CWE-400 · Uncontrolled Resource Consumption (page 29)
Page 29 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22124 | High | 7.5 | 2021-08-04 | An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0… |
CVE-2021-21565 | Medium | 5.3 | 2021-08-03 | Dell PowerScale OneFS versions 9.1.0.3 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop… |
CVE-2021-25701 | Medium | 5.5 | 2021-07-21 | The fUSBHub driver in the PCoIP Software Client prior to version 21.07.0 had an error in object management during the handling of a variety of IOCTLs, which al… |
CVE-2020-20221 | Medium | 6.5 | 2021-07-21 | Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process. An authenticate… |
CVE-2021-32763 | Medium | 4.3 | 2021-07-20 | OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProject has a `quote` met… |
CVE-2020-20248 | Medium | 6.5 | 2021-07-19 | Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the memtest process. An authenticated remote attacker can cause a Den… |
CVE-2020-20230 | Medium | 6.5 | 2021-07-19 | Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the sshd process. An authenticated remote attacker can cause a Denial… |
CVE-2021-32014 | Medium | 5.5 | 2021-07-19 | SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when rea… |
CVE-2021-32013 | Medium | 5.5 | 2021-07-19 | SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when… |
CVE-2021-32012 | Medium | 5.5 | 2021-07-19 | SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when… |
CVE-2021-0292 | Medium | 6.5 | 2021-07-15 | An Uncontrolled Resource Consumption vulnerability in the ARP daemon (arpd) and Network Discovery Protocol (ndp) process of Juniper Networks Junos OS Evolved a… |
CVE-2021-0285 | High | 7.5 | 2021-07-15 | An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker sending large a… |
CVE-2021-36716 | High | 7.5 | 2021-07-14 | A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide cra… |
CVE-2020-20217 | Medium | 6.5 | 2021-07-08 | Mikrotik RouterOs before 6.47 (stable tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/route process. An authenticated re… |
CVE-2021-32740 | High | 7.5 | 2021-07-06 | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerabil… |
CVE-2021-22119 | High | 7.5 | 2021-06-29 | Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (Do… |
CVE-2021-34549 | High | 7.5 | 2021-06-29 | An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can t… |
CVE-2021-33503 | High | 7.5 | 2021-06-29 | An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expre… |
CVE-2021-32723 | High | 7.4 | 2021-06-28 | Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to high… |
CVE-2021-32722 | Medium | 6.5 | 2021-06-28 | GlobalNewFiles is a mediawiki extension. Versions prior to 48be7adb70568e20e961ea1cb70904454a671b1d are affected by an uncontrolled resource consumption vulner… |
CVE-2021-32823 | Low | 3.7 | 2021-06-24 | In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in… |
CVE-2021-32699 | Medium | 6.5 | 2021-06-22 | Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vulnerable t… |
CVE-2021-33824 | High | 7.5 | 2021-06-18 | An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make… |
CVE-2021-33822 | High | 7.5 | 2021-06-18 | An issue was discovered on 4GEE ROUTER HH70VB Version HH70_E1_02.00_22. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make s… |
CVE-2021-33818 | High | 7.5 | 2021-06-18 | An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. Attackers can use slowhttptest tool to send incomplete HTTP request, which coul… |
CVE-2020-8299 | Medium | 6.5 | 2021-06-16 | Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Editio… |
CVE-2021-30468 | High | 7.5 | 2021-06-16 | A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread gettin… |
CVE-2021-22906 | Medium | 6.5 | 2021-06-11 | Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authenticated users to lock… |
CVE-2021-22904 | High | 7.5 | 2021-06-11 | The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Ac… |
CVE-2021-22902 | High | 7.5 | 2021-06-11 | The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vu… |
CVE-2021-22181 | High | 7.7 | 2021-06-11 | A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust… |
CVE-2021-20591 | High | 7.5 | 2021-06-11 | Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R00/01/02CPU all versions, R04/08/16/32/120(EN)CPU all v… |
CVE-2020-12296 | Medium | 5.5 | 2021-06-09 | Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via loca… |
CVE-2020-12291 | Medium | 5.5 | 2021-06-09 | Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via loca… |
CVE-2021-23852 | Medium | 4.9 | 2021-06-09 | An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive fo… |
CVE-2021-31340 | High | 7.5 | 2021-06-08 | A vulnerability has been identified in SIMATIC RF166C (All versions > V1.1 and < V1.3.2), SIMATIC RF185C (All versions > V1.1 and < V1.3.2), SIMATIC RF186C (Al… |
CVE-2021-22216 | Medium | 6.5 | 2021-06-08 | A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumpt… |
CVE-2021-26945 | Medium | 5.5 | 2021-06-08 | An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application co… |
CVE-2021-26260 | Medium | 5.5 | 2021-06-08 | An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to cr… |
CVE-2021-23215 | Medium | 5.5 | 2021-06-08 | An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to cr… |
CVE-2021-22116 | High | 7.5 | 2021-06-08 | RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A… |
CVE-2020-1750 | Medium | 6.5 | 2021-06-07 | A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amount of memory. An att… |
CVE-2021-1564 | Medium | 6.5 | 2021-06-04 | Multiple vulnerabilities in the implementation of the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) for Cisco Video Surveillance 7000 Serie… |
CVE-2021-1563 | Medium | 6.5 | 2021-06-04 | Multiple vulnerabilities in the implementation of the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) for Cisco Video Surveillance 7000 Serie… |
CVE-2020-28469 | Medium | 5.3 | 2021-06-03 | This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator. |
CVE-2020-35510 | Medium | 5.9 | 2021-06-02 | A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by… |
CVE-2020-14340 | Medium | 5.9 | 2021-06-02 | A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It… |
CVE-2020-14326 | High | 7.5 | 2021-06-02 | A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CP… |
CVE-2021-32657 | Medium | 4.3 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may… |
CVE-2021-33623 | High | 7.5 | 2021-05-28 | The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() met… |
CVE-2021-20237 | High | 7.5 | 2021-05-28 | An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. This flaw allows a remote unauthenticated… |
CVE-2021-20201 | Medium | 5.3 | 2021-05-28 | A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service (CPU consumption) by pe… |
CVE-2020-1702 | Low | 3.3 | 2021-05-27 | A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using pod… |
CVE-2018-10868 | High | 7.5 | 2021-05-26 | redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user to run a "… |
CVE-2020-25673 | Medium | 5.5 | 2021-05-26 | A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak and eventually hanging-up the system. |
CVE-2021-32640 | Medium | 5.3 | 2021-05-25 | ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significa… |
CVE-2020-36332 | High | 7.5 | 2021-05-21 | A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threat from this vulnera… |
CVE-2021-20718 | High | 7.5 | 2021-05-20 | mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors. |
CVE-2021-32617 | Medium | 4.7 | 2021-05-17 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm (quadratic… |
CVE-2021-32455 | Medium | 6.8 | 2021-05-17 | SITEL CAP/PRX firmware version 5.2.01, allows an attacker with access to the device´s network to cause a denial of service condition on the device. An attacker… |
CVE-2021-32816 | Medium | 6.5 | 2021-05-14 | ProtonMail Web Client is the official AngularJS web client for the ProtonMail secure email service. ProtonMail Web Client before version 3.16.60 has a regular… |
CVE-2021-29506 | Medium | 6.5 | 2021-05-13 | GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerabilit… |
CVE-2021-22139 | Medium | 6.5 | 2021-05-13 | Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request siz… |
CVE-2021-32918 | High | 7.5 | 2021-05-13 | An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaust… |
CVE-2021-27385 | High | 7.5 | 2021-05-12 | A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI C… |
CVE-2020-25242 | High | 7.5 | 2021-05-12 | A vulnerability has been identified in SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Lean (incl. SIPLUS variants)… |
CVE-2021-29509 | High | 7.5 | 2021-05-11 | Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connection… |
CVE-2021-29471 | Low | 3.7 | 2021-05-11 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2021-30504 | High | 7.5 | 2021-05-11 | In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation. |
CVE-2021-32053 | Medium | 5.3 | 2021-05-10 | JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occ… |
CVE-2021-23011 | High | 7.5 | 2021-05-10 | On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, when th… |
CVE-2021-21419 | Medium | 5.3 | 2021-05-07 | Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious… |
CVE-2021-31409 | High | 7.5 | 2021-05-06 | Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12… |
CVE-2021-1275 | Critical | 9.8 | 2021-05-06 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… |
CVE-2020-28944 | High | 7.5 | 2021-04-30 | OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of data. |
CVE-2021-1489 | Medium | 6.5 | 2021-04-29 | A vulnerability in filesystem usage management for Cisco Firepower Device Manager (FDM) Software could allow an authenticated, remote attacker to exhaust files… |
CVE-2021-21391 | Medium | 6.5 | 2021-04-29 | CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list… |
CVE-2021-29469 | Medium | 5.3 | 2021-04-23 | Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause… |
CVE-2021-31405 | High | 7.5 | 2021-04-23 | Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 thr… |
CVE-2020-36320 | High | 7.5 | 2021-04-23 | Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allows attackers to cau… |
CVE-2021-0257 | Medium | 6.5 | 2021-04-22 | On Juniper Networks MX Series and EX9200 Series platforms with Trio-based MPCs (Modular Port Concentrators) where Integrated Routing and Bridging (IRB) interfa… |
CVE-2021-0238 | Medium | 5.5 | 2021-04-22 | When a MX Series is configured as a Broadband Network Gateway (BNG) based on Layer 2 Tunneling Protocol (L2TP), executing certain CLI command may cause the sys… |
CVE-2021-0233 | High | 7.5 | 2021-04-22 | A vulnerability in Juniper Networks Junos OS ACX500 Series, ACX4000 Series, may allow an attacker to cause a Denial of Service (DoS) by sending a high rate of… |
CVE-2021-0230 | High | 7.5 | 2021-04-22 | On Juniper Networks SRX Series devices with link aggregation (lag) configured, executing any operation that fetches Aggregated Ethernet (AE) interface statisti… |
CVE-2021-0229 | Medium | 5.3 | 2021-04-22 | An uncontrolled resource consumption vulnerability in Message Queue Telemetry Transport (MQTT) server of Juniper Networks Junos OS allows an attacker to cause… |
CVE-2021-30464 | High | 7.5 | 2021-04-20 | OMICRON StationGuard before 1.10 allows remote attackers to cause a denial of service (connectivity outage) via crafted tcp/20499 packets to the CTRL Ethernet… |
CVE-2021-29453 | Medium | 5.7 | 2021-04-19 | matrix-media-repo is an open-source multi-domain media repository for Matrix. Versions 1.2.6 and earlier of matrix-media-repo do not properly handle malicious… |
CVE-2021-29430 | High | 7.5 | 2021-04-15 | Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP req… |
CVE-2021-29433 | Medium | 4.3 | 2021-04-15 | Sydent is a reference Matrix identity server. In Sydent versions 2.2.0 and prior, sissing input validation of some parameters on the endpoints used to confirm… |
CVE-2021-21728 | Medium | 5.3 | 2021-04-09 | A ZTE product has a configuration error vulnerability. Because a certain port is open by default, an attacker can consume system processing resources by flushi… |
CVE-2021-21529 | Low | 3.8 | 2021-04-02 | Dell System Update (DSU) 1.9 and earlier versions contain a denial of service vulnerability. A local authenticated malicious user with low privileges may poten… |
CVE-2021-22696 | High | 7.5 | 2021-04-02 | CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework… |
CVE-2021-28165 | High | 7.5 | 2021-04-01 | In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame. |
CVE-2021-22177 | Medium | 4.3 | 2021-04-01 | Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via git… |
CVE-2021-20234 | Medium | 6.5 | 2021-04-01 | An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue causes a client tha… |
CVE-2021-3479 | Medium | 5.5 | 2021-03-31 | There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenE… |
CVE-2021-3478 | Medium | 5.5 | 2021-03-31 | There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenE… |
CVE-2018-1109 | Medium | 5.3 | 2021-03-30 | A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of… |
CVE-2018-1107 | Medium | 5.3 | 2021-03-30 | It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A s… |
CVE-2021-20216 | High | 7.5 | 2021-03-25 | A flaw was found in Privoxy in versions before 3.0.31. A memory leak that occurs when decompression fails unexpectedly may lead to a denial of service. The hig… |