CWE-400 · Uncontrolled Resource Consumption (page 24)
Page 24 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25568 | High | 8.2 | 2023-05-10 | Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able alloca… |
CVE-2023-25179 | Medium | 5.0 | 2023-05-10 | Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authenticated user to potentially enable denial o… |
CVE-2022-46645 | Medium | 5.0 | 2023-05-10 | Uncontrolled resource consumption in the Intel(R) Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable den… |
CVE-2022-41801 | Medium | 5.0 | 2023-05-10 | Uncontrolled resource consumption in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated user to potentially enable denia… |
CVE-2022-4008 | Medium | 5.5 | 2023-05-10 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service |
CVE-2023-29333 | Low | 3.3 | 2023-05-09 | Microsoft Access Denial of Service Vulnerability |
CVE-2023-22874 | Medium | 5.5 | 2023-05-05 | IBM MQ Clients 9.2 CD, 9.3 CD, and 9.3 LTS are vulnerable to a denial of service attack when processing configuration files. IBM X-Force ID: 244216. |
CVE-2023-24594 | Medium | 5.3 | 2023-05-03 | When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization. Note: Soft… |
CVE-2023-28882 | High | 7.5 | 2023-04-28 | Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in t… |
CVE-2023-30408 | Medium | 5.5 | 2023-04-24 | Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry. |
CVE-2023-30406 | Medium | 5.5 | 2023-04-24 | Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c. |
CVE-2023-29479 | Medium | 5.3 | 2023-04-24 | Ribose RNP before 0.16.3 may hang when the input is malformed. |
CVE-2023-30798 | High | 7.5 | 2023-04-21 | There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number o… |
CVE-2023-27652 | Medium | 5.5 | 2023-04-20 | An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _d… |
CVE-2022-24109 | Medium | 6.5 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. To attack an intent installed by a normal user, a remote attacker can install a duplicate intent with a different key, a… |
CVE-2022-24035 | High | 7.5 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. The purge-requested intent remains on the list, but it does not respond to changes in topology (e.g., link failure). In… |
CVE-2023-0384 | Medium | 6.5 | 2023-04-20 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption for a scheduled… |
CVE-2023-0383 | High | 7.5 | 2023-04-20 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption. |
CVE-2023-21090 | Medium | 5.0 | 2023-04-19 | In parseUsesPermission of ParsingPackageUtils.java, there is a possible boot loop due to resource exhaustion. This could lead to local denial of service with n… |
CVE-2023-28440 | Low | 2.7 | 2023-04-18 | Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a… |
CVE-2023-26048 | Medium | 5.3 | 2023-04-18 | Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `H… |
CVE-2023-21996 | High | 7.5 | 2023-04-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.3.0… |
CVE-2023-21964 | High | 7.5 | 2023-04-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2023-21925 | Medium | 5.3 | 2023-04-18 | Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Supported versions that are affected are… |
CVE-2023-30769 | Critical | 9.1 | 2023-04-17 | Vulnerability discovered is related to the peer-to-peer (p2p) communications, attackers can craft consensus messages, send it to individual nodes and take them… |
CVE-2022-40946 | High | 7.5 | 2023-04-16 | On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a Denial of Service via the sys_token parameter in a cgi-bin/web… |
CVE-2021-39295 | High | 7.5 | 2023-04-15 | In OpenBMC 2.9, crafted IPMI messages allow an attacker to cause a denial of service to the BMC via the netipmid (IPMI lan+) interface. |
CVE-2023-29013 | High | 7.5 | 2023-04-14 | Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP… |
CVE-2023-27643 | High | 7.5 | 2023-04-14 | An issue found in POWERAMP 925-bundle-play and Poweramp 954-uni allows a remote attacker to cause a denial of service via the Rescan button in Queue and Select… |
CVE-2023-30635 | High | 7.5 | 2023-04-13 | TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error) upon an attempt to get a timestamp from the Placement Driver. |
CVE-2023-20863 | Medium | 6.5 | 2023-04-13 | In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may c… |
CVE-2023-1994 | Medium | 6.3 | 2023-04-12 | GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file |
CVE-2023-24545 | High | 7.5 | 2023-04-12 | On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malf… |
CVE-2023-1992 | Medium | 6.3 | 2023-04-12 | RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file |
CVE-2023-28217 | High | 7.5 | 2023-04-11 | Windows Network Address Translation (NAT) Denial of Service Vulnerability |
CVE-2023-24860 | High | 7.5 | 2023-04-11 | Microsoft Defender Denial of Service Vulnerability |
CVE-2023-29185 | Medium | 5.3 | 2023-04-11 | SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated… |
CVE-2023-28763 | Medium | 6.5 | 2023-04-11 | SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a non-administrati… |
CVE-2023-27191 | High | 7.5 | 2023-04-11 | An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files. |
CVE-2023-24534 | High | 7.5 | 2023-04-06 | HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual… |
CVE-2023-1787 | Medium | 4.3 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A search timeo… |
CVE-2023-1071 | Low | 3.1 | 2023-04-05 | An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting fro… |
CVE-2023-1733 | Medium | 5.8 | 2023-04-05 | A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.1… |
CVE-2023-28342 | High | 7.5 | 2023-04-05 | Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API. |
CVE-2023-20051 | Medium | 5.8 | 2023-04-05 | A vulnerability in the Vector Packet Processor (VPP) of Cisco Packet Data Network Gateway (PGW) could allow an unauthenticated, remote attacker to stop ICMP tr… |
CVE-2023-0382 | Medium | 6.5 | 2023-04-05 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption. |
CVE-2023-27734 | Medium | 5.5 | 2023-04-04 | An issue found in Eteran edb-debugger v.1.3.0 allows a local attacker to causea denial of service via the collect_symbols function in plugins/BinaryInfo/symbol… |
CVE-2023-26437 | Low | 3.4 | 2023-04-04 | Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through… |
CVE-2020-19850 | Medium | 6.5 | 2023-04-04 | An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests. |
CVE-2023-28837 | Medium | 4.9 | 2023-04-03 | Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of… |
CVE-2023-1580 | High | 7.5 | 2023-04-02 | Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and earlier allows an attacker to cause a denial of service by filling… |
CVE-2023-26485 | Medium | 5.3 | 2023-03-31 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to u… |
CVE-2023-24824 | Medium | 5.3 | 2023-03-31 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to u… |
CVE-2022-4899 | High | 7.5 | 2023-03-31 | A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun. |
CVE-2023-29139 | Medium | 6.5 | 2023-03-31 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. When a user with checkuserlog permissions makes many CheckUserLog API requests… |
CVE-2023-28846 | Medium | 5.9 | 2023-03-30 | Unpoly is a JavaScript framework for server-side web applications. There is a possible Denial of Service (DoS) vulnerability in the `unpoly-rails` gem that imp… |
CVE-2023-28644 | Medium | 5.7 | 2023-03-30 | Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server p… |
CVE-2023-28507 | Critical | 9.8 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a memory-exhaustio… |
CVE-2023-28626 | Medium | 5.3 | 2023-03-28 | comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A range of quadratic parsing issues are present in Comrak. These can be u… |
CVE-2022-48351 | High | 7.5 | 2023-03-27 | The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect availability. |
CVE-2023-1654 | High | 7.8 | 2023-03-27 | Denial of Service in GitHub repository gpac/gpac prior to 2.4.0. |
CVE-2023-21061 | High | 7.5 | 2023-03-24 | Product: AndroidVersions: Android kernelAndroid ID: A-229255400References: N/A |
CVE-2023-21033 | Medium | 5.5 | 2023-03-24 | In addNetwork of WifiManager.java, there is a possible way to trigger a persistent DoS due to resource exhaustion. This could lead to local denial of service w… |
CVE-2023-20911 | High | 7.8 | 2023-03-24 | In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due to resource exhaustion. This could lead… |
CVE-2023-20910 | Medium | 5.5 | 2023-03-24 | In add of WifiNetworkSuggestionsManager.java, there is a possible way to trigger permanent DoS due to resource exhaustion. This could lead to local denial of s… |
CVE-2023-20861 | Medium | 6.5 | 2023-03-23 | In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provid… |
CVE-2023-0056 | Medium | 6.5 | 2023-03-23 | An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote atta… |
CVE-2023-1605 | High | 7.5 | 2023-03-23 | Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6. |
CVE-2022-45003 | High | 7.5 | 2023-03-22 | Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus. |
CVE-2023-24862 | Medium | 5.5 | 2023-03-14 | Windows Secure Channel Denial of Service Vulnerability |
CVE-2023-23411 | Medium | 6.5 | 2023-03-14 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2023-23396 | Medium | 6.5 | 2023-03-14 | Microsoft Excel Denial of Service Vulnerability |
CVE-2023-27270 | Medium | 6.5 | 2023-03-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulne… |
CVE-2023-25618 | Medium | 6.5 | 2023-03-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulne… |
CVE-2023-27530 | High | 7.5 | 2023-03-10 | A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to… |
CVE-2023-1072 | Medium | 4.3 | 2023-03-09 | An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions star… |
CVE-2023-27484 | Medium | 6.2 | 2023-03-09 | crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions an already highly p… |
CVE-2023-27483 | Medium | 5.9 | 2023-03-09 | crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has… |
CVE-2022-41333 | High | 7.5 | 2023-03-07 | An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allo… |
CVE-2022-3277 | Medium | 6.5 | 2023-03-06 | An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for a… |
CVE-2023-26601 | High | 7.5 | 2023-03-06 | Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow De… |
CVE-2021-36395 | High | 7.5 | 2023-03-06 | In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. |
CVE-2023-27567 | High | 7.5 | 2023-03-03 | In OpenBSD 7.2, a TCP packet with destination port 0 that matches a pf divert-to rule can crash the kernel. |
CVE-2023-26470 | Medium | 5.7 | 2023-03-02 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusable by adding an o… |
CVE-2022-38734 | High | 7.5 | 2023-03-02 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0.8 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploit could l… |
CVE-2023-20014 | High | 7.5 | 2023-03-01 | A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) c… |
CVE-2022-41724 | High | 7.5 | 2023-02-28 | Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respecti… |
CVE-2023-23689 | Medium | 5.3 | 2023-02-28 | Dell PowerScale nodes A200, A2000, H400, H500, H600, H5600, F800, F810 integrated hardware management software contains an uncontrolled resource consumption v… |
CVE-2022-20455 | Medium | 5.5 | 2023-02-28 | In addAutomaticZenRule of ZenModeHelper.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of s… |
CVE-2023-23524 | High | 7.5 | 2023-02-27 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in tvOS 16.3.2, iOS 16.3.1 and iPadOS 16.3.1, watchOS 9.3.1, macOS… |
CVE-2023-26104 | High | 7.5 | 2023-02-25 | All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters th… |
CVE-2023-25816 | Medium | 4.3 | 2023-02-25 | Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can co… |
CVE-2023-23296 | Medium | 6.5 | 2023-02-23 | Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault. |
CVE-2023-23009 | Medium | 6.5 | 2023-02-21 | Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length. |
CVE-2023-0662 | High | 7.5 | 2023-02-16 | In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and e… |
CVE-2023-24580 | High | 7.5 | 2023-02-15 | An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an… |
CVE-2023-0518 | Medium | 4.3 | 2023-02-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versio… |
CVE-2022-3759 | Medium | 4.3 | 2023-02-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versio… |
CVE-2022-3411 | Medium | 6.5 | 2023-02-13 | A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated… |
CVE-2022-47370 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services. |