr service.unk |
CVE-2022-27937 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264. |
CVE-2022-2406 | Medium | 4.3 | 2022-07-14 | The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated atta… |
CVE-2022-31080 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31079 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31078 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31075 | Medium | 4.9 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31074 | Medium | 4.5 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31073 | Medium | 6.5 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-30792 | High | 7.5 | 2022-07-11 | In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel… |
CVE-2022-30791 | High | 7.5 | 2022-07-11 | In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing… |
CVE-2022-20808 | High | 7.7 | 2022-07-06 | A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to cause a denial of service (DoS) conditio… |
CVE-2022-31129 | High | 7.5 | 2022-07-06 | moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient p… |
CVE-2022-30591 | High | 7.5 | 2022-07-06 | quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 reques… |
CVE-2014-3648 | High | 7.5 | 2022-07-01 | The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controll… |
CVE-2022-31110 | Medium | 5.3 | 2022-06-29 | RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameter… |
CVE-2022-26477 | High | 7.5 | 2022-06-27 | The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may le… |
CVE-2022-31016 | Medium | 6.5 | 2022-06-25 | Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allo… |
CVE-2022-31803 | Medium | 5.3 | 2022-06-24 | In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP c… |
CVE-2022-29866 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggers Uncontrolled Resou… |
CVE-2022-29864 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontrolled Resource Consu… |
CVE-2022-27889 | Medium | 5.3 | 2022-06-14 | The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A maliciou… |
CVE-2022-31054 | High | 7.5 | 2022-06-13 | Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated… |
CVE-2022-29225 | High | 7.5 | 2022-06-09 | Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overw… |
CVE-2022-31030 | Medium | 5.5 | 2022-06-09 | containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containe… |
CVE-2022-1708 | High | 7.5 | 2022-06-07 | A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs co… |
CVE-2022-31028 | High | 7.5 | 2022-06-07 | MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO… |
CVE-2022-22556 | Low | 3.7 | 2022-06-02 | Dell PowerStore contains an Uncontrolled Resource Consumption Vulnerability in PowerStore User Interface. A remote unauthenticated attacker could potentially e… |
CVE-2022-1982 | Medium | 4.3 | 2022-06-02 | Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on… |
CVE-2022-31018 | High | 7.5 | 2022-06-02 | Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms lib… |
CVE-2022-27781 | High | 7.5 | 2022-06-02 | libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous fu… |
CVE-2022-1797 | Medium | 6.8 | 2022-06-02 | A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automation Logix Controller… |
CVE-2022-29243 | Medium | 4.3 | 2022-05-31 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size valida… |
CVE-2021-3629 | Medium | 5.9 | 2022-05-24 | A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of serv… |
CVE-2022-29202 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.ragged.constant` does n… |
CVE-2022-29177 | Medium | 5.9 | 2022-05-20 | Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to use high verbosity lo… |
CVE-2022-27640 | Medium | 6.5 | 2022-05-20 | A vulnerability has been identified in SIMATIC CP 442-1 RNA (All versions < V1.5.18), SIMATIC CP 443-1 RNA (All versions < V1.5.18). The affected devices impro… |
CVE-2022-30551 | High | 7.5 | 2022-05-20 | OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available r… |
CVE-2022-28191 | Medium | 5.5 | 2022-05-17 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where uncontrolled resource consumption can be triggered by an unprivileg… |
CVE-2021-33135 | Medium | 5.5 | 2022-05-12 | Uncontrolled resource consumption in the Linux kernel drivers for Intel(R) SGX may allow an authenticated user to potentially enable denial of service via loca… |
CVE-2022-1699 | High | 7.5 | 2022-05-12 | Uncontrolled Resource Consumption in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused by doing a DDoS attack for which ge… |
CVE-2022-29885 | High | 7.5 | 2022-05-12 | The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly… |
CVE-2022-29145 | High | 7.5 | 2022-05-10 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2022-29117 | High | 7.5 | 2022-05-10 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2022-24040 | Medium | 6.5 | 2022-05-10 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2022-24902 | Low | 2.9 | 2022-05-06 | TkVideoplayer is a simple library to play video files in tkinter. Uncontrolled memory consumption in versions of TKVideoplayer prior to 2.0.0 can theoretically… |
CVE-2022-29167 | High | 7.4 | 2022-05-05 | Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and re… |
CVE-2022-29480 | Medium | 5.3 | 2022-05-05 | On F5 BIG-IP 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when multiple route domains are configured, undisclosed requests to big3d… |
CVE-2022-28701 | High | 7.5 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause an increase in memory… |
CVE-2022-28691 | High | 7.5 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when a… |
CVE-2022-27182 | Medium | 5.3 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, when BIG-IP packet filters are enable… |
CVE-2022-27181 | Medium | 5.3 | 2022-05-05 | On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and… |
CVE-2022-26372 | High | 7.5 | 2022-05-05 | On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when… |
CVE-2022-1468 | Medium | 4.3 | 2022-05-05 | On all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user with at least guest role privil… |
CVE-2022-25779 | Medium | 4.3 | 2022-05-04 | Logging of Excessive Data vulnerability in audit log of Secomea GateManager allows logged in user to write text entries in audit log. This issue affects: Secom… |
CVE-2022-20760 | High | 8.6 | 2022-05-03 | A vulnerability in the DNS inspection handler of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an un… |
CVE-2022-22275 | High | 7.5 | 2022-04-27 | Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting… |
CVE-2021-43933 | Medium | 6.1 | 2022-04-20 | The affected product is vulnerable to a network-based attack by threat actors sending unimpeded requests to the receiving server, which could cause a denial-of… |
CVE-2022-24863 | High | 7.5 | 2022-04-18 | http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an atta… |
CVE-2022-20692 | High | 7.7 | 2022-04-15 | A vulnerability in the NETCONF over SSH feature of Cisco IOS XE Software could allow a low-privileged, authenticated, remote attacker to cause a denial of serv… |
CVE-2022-26498 | High | 7.5 | 2022-04-15 | An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much… |
CVE-2022-22191 | Medium | 6.5 | 2022-04-14 | A Denial of Service (DoS) vulnerability in the processing of a flood of specific ARP traffic in Juniper Networks Junos OS on the EX4300 switch, sent from the l… |
CVE-2021-41119 | Medium | 5.3 | 2022-04-13 | Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object c… |
CVE-2022-1337 | Medium | 4.3 | 2022-04-13 | The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attack… |
CVE-2022-21155 | High | 7.5 | 2022-04-12 | A specially crafted packet sent to the Fernhill SCADA Server Version 3.77 and earlier may cause an exception, causing the server process (FHSvrService.exe) to… |
CVE-2022-27194 | High | 7.5 | 2022-04-12 | A vulnerability has been identified in SIMATIC PCS neo (Administration Console) (All versions < V3.1 SP1), SINETPLAN (All versions), TIA Portal (V15, V15.1, V1… |
CVE-2022-25622 | Medium | 5.3 | 2022-04-12 | The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, improperly handles internal resources for TCP segments where the minimum TCP-Header le… |
CVE-2022-24839 | High | 7.5 | 2022-04-11 | org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` excepti… |
CVE-2022-24836 | High | 7.5 | 2022-04-11 | Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive back… |
CVE-2022-1099 | Medium | 4.3 | 2022-04-04 | Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an… |
CVE-2022-1210 | Medium | 4.3 | 2022-04-03 | A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious f… |
CVE-2022-0489 | Low | 3.5 | 2022-04-01 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a spec… |
CVE-2021-32503 | Medium | 4.9 | 2022-04-01 | Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use t… |
CVE-2022-0488 | Low | 3.5 | 2022-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a page with markdown by… |
CVE-2021-22100 | Medium | 5.3 | 2022-03-25 | In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally or maliciously) cau… |
CVE-2022-24729 | Medium | 6.5 | 2022-03-16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vu… |
CVE-2022-22145 | High | 8.1 | 2022-03-11 | CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption. CENTUM CS 3000 versions from… |
CVE-2022-24726 | High | 7.5 | 2022-03-10 | Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request proces… |
CVE-2021-3733 | Medium | 6.5 | 2022-03-10 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects… |
CVE-2022-24741 | Low | 3.5 | 2022-03-09 | Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading spec… |
CVE-2022-24464 | High | 7.5 | 2022-03-09 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2022-24713 | High | 7.5 | 2022-03-08 | regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks cau… |