CWE-400 · Uncontrolled Resource Consumption (page 24)
Page 24 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3737 | High | 7.5 | 2022-03-04 | A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to… |
CVE-2022-23328 | High | 7.5 | 2022-03-04 | A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spen… |
CVE-2022-25326 | Medium | 5.5 | 2022-02-25 | fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We… |
CVE-2021-4021 | High | 7.5 | 2022-02-24 | A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2. Mapping a huge section filled with zeros of an ELF64 binary for MIPS a… |
CVE-2022-0695 | Medium | 5.5 | 2022-02-24 | Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4. |
CVE-2022-24678 | High | 7.5 | 2022-02-24 | An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Busine… |
CVE-2022-20624 | High | 8.6 | 2022-02-23 | A vulnerability in the Cisco Fabric Services over IP (CFSoIP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial… |
CVE-2022-0476 | Medium | 5.5 | 2022-02-23 | Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4. |
CVE-2021-4115 | Medium | 5.5 | 2022-02-21 | There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from thi… |
CVE-2022-0671 | Critical | 9.1 | 2022-02-18 | A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file. |
CVE-2022-21698 | High | 7.5 | 2022-02-15 | client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers… |
CVE-2022-22780 | Medium | 4.7 | 2022-02-09 | The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS bef… |
CVE-2022-22543 | High | 7.5 | 2022-02-09 | SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC… |
CVE-2021-0092 | Medium | 4.4 | 2022-02-09 | Improper access control in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access. |
CVE-2013-20004 | Critical | 9.8 | 2022-02-06 | A flaw was found in StarWind iSCSI target. StarWind service does not limit client connections and allocates memory on each connection attempt. An attacker coul… |
CVE-2007-20001 | High | 7.5 | 2022-02-06 | A flaw was found in StarWind iSCSI target. An attacker could script standard iSCSI Initiator operation(s) to exhaust the StarWind service socket, which could l… |
CVE-2022-23591 | High | 7.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that… |
CVE-2022-23580 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controll… |
CVE-2022-22724 | High | 7.5 | 2022-02-04 | A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus), when sending a larg… |
CVE-2021-43859 | High | 7.5 | 2022-02-01 | XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU ti… |
CVE-2021-46668 | Medium | 5.5 | 2022-02-01 | MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitation… |
CVE-2021-40406 | High | 7.5 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP… |
CVE-2022-23030 | Medium | 5.3 | 2022-01-25 | On version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when the BIG-IP Virtual Edition (VE) uses the ixlv… |
CVE-2022-23024 | High | 7.5 | 2022-01-25 | On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.2, and all versions of 13.1.x, when the IPsec application layer gateway… |
CVE-2022-23023 | Medium | 6.5 | 2022-01-25 | On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, and BIG-IQ all versions of 8.x a… |
CVE-2022-23015 | High | 7.5 | 2022-01-25 | On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, and 14.1.2.6-14.1.4.4, when a Client SSL profile is configured on a virtual server with Client C… |
CVE-2022-21708 | Medium | 6.5 | 2022-01-21 | graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the li… |
CVE-2021-23236 | High | 7.5 | 2022-01-21 | Requests may be used to interrupt the normal operation of the device. When exploited, Fresenius Kabi Agilia Link+ version 3.0 must be rebooted via a hard reset… |
CVE-2022-21366 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are… |
CVE-2022-21360 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are… |
CVE-2022-21340 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a… |
CVE-2022-21299 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Or… |
CVE-2022-21293 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a… |
CVE-2022-21277 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are… |
CVE-2022-22161 | High | 7.5 | 2022-01-19 | An Uncontrolled Resource Consumption vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated network based attacker to cause 100% CP… |
CVE-2022-22155 | Medium | 6.5 | 2022-01-19 | An Uncontrolled Resource Consumption vulnerability in the handling of IPv6 neighbor state change events in Juniper Networks Junos OS allows an adjacent attacke… |
CVE-2022-21700 | Medium | 5.3 | 2022-01-18 | Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affect… |
CVE-2022-21689 | High | 7.5 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2021-39942 | Medium | 4.3 | 2022-01-18 | A denial of service vulnerability in GitLab CE/EE affecting all versions starting from 12.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all v… |
CVE-2021-37865 | Medium | 4.3 | 2022-01-18 | Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated… |
CVE-2022-21681 | High | 7.5 | 2022-01-14 | Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against so… |
CVE-2022-21680 | High | 7.5 | 2022-01-14 | Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings… |
CVE-2021-30301 | High | 7.5 | 2022-01-13 | Possible denial of service due to out of memory while processing RRC and NAS OTA message in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile |
CVE-2022-21670 | Medium | 5.3 | 2022-01-10 | markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser signific… |
CVE-2021-46149 | High | 7.5 | 2022-01-10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplis… |
CVE-2021-40011 | High | 7.5 | 2022-01-10 | There is an uncontrolled resource consumption vulnerability in the display module. Successful exploitation of this vulnerability may affect integrity. |
CVE-2020-9060 | Medium | 6.5 | 2022-01-10 | Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, Zo… |
CVE-2020-9059 | Medium | 6.5 | 2022-01-10 | Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resource consumption leading to battery exhaus… |
CVE-2022-21653 | Medium | 5.9 | 2022-01-05 | Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext… |
CVE-2021-24893 | High | 7.5 | 2022-01-03 | The Stars Rating WordPress plugin before 3.5.1 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the… |
CVE-2021-30348 | Medium | 6.5 | 2022-01-03 | Improper validation of LLM utility timers availability can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrago… |
CVE-2021-44716 | High | 7.5 | 2022-01-01 | net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests. |
CVE-2021-3622 | Medium | 4.3 | 2021-12-23 | A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive) file, which would cause hivex to recur… |
CVE-2021-43854 | High | 7.5 | 2021-12-23 | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Proc… |
CVE-2021-43843 | Medium | 5.3 | 2021-12-20 | jsx-slack is a package for building JSON objects for Slack block kit surfaces from JSX. The maintainers found the patch for CVE-2021-43838 in jsx-slack v4.5.1… |
CVE-2021-43838 | Medium | 5.3 | 2021-12-17 | jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression… |
CVE-2021-39939 | Medium | 6.5 | 2021-12-13 | An uncontrolled resource consumption vulnerability in GitLab Runner affecting all versions starting from 13.7 before 14.3.6, all versions starting from 14.4 be… |
CVE-2021-39938 | Low | 3.1 | 2021-12-13 | A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting… |
CVE-2021-44228 | Critical | 10.0 | 2021-12-10 | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameter… |
CVE-2021-41014 | High | 7.5 | 2021-12-08 | A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to make the httpsd daemon… |
CVE-2021-37061 | High | 7.5 | 2021-12-07 | There is a Uncontrolled Resource Consumption vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Screen projection app… |
CVE-2021-44527 | Medium | 6.5 | 2021-12-07 | A vulnerability found in UniFi Switch firmware Version 5.43.35 and earlier allows a malicious actor who has already gained access to the network to perform a D… |
CVE-2021-22956 | High | 7.5 | 2021-12-07 | An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSI… |
CVE-2021-22955 | High | 7.5 | 2021-12-07 | A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when configured as a VPN (Gateway) or AAA virtua… |
CVE-2021-44686 | High | 7.5 | 2021-12-07 | calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conve… |
CVE-2021-20609 | High | 7.5 | 2021-12-01 | Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, MELSEC iQ-R… |
CVE-2021-42120 | Medium | 6.5 | 2021-11-30 | Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on all object attributes allow… |
CVE-2021-36310 | Medium | 4.9 | 2021-11-20 | Dell Networking OS10, versions 10.4.3.x, 10.5.0.x, 10.5.1.x & 10.5.2.x, contain an uncontrolled resource consumption flaw in its API service. A high-privileged… |
CVE-2021-22965 | High | 7.5 | 2021-11-19 | A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is… |
CVE-2021-33073 | Medium | 5.5 | 2021-11-17 | Uncontrolled resource consumption in the Intel(R) Distribution of OpenVINOâ„¢ Toolkit before version 2021.4 may allow an unauthenticated user to potentially en… |
CVE-2021-0182 | Medium | 6.2 | 2021-11-17 | Uncontrolled resource consumption in the Intel(R) HAXM software before version 7.6.6 may allow an unauthenticated user to potentially enable information disclo… |
CVE-2021-0180 | High | 8.4 | 2021-11-17 | Uncontrolled resource consumption in the Intel(R) HAXM software before version 7.6.6 may allow an unauthenticated user to potentially enable privilege escalati… |
CVE-2021-41229 | Medium | 4.3 | 2021-11-12 | BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be… |
CVE-2021-3912 | Medium | 4.2 | 2021-11-11 | OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a reposi… |
CVE-2021-3909 | Medium | 4.4 | 2021-11-11 | OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repo… |
CVE-2021-3908 | Medium | 5.9 | 2021-11-11 | OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end. |
CVE-2002-20001 | High | 7.5 | 2021-11-11 | The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigg… |
CVE-2021-43173 | High | 7.5 | 2021-11-09 | In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to… |
CVE-2021-39914 | Low | 3.1 | 2021-11-04 | A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a spe… |
CVE-2021-36187 | Medium | 5.3 | 2021-11-02 | A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service… |
CVE-2021-32595 | Medium | 6.5 | 2021-11-02 | Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a… |
CVE-2020-21573 | Medium | 5.5 | 2021-11-02 | An issue was discoverered in in abhijitnathwani image-processing v0.1.0, allows local attackers to cause a denial of service via a crafted image file. |
CVE-2021-41186 | Medium | 5.9 | 2021-10-29 | Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14… |
CVE-2020-10005 | Medium | 6.5 | 2021-10-28 | A resource exhaustion issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1. An attacker in a privileged network posi… |
CVE-2021-40125 | Medium | 5.3 | 2021-10-27 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat De… |
CVE-2021-40117 | High | 8.6 | 2021-10-27 | A vulnerability in SSL/TLS message handler for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow a… |
CVE-2021-34792 | High | 8.6 | 2021-10-27 | A vulnerability in the memory management of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthe… |
CVE-2021-22101 | High | 7.5 | 2021-10-27 | Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause d… |
CVE-2021-41145 | High | 8.6 | 2021-10-25 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2021-42836 | High | 7.5 | 2021-10-22 | GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack. |
CVE-2021-38465 | High | 8.0 | 2021-10-22 | The webinstaller is a Golang web server executable that enables the generation of an Auvesy image agent. Resource consumption can be achieved by generating lar… |
CVE-2021-38463 | High | 7.3 | 2021-10-22 | The affected product does not properly control the allocation of resources. A user may be able to allocate unlimited memory buffers using API functions. |
CVE-2021-41168 | Medium | 6.5 | 2021-10-21 | Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown was found to be vu… |
CVE-2021-41167 | High | 7.5 | 2021-10-20 | modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two… |
CVE-2021-35559 | Medium | 5.3 | 2021-10-20 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE… |
CVE-2021-31368 | High | 7.5 | 2021-10-19 | An Uncontrolled Resource Consumption vulnerability in the kernel of Juniper Networks JUNOS OS allows an unauthenticated network based attacker to cause 100% CP… |
CVE-2021-31365 | Medium | 6.5 | 2021-10-19 | An Uncontrolled Resource Consumption vulnerability in Juniper Networks Junos OS on EX2300, EX3400 and EX4300 Series platforms allows an adjacent attacker sendi… |
CVE-2021-37137 | High | 7.5 | 2021-10-19 | The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable… |
CVE-2021-37136 | High | 7.5 | 2021-10-19 | The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during… |
CVE-2021-22964 | High | 8.8 | 2021-10-14 | A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox users to arbitrary web… |