CWE-400 · Uncontrolled Resource Consumption (page 27)
Page 27 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-12516 | High | 7.5 | 2020-12-10 | Older firmware versions (FW1 up to FW10) of the WAGO PLC family 750-88x and 750-352 are vulnerable for a special denial of service attack. |
CVE-2020-26257 | Medium | 6.5 | 2020-12-09 | Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-imple… |
CVE-2020-26256 | Medium | 5.7 | 2020-12-08 | Fast-csv is an npm package for parsing and formatting CSVs or any other delimited value file in node. In fast-cvs before version 4.3.6 there is a possible ReDo… |
CVE-2020-25630 | High | 7.5 | 2020-12-08 | A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping them, which could le… |
CVE-2020-12524 | High | 7.5 | 2020-12-02 | Uncontrolled Resource Consumption can be exploited to cause the Phoenix Contact HMIs BTP 2043W, BTP 2070W and BTP 2102W in all versions to become unresponsive… |
CVE-2020-5423 | High | 7.5 | 2020-12-02 | CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send speciall… |
CVE-2020-27813 | High | 7.5 | 2020-12-02 | An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a de… |
CVE-2020-16850 | High | 7.5 | 2020-11-30 | Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the netwo… |
CVE-2020-10772 | High | 7.5 | 2020-11-27 | An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound c… |
CVE-2020-7779 | Medium | 5.3 | 2020-11-26 | All versions of package djvalidator are vulnerable to Regular Expression Denial of Service (ReDoS) by sending crafted invalid emails - for example, --@--------… |
CVE-2020-14190 | High | 7.5 | 2020-11-25 | Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versio… |
CVE-2020-5668 | High | 7.5 | 2020-11-20 | Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series modules (R00/01/02CPU firmware version '19' and earlier, R04/08/16/32/120 (EN) CPU firmwa… |
CVE-2020-8277 | High | 7.5 | 2020-11-19 | A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14… |
CVE-2020-13349 | Medium | 4.3 | 2020-11-17 | An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Searc… |
CVE-2020-13354 | Medium | 4.3 | 2020-11-17 | A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponential number of ba… |
CVE-2020-5666 | High | 7.5 | 2020-11-16 | Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from '05' to '19' and R04/08/16/32/120(EN)CPU… |
CVE-2020-15783 | High | 7.5 | 2020-11-12 | A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC TDC CPU555 (All version… |
CVE-2020-24573 | High | 7.5 | 2020-11-12 | BAB TECHNOLOGIE GmbH eibPort V3 prior to 3.8.3 devices allow denial of service (Uncontrolled Resource Consumption) via requests to the lighttpd component. |
CVE-2020-7767 | Medium | 5.3 | 2020-11-11 | All versions of package express-validators are vulnerable to Regular Expression Denial of Service (ReDoS) when validating specifically-crafted invalid urls. |
CVE-2020-0441 | High | 7.5 | 2020-11-10 | In Message and toBundle of Notification.java, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of ser… |
CVE-2020-5652 | High | 7.5 | 2020-11-02 | Uncontrolled resource consumption vulnerability in Ethernet Port on MELSEC iQ-R, Q and L series CPU modules (R 00/01/02 CPU firmware versions '20' and earlier… |
CVE-2020-7760 | Medium | 5.3 | 2020-10-30 | This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is locat… |
CVE-2020-5936 | High | 7.5 | 2020-10-29 | On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel (TMM) process may consume excessive re… |
CVE-2019-8774 | Medium | 5.5 | 2020-10-27 | A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15. Parsing a mali… |
CVE-2018-4474 | High | 7.5 | 2020-10-27 | A memory consumption issue was addressed with improved memory handling. This issue is fixed in iCloud for Windows 7.7, watchOS 5, Safari 12, iOS 12, iTunes 12… |
CVE-2018-4381 | Medium | 5.5 | 2020-10-27 | A resource exhaustion issue was addressed with improved input validation. This issue is fixed in tvOS 12.1, iOS 12.1. Processing a maliciously crafted message… |
CVE-2020-7755 | High | 7.5 | 2020-10-27 | All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values. |
CVE-2020-7753 | High | 7.5 | 2020-10-27 | All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim(). |
CVE-2020-3572 | High | 8.6 | 2020-10-21 | A vulnerability in the SSL/TLS session handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allo… |
CVE-2020-3571 | High | 8.6 | 2020-10-21 | A vulnerability in the ICMP ingress packet processing of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 4110 appliances could allow an unaut… |
CVE-2020-3563 | High | 8.6 | 2020-10-21 | A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to caus… |
CVE-2020-3554 | High | 7.5 | 2020-10-21 | A vulnerability in the TCP packet processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2020-3533 | High | 8.6 | 2020-10-21 | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Firepower Threat Defense (FTD) Software could allow an unauthe… |
CVE-2020-3529 | High | 8.6 | 2020-10-21 | A vulnerability in the SSL VPN negotiation process for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could… |
CVE-2020-3528 | High | 8.6 | 2020-10-21 | A vulnerability in the OSPF Version 2 (OSPFv2) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Soft… |
CVE-2020-3499 | High | 8.6 | 2020-10-21 | A vulnerability in the licensing service of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to cause a denial… |
CVE-2020-3373 | High | 8.6 | 2020-10-21 | A vulnerability in the IP fragment-handling implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Softwar… |
CVE-2020-3304 | High | 8.6 | 2020-10-21 | A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthentic… |
CVE-2020-1689 | Medium | 6.5 | 2020-10-16 | On Juniper Networks EX4300-MP Series, EX4600 Series and QFX5K Series deployed in a Virtual Chassis configuration, receipt of a stream of specific layer 2 frame… |
CVE-2020-1687 | Medium | 6.5 | 2020-10-16 | On Juniper Networks EX4300-MP Series, EX4600 Series and QFX5K Series deployed in (Ethernet VPN) EVPN-(Virtual Extensible LAN) VXLAN configuration, receipt of a… |
CVE-2020-1684 | High | 7.5 | 2020-10-16 | On Juniper Networks SRX Series configured with application identification inspection enabled, receipt of specific HTTP traffic can cause high CPU load utilizat… |
CVE-2020-1678 | Medium | 6.5 | 2020-10-16 | On Juniper Networks Junos OS and Junos OS Evolved platforms with EVPN configured, receipt of specific BGP packets causes a slow memory leak. If the memory is e… |
CVE-2020-1670 | Medium | 6.5 | 2020-10-16 | On Juniper Networks EX4300 Series, receipt of a stream of specific IPv4 packets can cause Routing Engine (RE) high CPU load, which could lead to network protoc… |
CVE-2020-1668 | Medium | 6.5 | 2020-10-16 | On Juniper Networks EX2300 Series, receipt of a stream of specific multicast packets by the layer2 interface can cause high CPU load, which could lead to traff… |
CVE-2020-11645 | Medium | 6.5 | 2020-10-15 | A denial of service vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users… |
CVE-2020-3543 | Medium | 6.5 | 2020-10-08 | A vulnerability in the Cisco Discovery Protocol of Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause a… |
CVE-2020-26164 | Medium | 5.5 | 2020-10-07 | In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memor… |
CVE-2020-13333 | Medium | 4.3 | 2020-10-06 | A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a link from a release had a regex check whic… |
CVE-2020-1903 | Medium | 5.5 | 2020-10-06 | An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulte… |
CVE-2020-1901 | Medium | 5.3 | 2020-10-06 | Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message. |
CVE-2019-20922 | High | 7.5 | 2020-09-30 | Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while proc… |
CVE-2018-10585 | High | 7.5 | 2020-09-25 | Pexip Infinity before 18 allows remote Denial of Service (XML parsing). |
CVE-2018-10432 | High | 7.5 | 2020-09-25 | Pexip Infinity before 18 allows Remote Denial of Service (TLS handshakes in RTMP). |
CVE-2020-3560 | High | 8.6 | 2020-09-24 | A vulnerability in Cisco Aironet Access Points (APs) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) on an affected device… |
CVE-2020-3559 | High | 8.6 | 2020-09-24 | A vulnerability in Cisco Aironet Access Point (AP) Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerab… |
CVE-2020-3527 | High | 8.6 | 2020-09-24 | A vulnerability in the Polaris kernel of Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote attacker to crash the device. The vulnerabi… |
CVE-2020-3512 | High | 7.4 | 2020-09-24 | A vulnerability in the PROFINET handler for Link Layer Discovery Protocol (LLDP) messages of Cisco IOS Software and Cisco IOS XE Software could allow an unauth… |
CVE-2020-3510 | High | 8.6 | 2020-09-24 | A vulnerability in the Umbrella Connector component of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote att… |
CVE-2020-3508 | High | 7.4 | 2020-09-24 | A vulnerability in the IP Address Resolution Protocol (ARP) feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers with a 20-G… |
CVE-2020-3487 | Medium | 6.5 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3479 | Medium | 6.1 | 2020-09-24 | A vulnerability in the implementation of Multiprotocol Border Gateway Protocol (MP-BGP) for the Layer 2 VPN (L2VPN) Ethernet VPN (EVPN) address family in Cisco… |
CVE-2020-3428 | Medium | 6.5 | 2020-09-24 | A vulnerability in the WLAN Local Profiling feature of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthentica… |
CVE-2020-3414 | High | 8.6 | 2020-09-24 | A vulnerability in the packet processing of Cisco IOS XE Software for Cisco 4461 Integrated Services Routers could allow an unauthenticated, remote attacker to… |
CVE-2020-3409 | High | 7.4 | 2020-09-24 | A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected… |
CVE-2020-3408 | High | 8.6 | 2020-09-24 | A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected d… |
CVE-2020-3569 | High | 8.6 | 2020-09-23 | Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote atta… |
CVE-2020-8251 | High | 7.5 | 2020-09-18 | Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new con… |
CVE-2020-8246 | High | 7.5 | 2020-09-18 | Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix… |
CVE-2020-8237 | High | 7.5 | 2020-09-18 | Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack. |
CVE-2020-7733 | High | 7.5 | 2020-09-16 | The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA. |
CVE-2020-15166 | High | 7.5 | 2020-09-11 | In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacte… |
CVE-2018-17145 | High | 7.5 | 2020-09-10 | Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with r… |
CVE-2020-2039 | Medium | 5.3 | 2020-09-09 | An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the… |
CVE-2020-14384 | High | 7.5 | 2020-09-09 | A flaw was found in JBossWeb in versions before 7.5.31.Final-redhat-3. The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulnerable to a denial… |
CVE-2019-5645 | High | 7.5 | 2020-09-01 | By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When e… |
CVE-2020-3566 | High | 8.6 | 2020-08-29 | A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to e… |
CVE-2020-3504 | Low | 3.3 | 2020-08-27 | A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of servic… |
CVE-2020-3505 | Medium | 6.5 | 2020-08-26 | A vulnerability in the Cisco Discovery Protocol of Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause a… |
CVE-2020-14522 | High | 7.5 | 2020-08-25 | Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to uncontrolled resource consumption… |
CVE-2020-3976 | Medium | 5.3 | 2020-08-21 | VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services. VMware has evaluated the severity… |
CVE-2020-9703 | Medium | 5.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a stack exhaustio… |
CVE-2020-9702 | Medium | 5.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a stack exhaustio… |
CVE-2020-13281 | Medium | 6.5 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature |
CVE-2020-13280 | Medium | 6.5 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message. |
CVE-2020-8229 | Medium | 5.5 | 2020-08-10 | A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system. |
CVE-2020-15114 | High | 7.7 | 2020-08-06 | In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to i… |
CVE-2020-11937 | Medium | 5.5 | 2020-08-06 | In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion d… |
CVE-2020-12739 | Medium | 5.3 | 2020-08-03 | A denial-of-service vulnerability in the Fanuc i Series CNC (0i-MD and 0i Mate-MD) could allow an unauthenticated, remote attacker to cause an affected CNC to… |
CVE-2020-8220 | Medium | 6.5 | 2020-07-30 | A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection via the administrato… |
CVE-2020-8192 | Medium | 6.5 | 2020-07-30 | A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors opt… |
CVE-2020-7016 | Medium | 4.8 | 2020-07-27 | Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user c… |
CVE-2020-8175 | Medium | 5.5 | 2020-07-24 | Uncontrolled resource consumption in `jpeg-js` before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image. |
CVE-2020-14297 | Medium | 6.5 | 2020-07-24 | A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the tim… |
CVE-2020-8557 | Medium | 5.5 | 2020-07-23 | The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/h… |
CVE-2020-3372 | Medium | 6.5 | 2020-07-16 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to consume excessive syste… |
CVE-2020-3351 | High | 8.6 | 2020-07-16 | A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerabili… |
CVE-2020-15101 | Low | 2.8 | 2020-07-14 | In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk()… |
CVE-2020-15100 | Low | 2.8 | 2020-07-14 | In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been patched in 0.1.1. |
CVE-2020-7587 | High | 8.2 | 2020-07-14 | A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Executi… |
CVE-2020-7584 | High | 7.5 | 2020-07-14 | A vulnerability has been identified in SIMATIC S7-200 SMART CPU family (All versions >= V2.2 < V2.5.1). Affected devices do not properly handle large numbers o… |