CWE-400 · Uncontrolled Resource Consumption (page 25)
Page 25 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-33609 | Medium | 4.3 | 2021-10-13 | Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network at… |
CVE-2021-41546 | High | 7.5 | 2021-10-12 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All… |
CVE-2021-20600 | Medium | 5.9 | 2021-10-08 | Uncontrolled resource consumption in Mitsubishi Electric MELSEC iQ-R series C Controller Module R12CCPU-V Firmware Versions "16" and prior allows a remote unau… |
CVE-2021-41115 | Medium | 4.3 | 2021-10-07 | Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automaticall… |
CVE-2021-41118 | Medium | 5.3 | 2021-10-04 | The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. In affected vers… |
CVE-2021-39877 | High | 7.7 | 2021-10-04 | A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with a specially crafted… |
CVE-2021-3822 | High | 7.5 | 2021-09-27 | jsoneditor is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-22010 | High | 7.5 | 2021-09-23 | The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter Server may exploit… |
CVE-2021-39229 | High | 7.5 | 2021-09-20 | Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versio… |
CVE-2021-32838 | High | 7.5 | 2021-09-20 | Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expressio… |
CVE-2021-32839 | High | 7.5 | 2021-09-20 | sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vul… |
CVE-2021-23042 | High | 7.5 | 2021-09-14 | On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when an HTTP profile is c… |
CVE-2021-23047 | Medium | 5.3 | 2021-09-14 | On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, and all versions of 13.1.x, 12.1.x and 11.6.x, when BIG-IP APM performs Online C… |
CVE-2021-23053 | Medium | 5.3 | 2021-09-14 | On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP Advanced WAF or BIG-IP A… |
CVE-2021-23049 | High | 7.5 | 2021-09-14 | On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, undisclosed request… |
CVE-2020-9000 | High | 7.5 | 2021-09-01 | An issue was discovered in iPortalis iCS 7.1.13.0. Attackers can send a sequence of requests to rapidly cause .NET Input Validation errors. This increases the… |
CVE-2021-3749 | High | 7.5 | 2021-08-31 | axios is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-32832 | Medium | 4.3 | 2021-08-30 | Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an is… |
CVE-2021-39171 | Medium | 5.3 | 2021-08-27 | Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can requ… |
CVE-2021-33580 | High | 7.5 | 2021-08-18 | User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The atta… |
CVE-2021-0008 | Medium | 4.4 | 2021-08-11 | Uncontrolled resource consumption in firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow pr… |
CVE-2021-25659 | High | 7.5 | 2021-08-10 | A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0 SP9 Update 2). Sending sp… |
CVE-2021-3679 | Medium | 5.5 | 2021-08-05 | A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace ring buffer in a spe… |
CVE-2021-22124 | High | 7.5 | 2021-08-04 | An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0… |
CVE-2021-21565 | Medium | 5.3 | 2021-08-03 | Dell PowerScale OneFS versions 9.1.0.3 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop… |
CVE-2021-25701 | Medium | 5.5 | 2021-07-21 | The fUSBHub driver in the PCoIP Software Client prior to version 21.07.0 had an error in object management during the handling of a variety of IOCTLs, which al… |
CVE-2020-20221 | Medium | 6.5 | 2021-07-21 | Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process. An authenticate… |
CVE-2021-32763 | Medium | 4.3 | 2021-07-20 | OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProject has a `quote` met… |
CVE-2020-20248 | Medium | 6.5 | 2021-07-19 | Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the memtest process. An authenticated remote attacker can cause a Den… |
CVE-2020-20230 | Medium | 6.5 | 2021-07-19 | Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the sshd process. An authenticated remote attacker can cause a Denial… |
CVE-2021-32014 | Medium | 5.5 | 2021-07-19 | SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when rea… |
CVE-2021-32013 | Medium | 5.5 | 2021-07-19 | SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when… |
CVE-2021-32012 | Medium | 5.5 | 2021-07-19 | SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when… |
CVE-2021-0292 | Medium | 6.5 | 2021-07-15 | An Uncontrolled Resource Consumption vulnerability in the ARP daemon (arpd) and Network Discovery Protocol (ndp) process of Juniper Networks Junos OS Evolved a… |
CVE-2021-0285 | High | 7.5 | 2021-07-15 | An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker sending large a… |
CVE-2021-36716 | High | 7.5 | 2021-07-14 | A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide cra… |
CVE-2020-20217 | Medium | 6.5 | 2021-07-08 | Mikrotik RouterOs before 6.47 (stable tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/route process. An authenticated re… |
CVE-2021-32740 | High | 7.5 | 2021-07-06 | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerabil… |
CVE-2021-22119 | High | 7.5 | 2021-06-29 | Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (Do… |
CVE-2021-34549 | High | 7.5 | 2021-06-29 | An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can t… |
CVE-2021-33503 | High | 7.5 | 2021-06-29 | An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expre… |
CVE-2021-32723 | High | 7.4 | 2021-06-28 | Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to high… |
CVE-2021-32722 | Medium | 6.5 | 2021-06-28 | GlobalNewFiles is a mediawiki extension. Versions prior to 48be7adb70568e20e961ea1cb70904454a671b1d are affected by an uncontrolled resource consumption vulner… |
CVE-2021-32823 | Low | 3.7 | 2021-06-24 | In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in… |
CVE-2021-32699 | Medium | 6.5 | 2021-06-22 | Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vulnerable t… |
CVE-2021-33824 | High | 7.5 | 2021-06-18 | An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make… |
CVE-2021-33822 | High | 7.5 | 2021-06-18 | An issue was discovered on 4GEE ROUTER HH70VB Version HH70_E1_02.00_22. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make s… |
CVE-2021-33818 | High | 7.5 | 2021-06-18 | An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. Attackers can use slowhttptest tool to send incomplete HTTP request, which coul… |
CVE-2020-8299 | Medium | 6.5 | 2021-06-16 | Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Editio… |
CVE-2021-30468 | High | 7.5 | 2021-06-16 | A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread gettin… |
CVE-2021-22906 | Medium | 6.5 | 2021-06-11 | Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authenticated users to lock… |
CVE-2021-22904 | High | 7.5 | 2021-06-11 | The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Ac… |
CVE-2021-22902 | High | 7.5 | 2021-06-11 | The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vu… |
CVE-2021-22181 | High | 7.7 | 2021-06-11 | A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust… |
CVE-2021-20591 | High | 7.5 | 2021-06-11 | Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R00/01/02CPU all versions, R04/08/16/32/120(EN)CPU all v… |
CVE-2020-12296 | Medium | 5.5 | 2021-06-09 | Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via loca… |
CVE-2020-12291 | Medium | 5.5 | 2021-06-09 | Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via loca… |
CVE-2021-23852 | Medium | 4.9 | 2021-06-09 | An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive fo… |
CVE-2021-31340 | High | 7.5 | 2021-06-08 | A vulnerability has been identified in SIMATIC RF166C (All versions > V1.1 and < V1.3.2), SIMATIC RF185C (All versions > V1.1 and < V1.3.2), SIMATIC RF186C (Al… |
CVE-2021-22216 | Medium | 6.5 | 2021-06-08 | A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumpt… |
CVE-2021-26945 | Medium | 5.5 | 2021-06-08 | An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application co… |
CVE-2021-26260 | Medium | 5.5 | 2021-06-08 | An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to cr… |
CVE-2021-23215 | Medium | 5.5 | 2021-06-08 | An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to cr… |
CVE-2021-22116 | High | 7.5 | 2021-06-08 | RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A… |
CVE-2020-1750 | Medium | 6.5 | 2021-06-07 | A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amount of memory. An att… |
CVE-2021-1564 | Medium | 6.5 | 2021-06-04 | Multiple vulnerabilities in the implementation of the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) for Cisco Video Surveillance 7000 Serie… |
CVE-2021-1563 | Medium | 6.5 | 2021-06-04 | Multiple vulnerabilities in the implementation of the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) for Cisco Video Surveillance 7000 Serie… |
CVE-2020-28469 | Medium | 5.3 | 2021-06-03 | This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator. |
CVE-2020-35510 | Medium | 5.9 | 2021-06-02 | A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by… |
CVE-2020-14340 | Medium | 5.9 | 2021-06-02 | A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It… |
CVE-2020-14326 | High | 7.5 | 2021-06-02 | A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CP… |
CVE-2021-32657 | Medium | 4.3 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may… |
CVE-2021-33623 | High | 7.5 | 2021-05-28 | The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() met… |
CVE-2021-20237 | High | 7.5 | 2021-05-28 | An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. This flaw allows a remote unauthenticated… |
CVE-2021-20201 | Medium | 5.3 | 2021-05-28 | A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service (CPU consumption) by pe… |
CVE-2020-1702 | Low | 3.3 | 2021-05-27 | A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using pod… |
CVE-2018-10868 | High | 7.5 | 2021-05-26 | redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user to run a "… |
CVE-2020-25673 | Medium | 5.5 | 2021-05-26 | A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak and eventually hanging-up the system. |
CVE-2021-32640 | Medium | 5.3 | 2021-05-25 | ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significa… |
CVE-2020-36332 | High | 7.5 | 2021-05-21 | A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threat from this vulnera… |
CVE-2021-20718 | High | 7.5 | 2021-05-20 | mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors. |
CVE-2021-32617 | Medium | 4.7 | 2021-05-17 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm (quadratic… |
CVE-2021-32455 | Medium | 6.8 | 2021-05-17 | SITEL CAP/PRX firmware version 5.2.01, allows an attacker with access to the device´s network to cause a denial of service condition on the device. An attacker… |
CVE-2021-32816 | Medium | 6.5 | 2021-05-14 | ProtonMail Web Client is the official AngularJS web client for the ProtonMail secure email service. ProtonMail Web Client before version 3.16.60 has a regular… |
CVE-2021-29506 | Medium | 6.5 | 2021-05-13 | GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerabilit… |
CVE-2021-22139 | Medium | 6.5 | 2021-05-13 | Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request siz… |
CVE-2021-32918 | High | 7.5 | 2021-05-13 | An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaust… |
CVE-2021-27385 | High | 7.5 | 2021-05-12 | A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI C… |
CVE-2020-25242 | High | 7.5 | 2021-05-12 | A vulnerability has been identified in SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Lean (incl. SIPLUS variants)… |
CVE-2021-29509 | High | 7.5 | 2021-05-11 | Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connection… |
CVE-2021-29471 | Low | 3.7 | 2021-05-11 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-30504 | High | 7.5 | 2021-05-11 | In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation. |
CVE-2021-32053 | Medium | 5.3 | 2021-05-10 | JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occ… |
CVE-2021-23011 | High | 7.5 | 2021-05-10 | On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, when th… |
CVE-2021-21419 | Medium | 5.3 | 2021-05-07 | Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious… |
CVE-2021-31409 | High | 7.5 | 2021-05-06 | Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12… |
CVE-2021-1275 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2020-28944 | High | 7.5 | 2021-04-30 | OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data. |
CVE-2021-1489 | Medium | 6.5 | 2021-04-29 | A vulnerability in filesystem usage management for Cisco Firepower Device Manager (FDM) Software could allow an authenticated, remote attacker to exhaust files… |
CVE-2021-21391 | Medium | 6.5 | 2021-04-29 | CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list… |