CWE-400 · Uncontrolled Resource Consumption (page 31)
Page 31 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7755 | High | 7.5 | 2020-10-27 | All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values. |
CVE-2020-7753 | High | 7.5 | 2020-10-27 | All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim(). |
CVE-2020-3572 | High | 8.6 | 2020-10-21 | A vulnerability in the SSL/TLS session handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allo… |
CVE-2020-3571 | High | 8.6 | 2020-10-21 | A vulnerability in the ICMP ingress packet processing of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 4110 appliances could allow an unaut… |
CVE-2020-3563 | High | 8.6 | 2020-10-21 | A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to caus… |
CVE-2020-3554 | High | 7.5 | 2020-10-21 | A vulnerability in the TCP packet processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2020-3533 | High | 8.6 | 2020-10-21 | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Firepower Threat Defense (FTD) Software could allow an unauthe… |
CVE-2020-3529 | High | 8.6 | 2020-10-21 | A vulnerability in the SSL VPN negotiation process for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could… |
CVE-2020-3528 | High | 8.6 | 2020-10-21 | A vulnerability in the OSPF Version 2 (OSPFv2) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Soft… |
CVE-2020-3499 | High | 8.6 | 2020-10-21 | A vulnerability in the licensing service of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to cause a denial… |
CVE-2020-3373 | High | 8.6 | 2020-10-21 | A vulnerability in the IP fragment-handling implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Softwar… |
CVE-2020-3304 | High | 8.6 | 2020-10-21 | A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthentic… |
CVE-2020-1689 | Medium | 6.5 | 2020-10-16 | On Juniper Networks EX4300-MP Series, EX4600 Series and QFX5K Series deployed in a Virtual Chassis configuration, receipt of a stream of specific layer 2 frame… |
CVE-2020-1687 | Medium | 6.5 | 2020-10-16 | On Juniper Networks EX4300-MP Series, EX4600 Series and QFX5K Series deployed in (Ethernet VPN) EVPN-(Virtual Extensible LAN) VXLAN configuration, receipt of a… |
CVE-2020-1684 | High | 7.5 | 2020-10-16 | On Juniper Networks SRX Series configured with application identification inspection enabled, receipt of specific HTTP traffic can cause high CPU load utilizat… |
CVE-2020-1678 | Medium | 6.5 | 2020-10-16 | On Juniper Networks Junos OS and Junos OS Evolved platforms with EVPN configured, receipt of specific BGP packets causes a slow memory leak. If the memory is e… |
CVE-2020-1670 | Medium | 6.5 | 2020-10-16 | On Juniper Networks EX4300 Series, receipt of a stream of specific IPv4 packets can cause Routing Engine (RE) high CPU load, which could lead to network protoc… |
CVE-2020-1668 | Medium | 6.5 | 2020-10-16 | On Juniper Networks EX2300 Series, receipt of a stream of specific multicast packets by the layer2 interface can cause high CPU load, which could lead to traff… |
CVE-2020-11645 | Medium | 6.5 | 2020-10-15 | A denial of service vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users… |
CVE-2020-3543 | Medium | 6.5 | 2020-10-08 | A vulnerability in the Cisco Discovery Protocol of Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause a… |
CVE-2020-26164 | Medium | 5.5 | 2020-10-07 | In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memor… |
CVE-2020-13333 | Medium | 4.3 | 2020-10-06 | A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a link from a release had a regex check whic… |
CVE-2020-1903 | Medium | 5.5 | 2020-10-06 | An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulte… |
CVE-2020-1901 | Medium | 5.3 | 2020-10-06 | Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message. |
CVE-2019-20922 | High | 7.5 | 2020-09-30 | Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while proc… |
CVE-2018-10585 | High | 7.5 | 2020-09-25 | Pexip Infinity before 18 allows remote Denial of Service (XML parsing). |
CVE-2018-10432 | High | 7.5 | 2020-09-25 | Pexip Infinity before 18 allows Remote Denial of Service (TLS handshakes in RTMP). |
CVE-2020-3560 | High | 8.6 | 2020-09-24 | A vulnerability in Cisco Aironet Access Points (APs) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) on an affected device… |
CVE-2020-3559 | High | 8.6 | 2020-09-24 | A vulnerability in Cisco Aironet Access Point (AP) Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerab… |
CVE-2020-3527 | High | 8.6 | 2020-09-24 | A vulnerability in the Polaris kernel of Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote attacker to crash the device. The vulnerabi… |
CVE-2020-3512 | High | 7.4 | 2020-09-24 | A vulnerability in the PROFINET handler for Link Layer Discovery Protocol (LLDP) messages of Cisco IOS Software and Cisco IOS XE Software could allow an unauth… |
CVE-2020-3510 | High | 8.6 | 2020-09-24 | A vulnerability in the Umbrella Connector component of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote att… |
CVE-2020-3508 | High | 7.4 | 2020-09-24 | A vulnerability in the IP Address Resolution Protocol (ARP) feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers with a 20-G… |
CVE-2020-3487 | Medium | 6.5 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3479 | Medium | 6.1 | 2020-09-24 | A vulnerability in the implementation of Multiprotocol Border Gateway Protocol (MP-BGP) for the Layer 2 VPN (L2VPN) Ethernet VPN (EVPN) address family in Cisco… |
CVE-2020-3428 | Medium | 6.5 | 2020-09-24 | A vulnerability in the WLAN Local Profiling feature of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthentica… |
CVE-2020-3414 | High | 8.6 | 2020-09-24 | A vulnerability in the packet processing of Cisco IOS XE Software for Cisco 4461 Integrated Services Routers could allow an unauthenticated, remote attacker to… |
CVE-2020-3409 | High | 7.4 | 2020-09-24 | A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected… |
CVE-2020-3408 | High | 8.6 | 2020-09-24 | A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected d… |
CVE-2020-3569 | High | 8.6 | 2020-09-23 | Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote atta… |
CVE-2020-8251 | High | 7.5 | 2020-09-18 | Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new con… |
CVE-2020-8246 | High | 7.5 | 2020-09-18 | Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix… |
CVE-2020-8237 | High | 7.5 | 2020-09-18 | Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack. |
CVE-2020-7733 | High | 7.5 | 2020-09-16 | The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA. |
CVE-2020-15166 | High | 7.5 | 2020-09-11 | In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacte… |
CVE-2018-17145 | High | 7.5 | 2020-09-10 | Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with r… |
CVE-2020-2039 | Medium | 5.3 | 2020-09-09 | An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the… |
CVE-2020-14384 | High | 7.5 | 2020-09-09 | A flaw was found in JBossWeb in versions before 7.5.31.Final-redhat-3. The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulnerable to a denial… |
CVE-2019-5645 | High | 7.5 | 2020-09-01 | By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When e… |
CVE-2020-3566 | High | 8.6 | 2020-08-29 | A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to e… |
CVE-2020-3504 | Low | 3.3 | 2020-08-27 | A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of servic… |
CVE-2020-3505 | Medium | 6.5 | 2020-08-26 | A vulnerability in the Cisco Discovery Protocol of Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause a… |
CVE-2020-14522 | High | 7.5 | 2020-08-25 | Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to uncontrolled resource consumption… |
CVE-2020-3976 | Medium | 5.3 | 2020-08-21 | VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services. VMware has evaluated the severity… |
CVE-2020-9703 | Medium | 5.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a stack exhaustio… |
CVE-2020-9702 | Medium | 5.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a stack exhaustio… |
CVE-2020-13281 | Medium | 6.5 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature |
CVE-2020-13280 | Medium | 6.5 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message. |
CVE-2020-8229 | Medium | 5.5 | 2020-08-10 | A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system. |
CVE-2020-15114 | High | 7.7 | 2020-08-06 | In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to i… |
CVE-2020-11937 | Medium | 5.5 | 2020-08-06 | In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion d… |
CVE-2020-12739 | Medium | 5.3 | 2020-08-03 | A denial-of-service vulnerability in the Fanuc i Series CNC (0i-MD and 0i Mate-MD) could allow an unauthenticated, remote attacker to cause an affected CNC to… |
CVE-2020-8220 | Medium | 6.5 | 2020-07-30 | A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection via the administrato… |
CVE-2020-8192 | Medium | 6.5 | 2020-07-30 | A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors opt… |
CVE-2020-7016 | Medium | 4.8 | 2020-07-27 | Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user c… |
CVE-2020-8175 | Medium | 5.5 | 2020-07-24 | Uncontrolled resource consumption in `jpeg-js` before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image. |
CVE-2020-14297 | Medium | 6.5 | 2020-07-24 | A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the tim… |
CVE-2020-8557 | Medium | 5.5 | 2020-07-23 | The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/h… |
CVE-2020-3372 | Medium | 6.5 | 2020-07-16 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to consume excessive syste… |
CVE-2020-3351 | High | 8.6 | 2020-07-16 | A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerabili… |
CVE-2020-15101 | Low | 2.8 | 2020-07-14 | In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk()… |
CVE-2020-15100 | Low | 2.8 | 2020-07-14 | In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been patched in 0.1.1. |
CVE-2020-7587 | High | 8.2 | 2020-07-14 | A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Executi… |
CVE-2020-7584 | High | 7.5 | 2020-07-14 | A vulnerability has been identified in SIMATIC S7-200 SMART CPU family (All versions >= V2.2 < V2.5.1). Affected devices do not properly handle large numbers o… |
CVE-2020-10745 | High | 7.5 | 2020-07-07 | A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This flaw allows a remote… |
CVE-2020-15565 | High | 8.8 | 2020-07-07 | An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain privileges because o… |
CVE-2020-8185 | Medium | 6.5 | 2020-07-02 | A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production. |
CVE-2020-8663 | High | 7.5 | 2020-07-01 | Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections. |
CVE-2020-12603 | High | 7.5 | 2020-07-01 | Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte… |
CVE-2020-5603 | High | 7.5 | 2020-06-30 | Uncontrolled resource consumption vulnerability in Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. 1.94Y and earlier… |
CVE-2020-9611 | Medium | 5.5 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have a sta… |
CVE-2015-9548 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file th… |
CVE-2018-21250 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a denial of service (memory consumption) via… |
CVE-2019-20858 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consumption) via crafted characters in a SQL… |
CVE-2017-9104 | Critical | 9.8 | 2020-06-18 | An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered. |
CVE-2020-7507 | High | 7.5 | 2020-06-16 | A CWE-400: Uncontrolled Resource Consumption vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to login mul… |
CVE-2020-14152 | High | 7.1 | 2020-06-15 | In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memor… |
CVE-2018-16848 | Medium | 6.5 | 2020-06-15 | A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition… |
CVE-2020-0173 | Medium | 6.5 | 2020-06-11 | In Parse_lins of eas_mdls.c, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additi… |
CVE-2020-11090 | High | 7.5 | 2020-06-11 | In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability. Indy Node has a bug in TAA handling code. The current primary can be crashed… |
CVE-2020-13238 | High | 7.5 | 2020-06-10 | Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted packet over the networ… |
CVE-2020-13849 | High | 7.5 | 2020-06-04 | The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remote attackers to caus… |
CVE-2020-7661 | High | 7.5 | 2020-06-04 | all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of… |
CVE-2018-21240 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows memory consumption via an ArrayBuffer(0xfffffffe) call. |
CVE-2018-21238 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows memory consumption via an ArrayBuffer(0xfffffffe) call. |
CVE-2020-13815 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It allows stack consumption via a loop of an indirect object reference. |
CVE-2020-13809 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows resource consumption via long strings in the content stream. |
CVE-2020-11080 | Low | 3.7 | 2020-06-03 | In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious cli… |
CVE-2020-3203 | High | 8.6 | 2020-06-03 | A vulnerability in the locally significant certificate (LSC) provisioning feature of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IOS… |
CVE-2019-20812 | Medium | 5.5 | 2020-06-03 | An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (C… |