CWE-400 · Uncontrolled Resource Consumption (page 26)
Page 26 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-29469 | Medium | 5.3 | 2021-04-23 | Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause… |
CVE-2021-31405 | High | 7.5 | 2021-04-23 | Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 thr… |
CVE-2020-36320 | High | 7.5 | 2021-04-23 | Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allows attackers to cau… |
CVE-2021-0257 | Medium | 6.5 | 2021-04-22 | On Juniper Networks MX Series and EX9200 Series platforms with Trio-based MPCs (Modular Port Concentrators) where Integrated Routing and Bridging (IRB) interfa… |
CVE-2021-0238 | Medium | 5.5 | 2021-04-22 | When a MX Series is configured as a Broadband Network Gateway (BNG) based on Layer 2 Tunneling Protocol (L2TP), executing certain CLI command may cause the sys… |
CVE-2021-0233 | High | 7.5 | 2021-04-22 | A vulnerability in Juniper Networks Junos OS ACX500 Series, ACX4000 Series, may allow an attacker to cause a Denial of Service (DoS) by sending a high rate of… |
CVE-2021-0230 | High | 7.5 | 2021-04-22 | On Juniper Networks SRX Series devices with link aggregation (lag) configured, executing any operation that fetches Aggregated Ethernet (AE) interface statisti… |
CVE-2021-0229 | Medium | 5.3 | 2021-04-22 | An uncontrolled resource consumption vulnerability in Message Queue Telemetry Transport (MQTT) server of Juniper Networks Junos OS allows an attacker to cause… |
CVE-2021-30464 | High | 7.5 | 2021-04-20 | OMICRON StationGuard before 1.10 allows remote attackers to cause a denial of service (connectivity outage) via crafted tcp/20499 packets to the CTRL Ethernet… |
CVE-2021-29453 | Medium | 5.7 | 2021-04-19 | matrix-media-repo is an open-source multi-domain media repository for Matrix. Versions 1.2.6 and earlier of matrix-media-repo do not properly handle malicious… |
CVE-2021-29430 | High | 7.5 | 2021-04-15 | Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP req… |
CVE-2021-29433 | Medium | 4.3 | 2021-04-15 | Sydent is a reference Matrix identity server. In Sydent versions 2.2.0 and prior, sissing input validation of some parameters on the endpoints used to confirm… |
CVE-2021-21728 | Medium | 5.3 | 2021-04-09 | A ZTE product has a configuration error vulnerability. Because a certain port is open by default, an attacker can consume system processing resources by flushi… |
CVE-2021-21529 | Low | 3.8 | 2021-04-02 | Dell System Update (DSU) 1.9 and earlier versions contain a denial of service vulnerability. A local authenticated malicious user with low privileges may poten… |
CVE-2021-22696 | High | 7.5 | 2021-04-02 | CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework… |
CVE-2021-28165 | High | 7.5 | 2021-04-01 | In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame. |
CVE-2021-22177 | Medium | 4.3 | 2021-04-01 | Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via git… |
CVE-2021-20234 | Medium | 6.5 | 2021-04-01 | An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue causes a client tha… |
CVE-2021-3479 | Medium | 5.5 | 2021-03-31 | There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenE… |
CVE-2021-3478 | Medium | 5.5 | 2021-03-31 | There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenE… |
CVE-2018-1109 | Medium | 5.3 | 2021-03-30 | A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of… |
CVE-2018-1107 | Medium | 5.3 | 2021-03-30 | It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A s… |
CVE-2021-20216 | High | 7.5 | 2021-03-25 | A flaw was found in Privoxy in versions before 3.0.31. A memory leak that occurs when decompression fails unexpectedly may lead to a denial of service. The hig… |
CVE-2021-1460 | Medium | 5.3 | 2021-03-24 | A vulnerability in the Cisco IOx Application Framework of Cisco 809 Industrial Integrated Services Routers (Industrial ISRs), Cisco 829 Industrial ISRs, Cisco… |
CVE-2019-19343 | High | 7.5 | 2021-03-23 | A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due to holding remote… |
CVE-2021-21348 | Medium | 5.3 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attac… |
CVE-2021-21341 | High | 7.5 | 2021-03-23 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacke… |
CVE-2021-21267 | High | 7.5 | 2021-03-19 | Schema-Inspector is an open-source tool to sanitize and validate JS objects (npm package schema-inspector). In before version 2.0.0, email address validation i… |
CVE-2021-28089 | High | 7.5 | 2021-03-19 | Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001. |
CVE-2020-27827 | High | 7.5 | 2021-03-18 | A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific option… |
CVE-2021-21375 | Medium | 6.5 | 2021-03-10 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2020-35233 | Medium | 6.5 | 2021-03-10 | The TFTP server fails to handle multiple connections on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices, and allows external attackers to force device reboots by s… |
CVE-2021-20265 | Medium | 5.5 | 2021-03-10 | A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an… |
CVE-2021-21369 | Medium | 6.5 | 2021-03-09 | Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerabilit… |
CVE-2021-22883 | High | 7.5 | 2021-03-03 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' a… |
CVE-2021-25252 | Medium | 5.5 | 2021-03-03 | Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-se… |
CVE-2021-22187 | Medium | 4.3 | 2021-03-02 | An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allowed running or pend… |
CVE-2020-27223 | Medium | 5.2 | 2021-02-26 | In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a lar… |
CVE-2021-21274 | Medium | 4.3 | 2021-02-26 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2020-24686 | High | 7.5 | 2021-02-26 | The vulnerabilities can be exploited to cause the web visualization component of the PLC to stop and not respond, leading to genuine users losing remote visibi… |
CVE-2021-21328 | Medium | 5.3 | 2021-02-26 | Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app… |
CVE-2021-22882 | High | 7.5 | 2021-02-23 | UniFi Protect before v1.17.1 allows an attacker to use spoofed cameras to perform a denial-of-service attack that may cause the UniFi Protect controller to cra… |
CVE-2020-27782 | High | 7.5 | 2021-02-23 | A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-… |
CVE-2020-11270 | High | 7.5 | 2021-02-22 | Possible denial of service due to RTT responder consistently rejects all FTMR by transmitting FTM1 with failure status in the FTM parameter IE in Snapdragon Au… |
CVE-2021-27405 | High | 7.5 | 2021-02-19 | A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js. |
CVE-2020-28496 | High | 7.5 | 2021-02-18 | This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { va… |
CVE-2021-1378 | Medium | 5.3 | 2021-02-17 | A vulnerability in the SSH service of the Cisco StarOS operating system could allow an unauthenticated, remote attacker to cause an affected device to stop pro… |
CVE-2020-24504 | Medium | 5.5 | 2021-02-17 | Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 may allow an authenticated user to potentially… |
CVE-2021-22553 | Medium | 6.5 | 2021-02-17 | Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispose of the session. O… |
CVE-2021-21317 | Medium | 5.3 | 2021-02-16 | uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some reg… |
CVE-2020-35559 | Medium | 4.3 | 2021-02-16 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to us… |
CVE-2020-4956 | Medium | 4.8 | 2021-02-15 | IBM Spectrum Protect Operations Center 7.1 and 8.1 is vulnerable to a denial of service, caused by a RPC that allows certain cache values to be set and dumped… |
CVE-2020-13949 | High | 7.5 | 2021-02-12 | In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denia… |
CVE-2021-22985 | High | 7.5 | 2021-02-12 | On BIG-IP APM version 16.0.x before 16.0.1.1, under certain conditions, when processing VPN traffic with APM, TMM consumes excessive memory. A malicious, authe… |
CVE-2021-22880 | High | 7.5 | 2021-02-11 | The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully c… |
CVE-2020-35498 | High | 7.5 | 2021-02-11 | A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted… |
CVE-2021-21296 | Low | 2.7 | 2021-02-10 | Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes t… |
CVE-2020-5023 | High | 7.5 | 2021-02-10 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 could allow a remote user to inject arbitrary data iwhich could cause the serivce to crash due to excess resour… |
CVE-2021-21306 | Medium | 5.3 | 2021-02-08 | Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular express… |
CVE-2021-21240 | High | 7.5 | 2021-02-08 | httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" cha… |
CVE-2021-25227 | Low | 3.3 | 2021-02-04 | Trend Micro Antivirus for Mac 2021 (Consumer) is vulnerable to a memory exhaustion vulnerability that could lead to disabling all the scanning functionality wi… |
CVE-2021-1266 | Medium | 4.3 | 2021-02-04 | A vulnerability in the REST API of Cisco Managed Services Accelerator (MSX) could allow an authenticated, remote attacker to cause a denial of service (DoS) co… |
CVE-2021-21294 | High | 7.5 | 2021-02-02 | Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnera… |
CVE-2021-21293 | High | 7.5 | 2021-02-02 | blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by… |
CVE-2021-21285 | Medium | 6.5 | 2021-02-02 | In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemo… |
CVE-2020-28493 | Medium | 5.3 | 2021-02-01 | This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of mult… |
CVE-2021-21254 | Medium | 6.5 | 2021-01-29 | CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before v… |
CVE-2021-25909 | High | 8.6 | 2021-01-29 | ZIV Automation 4CCT-EA6-334126BF firmware version 3.23.80.27.36371, allows an unauthenticated, remote attacker to cause a denial of service condition on the de… |
CVE-2021-20185 | Medium | 5.3 | 2021-01-28 | It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result… |
CVE-2021-25226 | Medium | 5.5 | 2021-01-27 | A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft specific files that can cause a denial-of-se… |
CVE-2021-25225 | Medium | 5.5 | 2021-01-27 | A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft specific files that can cause a denial-of-se… |
CVE-2021-25224 | Medium | 5.5 | 2021-01-27 | A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft specific files that can cause a denial-of-se… |
CVE-2021-21271 | Medium | 6.5 | 2021-01-26 | Tendermint Core is an open source Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine - written in any programming language - and s… |
CVE-2020-27295 | High | 7.5 | 2021-01-26 | The affected product has uncontrolled resource consumption issues, which may allow an attacker to cause a denial-of-service condition on the OPC UA Tunneller (… |
CVE-2020-8295 | High | 7.5 | 2021-01-26 | A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user. |
CVE-2020-8293 | Medium | 6.5 | 2021-01-26 | A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential… |
CVE-2020-4766 | High | 7.5 | 2021-01-22 | IBM MQ Internet Pass-Thru 2.1 and 9.2 could allow a remote user to cause a denial of service by sending malformed MQ data requests which would consume all avai… |
CVE-2021-1312 | Medium | 5.3 | 2021-01-20 | A vulnerability in the system resource management of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to cause a denial… |
CVE-2021-0215 | Medium | 6.5 | 2021-01-15 | On Juniper Networks Junos EX series, QFX Series, MX Series and SRX branch series devices, a memory leak occurs every time the 802.1X authenticator port interfa… |
CVE-2021-0202 | High | 7.5 | 2021-01-15 | On Juniper Networks MX Series and EX9200 Series platforms with Trio-based MPC (Modular Port Concentrator) where Integrated Routing and Bridging (IRB) interface… |
CVE-2021-22168 | Medium | 4.3 | 2021-01-15 | A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8. |
CVE-2021-22166 | Medium | 5.3 | 2021-01-15 | An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method |
CVE-2020-9203 | Low | 3.3 | 2021-01-13 | There is a resource management errors vulnerability in Huawei P30. Local attackers construct broadcast message for some application, causing this application t… |
CVE-2021-21252 | Medium | 5.3 | 2021-01-13 | The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation befo… |
CVE-2020-36048 | High | 7.5 | 2021-01-08 | Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport. |
CVE-2021-21236 | Medium | 5.7 | 2021-01-06 | CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of ser… |
CVE-2021-21235 | Medium | 5.7 | 2021-01-06 | kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifical… |
CVE-2020-29490 | High | 7.5 | 2021-01-05 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a Denial of Service vulnerability on NAS Servers with NFS exports. A remote auth… |
CVE-2020-35857 | High | 7.5 | 2020-12-31 | An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption. |
CVE-2020-35916 | Medium | 5.5 | 2020-12-31 | An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always co… |
CVE-2020-26289 | High | 7.5 | 2020-12-28 | date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which ca… |
CVE-2020-27722 | Medium | 6.5 | 2020-12-24 | In BIG-IP APM versions 15.0.0-15.0.1.3, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, under certain conditions, the VDI plugin does not observe plugin flow-control proto… |
CVE-2020-27724 | Medium | 6.5 | 2020-12-24 | In BIG-IP APM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, on systems runn… |
CVE-2018-1000893 | High | 7.5 | 2020-12-23 | Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when deserializing transactions. |
CVE-2018-1000892 | High | 7.5 | 2020-12-23 | Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving sendheaders messages. |
CVE-2018-1000891 | High | 7.5 | 2020-12-23 | Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving messages with invalid checksums. |
CVE-2018-7580 | High | 7.5 | 2020-12-21 | Philips Hue is vulnerable to a Denial of Service attack. Sending a SYN flood on port tcp/80 will freeze Philips Hue's hub and it will stop responding. The "hub… |
CVE-2020-5682 | High | 7.5 | 2020-12-16 | Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier GROWI… |
CVE-2020-26264 | Medium | 6.5 | 2020-12-11 | Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.25 a denial-of-service vulnerability can mak… |
CVE-2020-26409 | Medium | 4.3 | 2020-12-11 | A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassin… |