CWE-400 · Uncontrolled Resource Consumption (page 30)
Page 30 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-14233 | High | 7.5 | 2019-08-02 | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django… |
CVE-2019-14232 | High | 7.5 | 2019-08-02 | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() meth… |
CVE-2019-10162 | High | 7.5 | 2019-07-30 | A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the server to exit by insert… |
CVE-2019-13655 | Medium | 6.5 | 2019-07-29 | Imgix through 2019-06-19 allows remote attackers to cause a denial of service (resource consumption) by manipulating a small JPEG file to specify dimensions of… |
CVE-2019-10972 | Medium | 5.5 | 2019-07-26 | Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability can be triggered when an attacker provides the target with a rogue project fi… |
CVE-2019-1010172 | High | 7.5 | 2019-07-25 | Jsish 2.4.84 2.0484 is affected by: Uncontrolled Resource Consumption. The impact is: denial of service. The component is: function jsiValueGetString (jsiUtils… |
CVE-2019-14262 | High | 7.5 | 2019-07-25 | MetadataExtractor 2.1.0 allows stack consumption. |
CVE-2019-1010266 | Medium | 6.5 | 2019-07-17 | lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attac… |
CVE-2019-0046 | Medium | 6.5 | 2019-07-11 | A vulnerability in the pfe-chassisd Chassis Manager (CMLC) daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the EX4… |
CVE-2019-5445 | Medium | 4.9 | 2019-07-10 | DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands. |
CVE-2019-1873 | High | 8.6 | 2019-07-10 | A vulnerability in the cryptographic driver for Cisco Adaptive Security Appliance Software (ASA) and Firepower Threat Defense (FTD) Software could allow an una… |
CVE-2019-11890 | High | 7.5 | 2019-07-09 | Sony Bravia Smart TV devices allow remote attackers to cause a denial of service (device hang or reboot) via a SYN flood attack over a wired or Wi-Fi LAN. |
CVE-2019-13232 | Low | 3.3 | 2019-07-04 | Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" iss… |
CVE-2019-11478 | Medium | 5.3 | 2019-06-19 | Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP S… |
CVE-2019-2259 | Critical | 9.8 | 2019-06-14 | Resource allocation error while playing the video whose dimensions are more than supported dimension in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect… |
CVE-2019-10636 | Medium | 4.6 | 2019-06-04 | Marvell SSD Controller (88SS1074, 88SS1079, 88SS1080, 88SS1093, 88SS1092, 88SS1095, 88SS9174, 88SS9175, 88SS9187, 88SS9188, 88SS9189, 88SS9190, 88SS1085, 88SS1… |
CVE-2018-11936 | Critical | 9.8 | 2019-05-24 | Index of array is processed in a wrong way inside a while loop and result in invalid index (-1 or something else) leads to out of bound memory access. in Snapd… |
CVE-2019-10977 | High | 7.5 | 2019-05-23 | In Mitsubishi Electric MELSEC-Q series Ethernet module QJ71E71-100 serial number 20121 and prior, an attacker could send crafted TCP packets against the FTP se… |
CVE-2018-7821 | High | 7.5 | 2019-05-22 | An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which… |
CVE-2019-0820 | High | 7.5 | 2019-05-16 | A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Servic… |
CVE-2019-10113 | High | 7.5 | 2019-05-16 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Making concurrent GET /api/v4… |
CVE-2019-1814 | High | 8.6 | 2019-05-16 | A vulnerability in the interactions between the DHCP and TFTP features for Cisco Small Business 300 Series (Sx300) Managed Switches could allow an unauthentica… |
CVE-2019-6578 | High | 7.5 | 2019-05-14 | A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G28), S… |
CVE-2018-19037 | High | 7.5 | 2019-05-13 | On Virgin Media wireless router 3.0 hub devices, the web interface is vulnerable to denial of service. When POST requests are sent and keep the connection open… |
CVE-2017-12806 | High | 7.5 | 2019-05-09 | In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial of service. |
CVE-2017-12805 | High | 7.5 | 2019-05-09 | In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a denial of service. |
CVE-2017-12804 | Medium | 6.5 | 2019-05-09 | The iwgif_init_screen function in imagew-gif.c:510 in ImageWorsener 1.3.2 allows remote attackers to cause a denial of service (hmemory exhaustion) via a craft… |
CVE-2018-13994 | High | 7.5 | 2019-05-07 | The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is vulnerable to a denial-of-service attack by making more than 120 connections. |
CVE-2019-1704 | High | 7.5 | 2019-05-03 | Multiple vulnerabilities in the Server Message Block (SMB) Protocol preprocessor detection engine for Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2019-1703 | High | 8.6 | 2019-05-03 | A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for the Cisco Firepower 2100 Series could allo… |
CVE-2019-1696 | High | 7.5 | 2019-05-03 | Multiple vulnerabilities in the Server Message Block (SMB) Protocol preprocessor detection engine for Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2018-15388 | High | 8.6 | 2019-05-03 | A vulnerability in the WebVPN login process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow a… |
CVE-2019-10952 | Critical | 9.8 | 2019-05-01 | An attacker could send a crafted HTTP/HTTPS request to render the web server unavailable and/or lead to remote code execution caused by a stack-based buffer ov… |
CVE-2019-10948 | High | 7.5 | 2019-04-30 | Fujifilm FCR Capsula X/ Carbon X/ FCR XC-2, model versions CR-IR 357 FCR Carbon X, CR-IR 357 FCR XC-2, FCR-IR 357 FCR Capsula X are susceptible to a denial-of-… |
CVE-2019-2602 | High | 7.5 | 2019-04-23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u211… |
CVE-2019-11470 | Medium | 6.5 | 2019-04-23 | The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon… |
CVE-2013-7470 | Medium | 5.9 | 2019-04-23 | cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of servic… |
CVE-2019-11391 | Medium | 5.3 | 2019-04-21 | An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause… |
CVE-2019-11390 | Medium | 5.3 | 2019-04-21 | An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause… |
CVE-2019-11389 | Medium | 5.3 | 2019-04-21 | An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause… |
CVE-2019-11388 | Medium | 5.3 | 2019-04-21 | An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf allows remote attackers to cause… |
CVE-2019-11387 | Medium | 5.3 | 2019-04-21 | An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf allows remote attackers to caus… |
CVE-2018-16878 | Medium | 5.5 | 2019-04-18 | A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS |
CVE-2019-9220 | High | 7.5 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Uncontrolled Resou… |
CVE-2019-10953 | High | 7.5 | 2019-04-17 | ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are suscep… |
CVE-2019-0038 | Medium | 6.5 | 2019-04-10 | Crafted packets destined to the management interface (fxp0) of an SRX340 or SRX345 services gateway may create a denial of service (DoS) condition due to buffe… |
CVE-2019-0033 | High | 7.5 | 2019-04-10 | A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high CPU condition leading to a Denial of S… |
CVE-2019-0031 | High | 7.5 | 2019-04-10 | Specific IPv6 DHCP packets received by the jdhcpd daemon will cause a memory resource consumption issue to occur on a Junos OS device using the jdhcpd daemon c… |
CVE-2019-0199 | High | 7.5 | 2019-04-10 | The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted… |
CVE-2018-19282 | Critical | 9.8 | 2019-04-04 | Rockwell Automation PowerFlex 525 AC Drives 5.001 and earlier allow remote attackers to cause a denial of service by crashing the Common Industrial Protocol (C… |
CVE-2018-4409 | Medium | 6.5 | 2019-04-03 | A resource exhaustion issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1, tvOS 12.1, Safari 12.0.1, iTunes 12.9… |
CVE-2019-4080 | Medium | 6.5 | 2019-04-02 | IBM WebSphere Application Server Admin Console 7.5, 8.0, 8.5, and 9.0 is vulnerable to a potential denial of service, caused by improper parameter parsing. A r… |
CVE-2018-3979 | Medium | 6.5 | 2019-04-01 | A remote denial-of-service vulnerability exists in the way the Nouveau Display Driver (the default Ubuntu Nvidia display driver) handles GPU shader execution… |
CVE-2018-13296 | High | 7.5 | 2019-04-01 | Uncontrolled resource consumption vulnerability in TLS configuration in Synology MailPlus Server before 2.0.5-0606 allows remote attackers to conduct denial-of… |
CVE-2019-5739 | High | 7.5 | 2019-03-28 | Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated serv… |
CVE-2019-5737 | High | 7.5 | 2019-03-28 | In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by est… |
CVE-2019-1737 | High | 8.6 | 2019-03-27 | A vulnerability in the processing of IP Service Level Agreement (SLA) packets by Cisco IOS Software and Cisco IOS XE software could allow an unauthenticated, r… |
CVE-2018-12545 | High | 7.5 | 2019-03-27 | In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames contai… |
CVE-2019-5419 | High | 7.5 | 2019-03-27 | There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can c… |
CVE-2019-4046 | High | 7.5 | 2019-03-25 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by improper handling of request headers. A remote attacker… |
CVE-2019-3874 | Medium | 6.5 | 2019-03-25 | The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service at… |
CVE-2018-19158 | High | 7.5 | 2019-03-21 | ColossusCoinXT through 1.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a sm… |
CVE-2018-18898 | High | 7.5 | 2019-03-21 | The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity att… |
CVE-2019-9750 | Critical | 9.1 | 2019-03-13 | In IoTivity through 1.3.1, the CoAP server interface can be used for Distributed Denial of Service attacks using source IP address spoofing and UDP-based traff… |
CVE-2019-9587 | High | 7.8 | 2019-03-06 | There is a stack consumption issue in md5Round1() located in Decrypt.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pd… |
CVE-2019-6559 | Medium | 6.5 | 2019-03-05 | Moxa IKS and EDS allow remote authenticated users to cause a denial of service via a specially crafted packet, which may cause the switch to crash. |
CVE-2018-5819 | High | 7.5 | 2019-02-20 | An error within the "parse_sinar_ia()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU re… |
CVE-2018-20030 | High | 7.5 | 2019-02-20 | An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources. |
CVE-2019-8909 | High | 7.5 | 2019-02-18 | An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service (resource consumption) via crafted dimensions for the verificatio… |
CVE-2017-0938 | High | 7.5 | 2019-02-12 | Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks. |
CVE-2019-1672 | Medium | 5.8 | 2019-02-08 | A vulnerability in the Decryption Policy Default Action functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker… |
CVE-2019-6535 | High | 7.5 | 2019-02-05 | Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26… |
CVE-2018-16492 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype. |
CVE-2018-16491 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype. |
CVE-2018-16490 | High | 7.5 | 2019-02-01 | A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype. |
CVE-2018-16489 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions. |
CVE-2018-16487 | Medium | 5.6 | 2019-02-01 | A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying… |
CVE-2018-16486 | Critical | 9.8 | 2019-02-01 | A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype. |
CVE-2018-17189 | Medium | 5.3 | 2019-01-30 | In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily… |
CVE-2019-6986 | High | 7.5 | 2019-01-28 | SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expression denial of se… |
CVE-2019-1644 | High | 7.5 | 2019-01-23 | A vulnerability in the UDP protocol implementation for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to exhaust sy… |
CVE-2017-3144 | High | 7.5 | 2019-01-16 | A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the D… |
CVE-2017-3140 | Low | 3.7 | 2019-01-16 | If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while hand… |
CVE-2019-3554 | Medium | 5.9 | 2019-01-15 | Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attack against systems a… |
CVE-2018-20699 | Medium | 4.9 | 2019-01-12 | Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus v… |
CVE-2018-15464 | Medium | 5.8 | 2019-01-11 | A vulnerability in Cisco 900 Series Aggregation Services Router (ASR) software could allow an unauthenticated, remote attacker to cause a partial denial of ser… |
CVE-2018-6347 | High | 7.5 | 2018-12-31 | An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior to v2018.12.31.00. |
CVE-2018-6346 | High | 7.5 | 2018-12-31 | A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This affects Proxygen pri… |
CVE-2018-6335 | High | 7.5 | 2018-12-31 | A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to denial-of-service. This affects all sup… |
CVE-2018-20543 | Medium | 6.5 | 2018-12-28 | There is an attempted excessive memory allocation at libxsmm_sparse_csc_reader in generator_spgemm_csc_reader.c in LIBXSMM 1.10 that will cause a denial of ser… |
CVE-2018-20502 | Medium | 6.5 | 2018-12-26 | An issue was discovered in Bento4 1.5.1-627. There is an attempt at excessive memory allocation in the AP4_DataBuffer class when called from AP4_HvccAtom::Crea… |
CVE-2018-19871 | Medium | 6.5 | 2018-12-26 | An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption. |
CVE-2018-18960 | Medium | 5.9 | 2018-12-24 | An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. They use SNMP to find certain devices on the network, b… |
CVE-2017-9732 | High | 7.5 | 2018-12-20 | The read_packet function in knc (Kerberised NetCat) before 1.11-1 is vulnerable to denial of service (memory exhaustion) that can be exploited remotely without… |
CVE-2018-1000872 | Medium | 6.5 | 2018-12-20 | OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerability in PyKMIP serve… |
CVE-2018-20186 | Medium | 6.5 | 2018-12-17 | An issue was discovered in Bento4 1.5.1-627. AP4_Sample::ReadData in Core/Ap4Sample.cpp allows attackers to trigger an attempted excessive memory allocation, r… |
CVE-2018-20169 | Medium | 6.8 | 2018-12-17 | An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to __usb… |
CVE-2018-6707 | Low | 3.7 | 2018-12-14 | Denial of Service through Resource Depletion vulnerability in the agent in non-Windows McAfee Agent (MA) 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows local use… |
CVE-2018-13815 | High | 7.5 | 2018-12-13 | A vulnerability has been identified in SIMATIC S7-1200 (All versions), SIMATIC S7-1500 (All Versions < V2.6). An attacker could exhaust the available connectio… |
CVE-2018-19881 | Medium | 5.5 | 2018-12-06 | In Artifex MuPDF 1.14.0, svg/svg-run.c allows remote attackers to cause a denial of service (recursive calls followed by a fitz/xml.c fz_xml_att crash from exc… |