CWE-400 · Uncontrolled Resource Consumption (page 27)
Page 27 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31078 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31075 | Medium | 4.9 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31074 | Medium | 4.5 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31073 | Medium | 6.5 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-30792 | High | 7.5 | 2022-07-11 | In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel… |
CVE-2022-30791 | High | 7.5 | 2022-07-11 | In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing… |
CVE-2022-20808 | High | 7.7 | 2022-07-06 | A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to cause a denial of service (DoS) conditio… |
CVE-2022-31129 | High | 7.5 | 2022-07-06 | moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient p… |
CVE-2022-30591 | High | 7.5 | 2022-07-06 | quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 reques… |
CVE-2014-3648 | High | 7.5 | 2022-07-01 | The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controll… |
CVE-2022-31110 | Medium | 5.3 | 2022-06-29 | RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameter… |
CVE-2022-26477 | High | 7.5 | 2022-06-27 | The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may le… |
CVE-2022-31016 | Medium | 6.5 | 2022-06-25 | Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allo… |
CVE-2022-31803 | Medium | 5.3 | 2022-06-24 | In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP c… |
CVE-2022-29866 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggers Uncontrolled Resou… |
CVE-2022-29864 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontrolled Resource Consu… |
CVE-2022-27889 | Medium | 5.3 | 2022-06-14 | The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A maliciou… |
CVE-2022-31054 | High | 7.5 | 2022-06-13 | Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated… |
CVE-2022-29225 | High | 7.5 | 2022-06-09 | Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overw… |
CVE-2022-31030 | Medium | 5.5 | 2022-06-09 | containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containe… |
CVE-2022-1708 | High | 7.5 | 2022-06-07 | A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs co… |
CVE-2022-31028 | High | 7.5 | 2022-06-07 | MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO… |
CVE-2022-22556 | Low | 3.7 | 2022-06-02 | Dell PowerStore contains an Uncontrolled Resource Consumption Vulnerability in PowerStore User Interface. A remote unauthenticated attacker could potentially e… |
CVE-2022-1982 | Medium | 4.3 | 2022-06-02 | Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on… |
CVE-2022-31018 | High | 7.5 | 2022-06-02 | Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms lib… |
CVE-2022-27781 | High | 7.5 | 2022-06-02 | libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous fu… |
CVE-2022-1797 | Medium | 6.8 | 2022-06-02 | A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automation Logix Controller… |
CVE-2022-29243 | Medium | 4.3 | 2022-05-31 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size valida… |
CVE-2021-3629 | Medium | 5.9 | 2022-05-24 | A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of serv… |
CVE-2022-29202 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.ragged.constant` does n… |
CVE-2022-29177 | Medium | 5.9 | 2022-05-20 | Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to use high verbosity lo… |
CVE-2022-27640 | Medium | 6.5 | 2022-05-20 | A vulnerability has been identified in SIMATIC CP 442-1 RNA (All versions < V1.5.18), SIMATIC CP 443-1 RNA (All versions < V1.5.18). The affected devices impro… |
CVE-2022-30551 | High | 7.5 | 2022-05-20 | OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available r… |
CVE-2022-28191 | Medium | 5.5 | 2022-05-17 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where uncontrolled resource consumption can be triggered by an unprivileg… |
CVE-2021-33135 | Medium | 5.5 | 2022-05-12 | Uncontrolled resource consumption in the Linux kernel drivers for Intel(R) SGX may allow an authenticated user to potentially enable denial of service via loca… |
CVE-2022-1699 | High | 7.5 | 2022-05-12 | Uncontrolled Resource Consumption in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused by doing a DDoS attack for which ge… |
CVE-2022-29885 | High | 7.5 | 2022-05-12 | The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly… |
CVE-2022-29145 | High | 7.5 | 2022-05-10 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2022-29117 | High | 7.5 | 2022-05-10 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2022-24040 | Medium | 6.5 | 2022-05-10 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2022-24902 | Low | 2.9 | 2022-05-06 | TkVideoplayer is a simple library to play video files in tkinter. Uncontrolled memory consumption in versions of TKVideoplayer prior to 2.0.0 can theoretically… |
CVE-2022-29167 | High | 7.4 | 2022-05-05 | Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and re… |
CVE-2022-29480 | Medium | 5.3 | 2022-05-05 | On F5 BIG-IP 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when multiple route domains are configured, undisclosed requests to big3d… |
CVE-2022-28701 | High | 7.5 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause an increase in memory… |
CVE-2022-28691 | High | 7.5 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when a… |
CVE-2022-27182 | Medium | 5.3 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, when BIG-IP packet filters are enable… |
CVE-2022-27181 | Medium | 5.3 | 2022-05-05 | On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and… |
CVE-2022-26372 | High | 7.5 | 2022-05-05 | On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when… |
CVE-2022-1468 | Medium | 4.3 | 2022-05-05 | On all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user with at least guest role privil… |
CVE-2022-25779 | Medium | 4.3 | 2022-05-04 | Logging of Excessive Data vulnerability in audit log of Secomea GateManager allows logged in user to write text entries in audit log. This issue affects: Secom… |
CVE-2022-20760 | High | 8.6 | 2022-05-03 | A vulnerability in the DNS inspection handler of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an un… |
CVE-2022-22275 | High | 7.5 | 2022-04-27 | Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting… |
CVE-2021-43933 | Medium | 6.1 | 2022-04-20 | The affected product is vulnerable to a network-based attack by threat actors sending unimpeded requests to the receiving server, which could cause a denial-of… |
CVE-2022-24863 | High | 7.5 | 2022-04-18 | http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an atta… |
CVE-2022-20692 | High | 7.7 | 2022-04-15 | A vulnerability in the NETCONF over SSH feature of Cisco IOS XE Software could allow a low-privileged, authenticated, remote attacker to cause a denial of serv… |
CVE-2022-26498 | High | 7.5 | 2022-04-15 | An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much… |
CVE-2022-22191 | Medium | 6.5 | 2022-04-14 | A Denial of Service (DoS) vulnerability in the processing of a flood of specific ARP traffic in Juniper Networks Junos OS on the EX4300 switch, sent from the l… |
CVE-2021-41119 | Medium | 5.3 | 2022-04-13 | Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object c… |
CVE-2022-1337 | Medium | 4.3 | 2022-04-13 | The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attack… |
CVE-2022-21155 | High | 7.5 | 2022-04-12 | A specially crafted packet sent to the Fernhill SCADA Server Version 3.77 and earlier may cause an exception, causing the server process (FHSvrService.exe) to… |
CVE-2022-27194 | High | 7.5 | 2022-04-12 | A vulnerability has been identified in SIMATIC PCS neo (Administration Console) (All versions < V3.1 SP1), SINETPLAN (All versions), TIA Portal (V15, V15.1, V1… |
CVE-2022-25622 | Medium | 5.3 | 2022-04-12 | The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, improperly handles internal resources for TCP segments where the minimum TCP-Header le… |
CVE-2022-24839 | High | 7.5 | 2022-04-11 | org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` excepti… |
CVE-2022-24836 | High | 7.5 | 2022-04-11 | Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive back… |
CVE-2022-1099 | Medium | 4.3 | 2022-04-04 | Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an… |
CVE-2022-1210 | Medium | 4.3 | 2022-04-03 | A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious f… |
CVE-2022-0489 | Low | 3.5 | 2022-04-01 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a spec… |
CVE-2021-32503 | Medium | 4.9 | 2022-04-01 | Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use t… |
CVE-2022-0488 | Low | 3.5 | 2022-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a page with markdown by… |
CVE-2021-22100 | Medium | 5.3 | 2022-03-25 | In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally or maliciously) cau… |
CVE-2022-24729 | Medium | 6.5 | 2022-03-16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vu… |
CVE-2022-22145 | High | 8.1 | 2022-03-11 | CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption. CENTUM CS 3000 versions from… |
CVE-2022-24726 | High | 7.5 | 2022-03-10 | Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request proces… |
CVE-2021-3733 | Medium | 6.5 | 2022-03-10 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects… |
CVE-2022-24741 | Low | 3.5 | 2022-03-09 | Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading spec… |
CVE-2022-24464 | High | 7.5 | 2022-03-09 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2022-24713 | High | 7.5 | 2022-03-08 | regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks cau… |
CVE-2021-3737 | High | 7.5 | 2022-03-04 | A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to… |
CVE-2022-23328 | High | 7.5 | 2022-03-04 | A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spen… |
CVE-2022-25326 | Medium | 5.5 | 2022-02-25 | fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We… |
CVE-2021-4021 | High | 7.5 | 2022-02-24 | A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2. Mapping a huge section filled with zeros of an ELF64 binary for MIPS a… |
CVE-2022-0695 | Medium | 5.5 | 2022-02-24 | Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4. |
CVE-2022-24678 | High | 7.5 | 2022-02-24 | An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Busine… |
CVE-2022-20624 | High | 8.6 | 2022-02-23 | A vulnerability in the Cisco Fabric Services over IP (CFSoIP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial… |
CVE-2022-0476 | Medium | 5.5 | 2022-02-23 | Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4. |
CVE-2021-4115 | Medium | 5.5 | 2022-02-21 | There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from thi… |
CVE-2022-0671 | Critical | 9.1 | 2022-02-18 | A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file. |
CVE-2022-21698 | High | 7.5 | 2022-02-15 | client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers… |
CVE-2022-22780 | Medium | 4.7 | 2022-02-09 | The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS bef… |
CVE-2022-22543 | High | 7.5 | 2022-02-09 | SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC… |
CVE-2021-0092 | Medium | 4.4 | 2022-02-09 | Improper access control in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access. |
CVE-2013-20004 | Critical | 9.8 | 2022-02-06 | A flaw was found in StarWind iSCSI target. StarWind service does not limit client connections and allocates memory on each connection attempt. An attacker coul… |
CVE-2007-20001 | High | 7.5 | 2022-02-06 | A flaw was found in StarWind iSCSI target. An attacker could script standard iSCSI Initiator operation(s) to exhaust the StarWind service socket, which could l… |
CVE-2022-23591 | High | 7.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that… |
CVE-2022-23580 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controll… |
CVE-2022-22724 | High | 7.5 | 2022-02-04 | A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus), when sending a larg… |
CVE-2021-43859 | High | 7.5 | 2022-02-01 | XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU ti… |
CVE-2021-46668 | Medium | 5.5 | 2022-02-01 | MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitation… |
CVE-2021-40406 | High | 7.5 | 2022-01-28 | A denial of service vulnerability exists in the cgiserver.cgi session creation functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP… |
CVE-2022-23030 | Medium | 5.3 | 2022-01-25 | On version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when the BIG-IP Virtual Edition (VE) uses the ixlv… |