CWE-400 · Uncontrolled Resource Consumption (page 28)
Page 28 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-10745 | High | 7.5 | 2020-07-07 | A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This flaw allows a remote… |
CVE-2020-15565 | High | 8.8 | 2020-07-07 | An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain privileges because o… |
CVE-2020-8185 | Medium | 6.5 | 2020-07-02 | A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production. |
CVE-2020-8663 | High | 7.5 | 2020-07-01 | Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections. |
CVE-2020-12603 | High | 7.5 | 2020-07-01 | Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte… |
CVE-2020-5603 | High | 7.5 | 2020-06-30 | Uncontrolled resource consumption vulnerability in Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. 1.94Y and earlier… |
CVE-2020-9611 | Medium | 5.5 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have a sta… |
CVE-2015-9548 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file th… |
CVE-2018-21250 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a denial of service (memory consumption) via… |
CVE-2019-20858 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consumption) via crafted characters in a SQL… |
CVE-2017-9104 | Critical | 9.8 | 2020-06-18 | An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered. |
CVE-2020-7507 | High | 7.5 | 2020-06-16 | A CWE-400: Uncontrolled Resource Consumption vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to login mul… |
CVE-2020-14152 | High | 7.1 | 2020-06-15 | In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memor… |
CVE-2018-16848 | Medium | 6.5 | 2020-06-15 | A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition… |
CVE-2020-0173 | Medium | 6.5 | 2020-06-11 | In Parse_lins of eas_mdls.c, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additi… |
CVE-2020-11090 | High | 7.5 | 2020-06-11 | In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability. Indy Node has a bug in TAA handling code. The current primary can be crashed… |
CVE-2020-13238 | High | 7.5 | 2020-06-10 | Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted packet over the networ… |
CVE-2020-13849 | High | 7.5 | 2020-06-04 | The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remote attackers to caus… |
CVE-2020-7661 | High | 7.5 | 2020-06-04 | all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of… |
CVE-2018-21240 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows memory consumption via an ArrayBuffer(0xfffffffe) call. |
CVE-2018-21238 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows memory consumption via an ArrayBuffer(0xfffffffe) call. |
CVE-2020-13815 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It allows stack consumption via a loop of an indirect object reference. |
CVE-2020-13809 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows resource consumption via long strings in the content stream. |
CVE-2020-11080 | Low | 3.7 | 2020-06-03 | In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious cli… |
CVE-2020-3203 | High | 8.6 | 2020-06-03 | A vulnerability in the locally significant certificate (LSC) provisioning feature of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IOS… |
CVE-2019-20812 | Medium | 5.5 | 2020-06-03 | An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (C… |
CVE-2014-8937 | High | 7.5 | 2020-06-01 | Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources. |
CVE-2020-13623 | High | 7.5 | 2020-05-27 | JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation. |
CVE-2019-11048 | Medium | 5.3 | 2020-05-20 | In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field name… |
CVE-2020-10995 | High | 7.5 | 2020-05-19 | PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found… |
CVE-2020-8616 | High | 8.6 | 2020-05-19 | A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the us… |
CVE-2020-12662 | High | 7.5 | 2020-05-19 | Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in N… |
CVE-2020-12667 | High | 7.5 | 2020-05-19 | Knot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker-controlled server, aka an "NXNSAttack" issue. This is trigger… |
CVE-2020-3334 | High | 7.4 | 2020-05-06 | A vulnerability in the ARP packet processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Fi… |
CVE-2020-3306 | High | 7.5 | 2020-05-06 | A vulnerability in the DHCP module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthe… |
CVE-2020-3305 | High | 7.5 | 2020-05-06 | A vulnerability in the implementation of the Border Gateway Protocol (BGP) module in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threa… |
CVE-2020-3303 | High | 7.5 | 2020-05-06 | A vulnerability in the Internet Key Exchange version 1 (IKEv1) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (… |
CVE-2020-3255 | High | 7.5 | 2020-05-06 | A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to caus… |
CVE-2020-3254 | High | 7.5 | 2020-05-06 | Multiple vulnerabilities in the Media Gateway Control Protocol (MGCP) inspection feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Thre… |
CVE-2020-3196 | High | 8.6 | 2020-05-06 | A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepowe… |
CVE-2020-3195 | High | 7.5 | 2020-05-06 | A vulnerability in the Open Shortest Path First (OSPF) implementation in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (F… |
CVE-2020-3189 | High | 8.6 | 2020-05-06 | A vulnerability in the VPN System Logging functionality for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to ca… |
CVE-2020-9481 | High | 7.5 | 2020-04-27 | Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack. |
CVE-2020-1722 | Medium | 5.3 | 2020-04-27 | A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing proce… |
CVE-2020-7486 | High | 7.5 | 2020-04-16 | **VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability could cause TCM modules to reset when under high network load in TCM v10.4.x and in system v10.3.x. Thi… |
CVE-2020-3260 | Medium | 6.5 | 2020-04-15 | A vulnerability in Cisco Aironet Series Access Points Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition o… |
CVE-2019-19301 | High | 7.5 | 2020-04-14 | A vulnerability has been identified in SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE X202-2IRT, SCALANCE X202-2P IRT, SCALANCE… |
CVE-2019-19300 | High | 7.5 | 2020-04-14 | A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P, K… |
CVE-2020-1625 | Medium | 6.5 | 2020-04-08 | The kernel memory usage represented as "temp" via 'show system virtual-memory' may constantly increase when Integrated Routing and Bridging (IRB) is configured… |
CVE-2019-17657 | High | 7.5 | 2020-04-07 | An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3 a… |
CVE-2020-5347 | Medium | 5.3 | 2020-04-04 | Dell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop… |
CVE-2019-18904 | Medium | 6.5 | 2020-04-03 | A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance C… |
CVE-2020-5527 | High | 7.5 | 2020-03-30 | When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versi… |
CVE-2020-10954 | High | 7.5 | 2020-03-27 | GitLab through 12.9 is affected by a potential DoS in repository archive download. |
CVE-2020-1950 | Medium | 5.5 | 2020-03-23 | A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23. |
CVE-2020-8136 | High | 7.5 | 2020-03-20 | Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a special… |
CVE-2020-0088 | Medium | 6.5 | 2020-03-15 | In parseTrackFragmentRun of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of ser… |
CVE-2020-9464 | High | 7.5 | 2020-03-12 | A Denial-of-Service vulnerability exists in BECKHOFF Ethernet TCP/IP Bus Coupler BK9000. After an attack has occurred, the device's functionality can be restor… |
CVE-2019-5149 | High | 7.5 | 2020-03-11 | The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use o… |
CVE-2019-19281 | High | 7.5 | 2020-03-10 | A vulnerability has been identified in SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V2.5 and < V20.8), SIMATIC S7-1… |
CVE-2019-18336 | High | 7.5 | 2020-03-10 | A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V3.X.17), SIMATIC TDC CP51M1 (A… |
CVE-2019-13011 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could… |
CVE-2019-13009 | Medium | 6.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible… |
CVE-2019-13007 | Medium | 4.9 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering… |
CVE-2019-13003 | High | 7.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion a… |
CVE-2020-7212 | High | 7.5 | 2020-03-06 | The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because… |
CVE-2020-6986 | High | 7.5 | 2020-03-05 | In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethern… |
CVE-2020-8661 | High | 7.5 | 2020-03-04 | CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests. |
CVE-2020-3190 | Medium | 5.8 | 2020-03-04 | A vulnerability in the IPsec packet processor of Cisco IOS XR Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condit… |
CVE-2020-3181 | Medium | 6.5 | 2020-03-04 | A vulnerability in the malware detection functionality in Cisco Advanced Malware Protection (AMP) in Cisco AsyncOS Software for Cisco Email Security Appliances… |
CVE-2020-3175 | High | 8.6 | 2020-02-26 | A vulnerability in the resource handling system of Cisco NX-OS Software for Cisco MDS 9000 Series Multilayer Switches could allow an unauthenticated, remote at… |
CVE-2020-3168 | High | 7.5 | 2020-02-26 | A vulnerability in the Secure Login Enhancements capability of Cisco Nexus 1000V Switch for VMware vSphere could allow an unauthenticated, remote attacker to c… |
CVE-2020-9369 | High | 7.5 | 2020-02-24 | Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listma… |
CVE-2012-0785 | High | 7.5 | 2020-02-24 | Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400… |
CVE-2015-4411 | High | 7.5 | 2020-02-20 | The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker… |
CVE-2012-5366 | High | 7.5 | 2020-02-20 | The IPv6 implementation in Apple Mac OS X (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6… |
CVE-2012-5365 | High | 7.5 | 2020-02-20 | The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICM… |
CVE-2012-5364 | High | 7.5 | 2020-02-20 | The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement pack… |
CVE-2012-5363 | High | 7.5 | 2020-02-20 | The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICM… |
CVE-2012-5362 | High | 7.5 | 2020-02-20 | The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation mes… |
CVE-2020-3132 | Medium | 5.9 | 2020-02-19 | A vulnerability in the email message scanning feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote… |
CVE-2020-8992 | Medium | 5.5 | 2020-02-14 | ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a cra… |
CVE-2020-3741 | High | 7.5 | 2020-02-13 | Adobe Experience Manager versions 6.5, and 6.4 have an uncontrolled resource consumption vulnerability. Successful exploitation could lead to denial-of-service. |
CVE-2013-4602 | Medium | 5.5 | 2020-02-12 | A Denial of Service (infinite loop) vulnerability exists in Avira AntiVir Engine before 8.2.12.58 via an unspecified function in the PDF Scanner Engine. |
CVE-2011-3336 | High | 7.5 | 2020-02-12 | regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion. |
CVE-2012-0810 | Medium | 5.5 | 2020-02-12 | The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stack corruption and pa… |
CVE-2019-13946 | High | 7.5 | 2020-02-11 | Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent… |
CVE-2019-13940 | Medium | 5.3 | 2020-02-11 | A vulnerability has been identified in SIMATIC ET 200pro IM154-8 PN/DP CPU (All versions < V3.X.17), SIMATIC ET 200pro IM154-8F PN/DP CPU (All versions < V3.X… |
CVE-2019-13926 | High | 7.5 | 2020-02-11 | A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All ver… |
CVE-2019-13925 | High | 7.5 | 2020-02-11 | A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All ver… |
CVE-2020-1700 | Medium | 6.5 | 2020-02-07 | A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disco… |
CVE-2016-1544 | Low | 3.3 | 2020-02-06 | nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion). |
CVE-2020-8123 | Medium | 4.9 | 2020-02-04 | A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of t… |
CVE-2019-9674 | High | 7.5 | 2020-02-04 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. |
CVE-2020-5236 | Medium | 5.7 | 2020-02-04 | Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x1… |
CVE-2019-20446 | Medium | 6.5 | 2020-02-02 | In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The at… |
CVE-2020-8492 | Medium | 6.5 | 2020-01-30 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression… |
CVE-2013-3074 | High | 7.5 | 2020-01-28 | NetGear WNDR4700 Media Server devices with firmware 1.0.0.34 allow remote attackers to cause a denial of service (device crash). |
CVE-2019-5472 | High | 7.5 | 2020-01-28 | An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments. |
CVE-2020-3131 | Medium | 6.5 | 2020-01-26 | A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial o… |