CWE-400 · Uncontrolled Resource Consumption (page 25)
Page 25 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-47356 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47355 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47354 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-40513 | High | 7.5 | 2023-02-12 | Transient DOS due to uncontrolled resource consumption in WLAN firmware when peer is freed in non qos state. |
CVE-2022-38674 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services. |
CVE-2023-23631 | Medium | 5.9 | 2023-02-09 | github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 tr… |
CVE-2023-23625 | Medium | 5.9 | 2023-02-09 | go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and vi… |
CVE-2023-22799 | High | 7.5 | 2023-02-09 | A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engin… |
CVE-2023-22796 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the… |
CVE-2023-22795 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Mat… |
CVE-2023-22792 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially cr… |
CVE-2022-44572 | High | 7.5 | 2023-02-09 | A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft inp… |
CVE-2022-44571 | High | 7.5 | 2023-02-09 | There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an… |
CVE-2022-44570 | High | 7.5 | 2023-02-09 | A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing componen… |
CVE-2022-44566 | High | 7.5 | 2023-02-09 | A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer… |
CVE-2023-25151 | High | 7.5 | 2023-02-08 | opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelh… |
CVE-2022-40480 | Medium | 6.5 | 2023-02-08 | Nordic Semiconductor, Microchip Technology NRF5340-DK DT100112 was discovered to contain an issue which allows attackers to cause a Denial of Service (DoS) via… |
CVE-2022-42950 | Medium | 4.9 | 2023-02-06 | An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase… |
CVE-2023-23925 | High | 8.6 | 2023-02-03 | Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation (EXIST)… |
CVE-2023-24574 | High | 7.5 | 2023-02-02 | Dell Enterprise SONiC OS, 3.5.3, 4.0.0, 4.0.1, 4.0.2, contains an "Uncontrolled Resource Consumption vulnerability" in authentication component. An unauthenti… |
CVE-2023-23552 | High | 7.5 | 2023-02-01 | On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WA… |
CVE-2023-22664 | High | 7.5 | 2023-02-01 | On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP… |
CVE-2023-23616 | Low | 3.5 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, when… |
CVE-2023-22486 | Low | 3.5 | 2023-01-26 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time com… |
CVE-2023-20922 | Medium | 5.5 | 2023-01-26 | In setMimeGroup of PackageManagerService.java, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no ad… |
CVE-2023-20908 | Medium | 5.5 | 2023-01-26 | In several functions of SettingsState.java, there is a possible system crash loop due to resource exhaustion. This could lead to local denial of service with n… |
CVE-2022-3094 | High | 7.5 | 2023-01-26 | Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free me… |
CVE-2022-27508 | High | 7.5 | 2023-01-26 | Unauthenticated denial of service |
CVE-2022-27507 | Medium | 6.5 | 2023-01-26 | Authenticated denial of service |
CVE-2021-28510 | Medium | 5.3 | 2023-01-26 | For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PT… |
CVE-2023-22484 | Low | 3.5 | 2023-01-23 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial ti… |
CVE-2023-22483 | Low | 3.5 | 2023-01-23 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynom… |
CVE-2022-4816 | Medium | 6.2 | 2023-01-23 | A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the application. |
CVE-2023-20047 | Medium | 6.5 | 2023-01-20 | A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco Webex Room Phone and Cisco Webex Share devices could allow an unauthenticated, adj… |
CVE-2023-21838 | High | 7.5 | 2023-01-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1… |
CVE-2022-41861 | Medium | 6.5 | 2023-01-17 | A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash. |
CVE-2023-23590 | High | 7.5 | 2023-01-15 | Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated API request. The at… |
CVE-2023-22470 | Low | 3.5 | 2023-01-14 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A database error ca… |
CVE-2023-22400 | High | 7.5 | 2023-01-13 | An Uncontrolled Resource Consumption vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an unauthenticated, n… |
CVE-2023-22396 | High | 7.5 | 2023-01-13 | An Uncontrolled Resource Consumption vulnerability in TCP processing on the Routing Engine (RE) of Juniper Networks Junos OS allows an unauthenticated network-… |
CVE-2022-3613 | Medium | 5.8 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15… |
CVE-2022-4344 | Medium | 6.3 | 2023-01-12 | Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted captu… |
CVE-2022-34335 | Medium | 6.5 | 2023-01-11 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.1 could allow an authenticated user to exhaust server resources which could lead to a denial of… |
CVE-2023-21728 | High | 7.5 | 2023-01-10 | Windows Netlogon Denial of Service Vulnerability |
CVE-2023-21557 | High | 7.5 | 2023-01-10 | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability |
CVE-2023-21547 | High | 7.5 | 2023-01-10 | Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability |
CVE-2023-21543 | High | 8.1 | 2023-01-10 | Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability |
CVE-2021-32821 | Medium | 6.2 | 2023-01-03 | MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulnerable to Regular Expr… |
CVE-2022-46740 | Medium | 6.5 | 2022-12-28 | There is a denial of service vulnerability in the Wi-Fi module of the HUAWEI WS7100-20 Smart WiFi Router.Successful exploit could cause a denial of service (Do… |
CVE-2022-3064 | High | 7.5 | 2022-12-27 | Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory. |
CVE-2019-25072 | High | 7.5 | 2022-12-27 | Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a sig… |
CVE-2022-4767 | High | 7.5 | 2022-12-27 | Denial of Service in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-24118 | Critical | 9.1 | 2022-12-26 | Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration. This affects iNET… |
CVE-2022-47934 | Medium | 6.5 | 2022-12-24 | Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs… |
CVE-2022-47932 | Medium | 6.5 | 2022-12-24 | Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This vulne… |
CVE-2022-28229 | High | 7.5 | 2022-12-23 | The hash functionality in userver before 42059b6319661583b3080cab9b595d4f8ac48128 allows attackers to cause a denial of service via crafted HTTP request, invol… |
CVE-2022-39164 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Fo… |
CVE-2022-39165 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. IBM X-Force ID: 23… |
CVE-2022-40899 | High | 7.5 | 2022-12-23 | An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malici… |
CVE-2020-26302 | High | 7.5 | 2022-12-22 | is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of… |
CVE-2022-42929 | Medium | 6.5 | 2022-12-22 | If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending… |
CVE-2020-36620 | Low | 3.5 | 2022-12-21 | A vulnerability was found in Brondahl EnumStringValues up to 4.0.0. It has been declared as problematic. This vulnerability affects the function GetStringValue… |
CVE-2022-46315 | High | 7.5 | 2022-12-20 | The ProfileSDK has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability. |
CVE-2022-46399 | High | 7.5 | 2022-12-19 | The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZero. |
CVE-2022-23524 | Medium | 5.3 | 2022-12-15 | Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting i… |
CVE-2022-46352 | High | 7.5 | 2022-12-13 | A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HS… |
CVE-2022-46351 | Medium | 5.5 | 2022-12-13 | A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HS… |
CVE-2022-45044 | Medium | 5.3 | 2022-12-13 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.50), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All… |
CVE-2022-31698 | Medium | 5.3 | 2022-12-13 | The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Serv… |
CVE-2022-20482 | Medium | 5.5 | 2022-12-13 | In createNotificationChannel of NotificationManager.java, there is a possible way to make the device unusable and require factory reset due to resource exhaust… |
CVE-2022-43780 | High | 7.5 | 2022-12-12 | Certain HP ENVY, OfficeJet, and DeskJet printers may be vulnerable to a Denial of Service attack. |
CVE-2022-3510 | High | 7.5 | 2022-12-12 | A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 c… |
CVE-2022-3509 | High | 7.5 | 2022-12-12 | A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a… |
CVE-2022-37907 | Medium | 5.8 | 2022-12-12 | A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A su… |
CVE-2022-2794 | High | 7.5 | 2022-12-12 | Certain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack. |
CVE-2021-3821 | Critical | 9.8 | 2022-12-12 | A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Denial of Service when runni… |
CVE-2022-20691 | Medium | 5.3 | 2022-12-12 | A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Adaptive Telephone Adapter firmware could allow an unauthenticated, adjac… |
CVE-2022-23492 | High | 7.5 | 2022-12-08 | go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to targeted resource exha… |
CVE-2022-23471 | Medium | 5.7 | 2022-12-07 | containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stre… |
CVE-2022-23487 | High | 7.5 | 2022-12-07 | js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource… |
CVE-2022-23486 | High | 7.5 | 2022-12-07 | libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node t… |
CVE-2022-44608 | High | 7.5 | 2022-12-07 | Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huge storage space, w… |
CVE-2022-35254 | High | 7.5 | 2022-12-05 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R1… |
CVE-2022-30122 | High | 7.5 | 2022-12-05 | A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack. |
CVE-2022-41969 | Low | 2.4 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user… |
CVE-2022-41968 | Low | 3.5 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a dat… |
CVE-2022-41568 | High | 7.5 | 2022-11-29 | LINE client for iOS before 12.17.0 might be crashed by sharing an invalid shared key of e2ee in group chat. |
CVE-2022-39346 | Low | 3.5 | 2022-11-25 | Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a m… |
CVE-2022-45873 | Medium | 5.5 | 2022-11-23 | systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object… |
CVE-2022-41932 | High | 7.5 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create many new schemas an… |
CVE-2022-41952 | Medium | 6.5 | 2022-11-22 | Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection t… |
CVE-2022-38871 | High | 7.5 | 2022-11-18 | In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages. |
CVE-2022-4006 | Low | 3.7 | 2022-11-15 | A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/fra… |
CVE-2022-20854 | High | 7.5 | 2022-11-15 | A vulnerability in the processing of SSH connections of Cisco Firepower Management Center (FMC) and Cisco Firepower Threat Defense (FTD) Software could allow a… |
CVE-2022-40735 | High | 7.5 | 2022-11-14 | The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oo… |
CVE-2022-45199 | High | 7.5 | 2022-11-14 | Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. |
CVE-2022-30691 | Medium | 5.9 | 2022-11-11 | Uncontrolled resource consumption in the Intel(R) Support Android application before version 22.02.28 may allow an authenticated user to potentially enable den… |
CVE-2022-3818 | Medium | 5.3 | 2022-11-10 | An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15… |
CVE-2022-43572 | High | 7.5 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Collector (HEC) protoco… |
CVE-2022-43564 | Medium | 4.9 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user who can create search macros and schedule search reports can cause a denial of serv… |