CWE-400 · Uncontrolled Resource Consumption (page 31)
Page 31 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-19838 | Medium | 6.5 | 2018-12-04 | In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack con… |
CVE-2018-19837 | Medium | 6.5 | 2018-12-04 | In LibSass prior to 3.5.5, Sass::Eval::operator()(Sass::Binary_Expression*) inside eval.cpp allows attackers to cause a denial-of-service resulting from stack… |
CVE-2018-6332 | Medium | 5.9 | 2018-12-03 | A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate resources. This aff… |
CVE-2018-14626 | Medium | 5.3 | 2018-11-29 | PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cache pollution via craf… |
CVE-2018-10851 | Medium | 5.3 | 2018-11-29 | PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, are vulnerable to a… |
CVE-2018-12122 | High | 7.5 | 2018-11-28 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by… |
CVE-2018-12121 | High | 7.5 | 2018-11-28 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests w… |
CVE-2018-16853 | High | 7.5 | 2018-11-28 | Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos confi… |
CVE-2018-14629 | Medium | 6.5 | 2018-11-28 | A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead to infinite recursion… |
CVE-2018-0700 | High | 7.5 | 2018-11-15 | YukiWiki 2.1.3 and earlier does not process a particular request properly that may allow consumption of large amounts of CPU and memory resources and may resul… |
CVE-2018-16470 | High | 7.5 | 2018-11-13 | There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathol… |
CVE-2018-15772 | High | 7.1 | 2018-11-13 | Dell EMC RecoverPoint versions prior to 5.1.2.1 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an uncontrolled resource consumption vulnerability… |
CVE-2018-1786 | Medium | 5.3 | 2018-11-12 | IBM Spectrum Protect 7.1 and 8.1 dsmc and dsmcad processes incorrectly accumulate TCP/IP sockets in a CLOSE_WAIT state. This can cause TCP/IP resource leakage… |
CVE-2018-15443 | Medium | 5.8 | 2018-11-08 | A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured Intrusion Pre… |
CVE-2018-15437 | Medium | 5.5 | 2018-11-08 | A vulnerability in the system scanning component of Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windows could… |
CVE-2018-16845 | Medium | 6.1 | 2018-11-07 | nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process… |
CVE-2018-16844 | High | 7.5 | 2018-11-07 | nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx co… |
CVE-2018-16843 | High | 7.5 | 2018-11-07 | nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects… |
CVE-2018-16472 | High | 7.5 | 2018-11-06 | A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are then inherited by a… |
CVE-2018-3935 | High | 7.5 | 2018-11-02 | An exploitable code execution vulnerability exists in the UDP network functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can… |
CVE-2018-14660 | Medium | 6.5 | 2018-11-01 | A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, authenticated attacker… |
CVE-2018-14659 | Medium | 6.5 | 2018-10-31 | The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_KEY' xattr. A remote… |
CVE-2018-15325 | Medium | 4.3 | 2018-10-31 | In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, iControl and TMSH usage by authenticated users may leak a small amount of memory when executing commands |
CVE-2018-18854 | High | 7.5 | 2018-10-31 | Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during t… |
CVE-2018-18853 | High | 7.5 | 2018-10-31 | Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during t… |
CVE-2018-16469 | High | 7.5 | 2018-10-30 | The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be p… |
CVE-2018-11828 | High | 7.5 | 2018-10-26 | When FW tries to get random mac address generated from new SW RNG and ADC values read are constant then DUT get struck in loop while trying to get random ADC s… |
CVE-2017-18299 | Medium | 5.5 | 2018-10-23 | Improper translation table consolidation logic leads to resource exhaustion and QSEE error in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in v… |
CVE-2018-0441 | High | 7.4 | 2018-10-17 | A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause… |
CVE-2018-0381 | Medium | 6.8 | 2018-10-17 | A vulnerability in the Cisco Aironet Series Access Points (APs) software could allow an authenticated, adjacent attacker to cause an affected device to reload… |
CVE-2018-17898 | High | 7.5 | 2018-10-12 | Yokogawa STARDOM Controllers FCJ,FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The controller application fails to prevent memory exhaustion by unau… |
CVE-2018-0063 | Medium | 6.5 | 2018-10-10 | A vulnerability in the IP next-hop index database in Junos OS 17.3R3 may allow a flood of ARP requests, sent to the management interface, to exhaust the privat… |
CVE-2018-0061 | Medium | 5.3 | 2018-10-10 | A denial of service vulnerability in the telnetd service on Junos OS allows remote unauthenticated users to cause high CPU usage which may affect system perfor… |
CVE-2018-0054 | Medium | 6.5 | 2018-10-10 | On QFX5000 Series and EX4600 switches, a high rate of Ethernet pause frames or an ARP packet storm received on the management interface (fxp0) can cause egress… |
CVE-2018-0048 | High | 7.5 | 2018-10-10 | A vulnerability in the Routing Protocols Daemon (RPD) with Juniper Extension Toolkit (JET) support can allow a network based unauthenticated attacker to cause… |
CVE-2018-13805 | High | 7.5 | 2018-10-10 | A vulnerability has been identified in SIMATIC ET 200SP Open Controller (All versions >= V2.0 and < V2.1.6), SIMATIC S7-1500 Software Controller (All versions… |
CVE-2018-17977 | Medium | 4.4 | 2018-10-08 | The Linux kernel 4.14.67 mishandles certain interaction among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets, which allows local users to ca… |
CVE-2018-15399 | Medium | 6.8 | 2018-10-05 | A vulnerability in the TCP syslog module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an u… |
CVE-2018-15396 | Medium | 6.8 | 2018-10-05 | A vulnerability in the Bulk Administration Tool (BAT) for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization… |
CVE-2018-15383 | High | 7.5 | 2018-10-05 | A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) S… |
CVE-2018-15377 | High | 8.6 | 2018-10-05 | A vulnerability in the Cisco Network Plug and Play agent, also referred to as the Cisco Open Plug-n-Play agent, of Cisco IOS Software and Cisco IOS XE Software… |
CVE-2018-0471 | High | 7.4 | 2018-10-05 | A vulnerability in the Cisco Discovery Protocol (CDP) module of Cisco IOS XE Software Releases 16.6.1 and 16.6.2 could allow an unauthenticated, adjacent attac… |
CVE-2018-17985 | Medium | 5.5 | 2018-10-04 | An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption problem caused by the cplus_demang… |
CVE-2018-14648 | High | 7.5 | 2018-09-28 | A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthentica… |
CVE-2018-17581 | Medium | 6.5 | 2018-09-28 | CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service. |
CVE-2018-8854 | High | 7.5 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not properly restrict the size or amount of resources requested or influen… |
CVE-2018-17281 | High | 7.5 | 2018-09-24 | There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and… |
CVE-2018-14827 | High | 7.5 | 2018-09-20 | Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. A remote, unauthenticated threat actor may intentionally send specially crafted Ethernet/IP pack… |
CVE-2017-1794 | High | 7.5 | 2018-09-19 | IBM Tivoli Monitoring 6.2.3 through 6.2.3.5 and 6.3.0 through 6.3.0.7 are vulnerable to both TEPS user privilege escalation and possible denial of service due… |
CVE-2018-14638 | High | 7.5 | 2018-09-14 | A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are… |
CVE-2018-16949 | High | 7.5 | 2018-09-12 | An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array typ… |
CVE-2018-1114 | Medium | 6.5 | 2018-09-11 | It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaus… |
CVE-2018-10935 | Medium | 6.5 | 2018-09-11 | A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort. |
CVE-2016-7068 | Medium | 5.3 | 2018-09-11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause… |
CVE-2016-7072 | Medium | 5.3 | 2018-09-10 | An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by op… |
CVE-2016-9040 | Medium | 5.5 | 2018-09-07 | An exploitable denial of service exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system ca… |
CVE-2018-16310 | Medium | 6.5 | 2018-09-06 | Technicolor TG588V V2 devices allow remote attackers to cause a denial of service (networking outage) via a flood of random MAC addresses, as demonstrated by m… |
CVE-2018-5391 | High | 7.5 | 2018-09-06 | The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An… |
CVE-2018-6923 | High | 7.5 | 2018-09-04 | In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p2, 11.1-RELEASE-p13, ip fragment reassembly code is vulnerable to a denial of service due to excessive system reso… |
CVE-2018-6554 | Medium | 5.5 | 2018-09-04 | Memory leak in the irda_bind function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users… |
CVE-2018-10924 | Medium | 5.3 | 2018-09-04 | It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service… |
CVE-2018-11056 | Medium | 6.5 | 2018-08-31 | RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contain an Uncontrolled R… |
CVE-2018-16131 | High | 7.5 | 2018-08-30 | The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a de… |
CVE-2018-16132 | High | 8.6 | 2018-08-29 | The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before… |
CVE-2018-15907 | Medium | 6.5 | 2018-08-29 | Technicolor (formerly RCA) TC8305C devices allow remote attackers to cause a denial of service (networking outage) via a flood of random MAC addresses, as demo… |
CVE-2018-8005 | Medium | 5.3 | 2018-08-29 | When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with… |
CVE-2018-15853 | Medium | 5.5 | 2018-08-25 | Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by suppl… |
CVE-2018-15852 | Medium | 6.5 | 2018-08-25 | Technicolor TC7200.20 devices allow remote attackers to cause a denial of service (networking outage) via a flood of random MAC addresses, as demonstrated by m… |
CVE-2018-1157 | Medium | 6.5 | 2018-08-23 | Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and i… |
CVE-2018-15671 | Medium | 6.5 | 2018-08-21 | An issue was discovered in the HDF HDF5 1.10.2 library. Excessive stack consumption has been detected in the function H5P__get_cb() in H5Pint.c during an attem… |
CVE-2018-15607 | Medium | 6.5 | 2018-08-21 | In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang o… |
CVE-2018-5243 | High | 7.5 | 2018-08-20 | The Symantec Encryption Management Server (SEMS) product, prior to version 3.4.2 MP1, may be susceptible to a denial of service (DoS) exploit. A DoS attack is… |
CVE-2018-15470 | Medium | 6.5 | 2018-08-17 | An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handling writes depended on the order of evaluation of expressions making up a tuple… |
CVE-2018-15469 | Medium | 6.5 | 2018-08-17 | An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in the hypervisor or in Linux. Unfortunately, an ARM guest… |
CVE-2016-9596 | Medium | 6.5 | 2018-08-16 | libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption)… |
CVE-2018-0418 | High | 8.6 | 2018-08-15 | A vulnerability in the Local Packet Transport Services (LPTS) feature set of Cisco ASR 9000 Series Aggregation Services Router Software could allow an unauthen… |
CVE-2018-0410 | High | 8.6 | 2018-08-15 | A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, remote attacker to e… |
CVE-2018-10864 | Medium | 5.3 | 2018-08-13 | An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may provide an existin… |
CVE-2018-6922 | Medium | 5.3 | 2018-08-09 | One of the data structures that holds TCP segments in all versions of FreeBSD prior to 11.2-RELEASE-p1, 11.1-RELEASE-p12, and 10.4-RELEASE-p10 uses an ineffici… |
CVE-2018-5390 | High | 7.5 | 2018-08-06 | Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can… |
CVE-2018-14940 | High | 7.5 | 2018-08-05 | PHPCMS 9 allows remote attackers to cause a denial of service (resource consumption) via large font_size, height, and width parameters in an api.php?op=checkco… |
CVE-2016-8611 | Medium | 4.3 | 2018-07-31 | A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenti… |
CVE-2017-5693 | High | 7.5 | 2018-07-31 | Firmware in the Intel Puma 5, 6, and 7 Series might experience resource depletion or timeout, which allows a network attacker to create a denial of service via… |
CVE-2018-10607 | High | 7.5 | 2018-07-31 | Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow the creation of new connections to one or more IOAs, without closi… |
CVE-2017-15119 | Medium | 5.8 | 2018-07-27 | The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. It could occur if a client sent large op… |
CVE-2018-5541 | High | 7.5 | 2018-07-25 | When F5 BIG-IP ASM 13.0.0-13.1.0.1, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.5.1-11.5.6 is processing HTTP requests, an unusually large number of parameters can… |
CVE-2018-5530 | High | 7.5 | 2018-07-25 | F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.1 virtual servers with HTTP/2 profiles enabled are vulnerable to "HPACK Bomb". |
CVE-2018-14596 | High | 7.5 | 2018-07-25 | wancms 1.0 through 5.0 allows remote attackers to cause a denial of service (resource consumption) via a checkcode (aka verification code) URI in which the val… |
CVE-2018-10632 | High | 7.5 | 2018-07-24 | In Moxa NPort 5210, 5230, and 5232 versions 2.9 build 17030709 and prior, the amount of resources requested by a malicious actor are not restricted, allowing f… |
CVE-2018-10608 | High | 7.5 | 2018-07-24 | SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP server, which may c… |
CVE-2018-0372 | High | 7.5 | 2018-07-18 | A vulnerability in the DHCPv6 feature of the Cisco Nexus 9000 Series Fabric Switches in Application-Centric Infrastructure (ACI) Mode could allow an unauthenti… |
CVE-2018-0031 | Medium | 5.3 | 2018-07-11 | Receipt of specially crafted UDP/IP packets over MPLS may be able to bypass a stateless firewall filter. The crafted UDP packets must be encapsulated and meet… |
CVE-2018-0030 | High | 7.5 | 2018-07-11 | Receipt of a specific MPLS packet may cause MPC7/8/9, PTX-FPC3 (FPC-P1, FPC-P2) line cards or PTX1K to crash and restart. By continuously sending specific MPLS… |
CVE-2018-0029 | Medium | 5.7 | 2018-07-11 | While experiencing a broadcast storm, placing the fxp0 interface into promiscuous mode via the 'monitor traffic interface fxp0' can cause the system to crash a… |
CVE-2016-10724 | High | 7.5 | 2018-07-05 | Bitcoin Core before v0.13.0 allows denial of service (memory exhaustion) triggered by the remote network alert system (deprecated since Q1 2016) if an attacker… |
CVE-2018-3767 | Critical | 9.1 | 2018-07-05 | `memjs` versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage. |
CVE-2018-13251 | Medium | 6.5 | 2018-07-05 | In libming 0.4.8, there is an excessive memory allocation attempt in the readBytes function of the util/read.c file, related to parseSWF_DEFINEBITSJPEG2. Remot… |
CVE-2018-1000518 | High | 7.5 | 2018-06-26 | aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unles… |
CVE-2018-12641 | Medium | 5.5 | 2018-06-22 | An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions… |
CVE-2018-0309 | High | 7.7 | 2018-06-21 | A vulnerability in the implementation of a specific CLI command and the associated Simple Network Management Protocol (SNMP) MIB for Cisco NX-OS (in standalone… |