CWE-400 · Uncontrolled Resource Consumption (page 32)
Page 32 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1333 | High | 7.5 | 2018-06-18 | By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed… |
CVE-2018-7164 | High | 7.5 | 2018-06-13 | Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from… |
CVE-2018-12066 | Medium | 5.5 | 2018-06-08 | BIRD Internet Routing Daemon before 1.6.4 allows local users to cause a denial of service (stack consumption and daemon crash) via BGP mask expressions in bird… |
CVE-2017-6779 | High | 7.5 | 2018-06-07 | Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow… |
CVE-2018-3739 | Critical | 9.1 | 2018-06-07 | https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setu… |
CVE-2017-16138 | High | 7.5 | 2018-06-07 | The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input. |
CVE-2017-16137 | Medium | 5.3 | 2018-06-07 | The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters… |
CVE-2017-16136 | High | 7.5 | 2018-06-07 | method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. met… |
CVE-2017-16129 | Medium | 5.9 | 2018-06-07 | The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes seve… |
CVE-2017-16119 | High | 7.5 | 2018-06-07 | Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is p… |
CVE-2017-16118 | High | 7.5 | 2018-06-07 | The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when… |
CVE-2017-16117 | High | 7.5 | 2018-06-07 | slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted in… |
CVE-2017-16116 | High | 7.5 | 2018-06-07 | The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically… |
CVE-2017-16115 | High | 7.5 | 2018-06-07 | The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around… |
CVE-2017-16114 | High | 7.5 | 2018-06-07 | The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for… |
CVE-2017-16113 | High | 7.5 | 2018-06-07 | The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed. |
CVE-2017-16111 | High | 7.5 | 2018-06-07 | The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to r… |
CVE-2017-16099 | High | 7.5 | 2018-06-07 | The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event loo… |
CVE-2017-16098 | High | 7.5 | 2018-06-07 | charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds… |
CVE-2017-16086 | High | 7.5 | 2018-06-07 | ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a speciall… |
CVE-2017-16030 | High | 7.5 | 2018-06-04 | Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arb… |
CVE-2017-16025 | Medium | 5.9 | 2018-06-04 | Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an… |
CVE-2017-16023 | High | 7.5 | 2018-06-04 | Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a… |
CVE-2017-16021 | Medium | 6.5 | 2018-06-04 | uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-j… |
CVE-2017-16013 | High | 7.5 | 2018-06-04 | hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown… |
CVE-2017-6153 | Medium | 5.3 | 2018-06-01 | Features in F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 system that utilizes inflate functionality directly, via an i… |
CVE-2016-10544 | Medium | 5.9 | 2018-05-31 | uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used c… |
CVE-2016-10542 | High | 7.5 | 2018-05-31 | ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly… |
CVE-2016-10540 | High | 7.5 | 2018-05-31 | Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, patt… |
CVE-2016-10539 | High | 7.5 | 2018-05-31 | negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", wh… |
CVE-2016-10527 | High | 7.5 | 2018-05-31 | The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditions. |
CVE-2016-10524 | High | 8.2 | 2018-05-31 | i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in… |
CVE-2016-10523 | High | 7.5 | 2018-05-31 | MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandw… |
CVE-2016-10521 | High | 7.5 | 2018-05-31 | jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator. |
CVE-2016-10520 | High | 7.5 | 2018-05-31 | jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in. |
CVE-2015-9239 | High | 7.5 | 2018-05-31 | ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in. |
CVE-2014-10064 | High | 7.5 | 2018-05-31 | The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will bl… |
CVE-2015-9242 | High | 7.5 | 2018-05-29 | Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash… |
CVE-2015-9241 | High | 7.5 | 2018-05-29 | Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 e… |
CVE-2018-6237 | High | 7.5 | 2018-05-25 | A vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow an unauthenticated remote attacker to manipulate the product to send a larg… |
CVE-2016-8627 | Medium | 4.3 | 2018-05-11 | admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET reques… |
CVE-2018-10827 | High | 7.5 | 2018-05-09 | LiteCart before 2.1.2 allows remote attackers to cause a denial of service (memory consumption) via URIs that do not exist, because public_html/logs/not_found… |
CVE-2018-0285 | Medium | 6.5 | 2018-05-02 | A vulnerability in service logging for Cisco Prime Service Catalog could allow an authenticated, remote attacker to deny service to the user interface. The vul… |
CVE-2018-1277 | Medium | 6.5 | 2018-04-30 | Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers. A remote authenticated user may push an ap… |
CVE-2017-7651 | High | 7.5 | 2018-04-24 | In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can b… |
CVE-2018-0233 | High | 8.6 | 2018-04-19 | A vulnerability in the Secure Sockets Layer (SSL) packet reassembly functionality of the detection engine in Cisco Firepower System Software could allow an una… |
CVE-2018-0230 | High | 8.6 | 2018-04-19 | A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Security Appli… |
CVE-2018-7920 | High | 7.5 | 2018-04-19 | Huawei AR1200 V200R006C10SPC300, AR160 V200R006C10SPC300, AR200 V200R006C10SPC300, AR2200 V200R006C10SPC300, AR3200 V200R006C10SPC300 devices have an improper… |
CVE-2018-10193 | High | 7.5 | 2018-04-18 | LogMeIn LastPass through 4.15.0 allows remote attackers to cause a denial of service (browser hang) via an HTML document because the resource consumption of on… |
CVE-2018-10070 | High | 7.5 | 2018-04-16 | A vulnerability in MikroTik Version 6.41.4 could allow an unauthenticated remote attacker to exhaust all available CPU and all available RAM by sending a craft… |
CVE-2018-0022 | High | 7.5 | 2018-04-11 | A Junos device with VPLS routing-instances configured on one or more interfaces may be susceptible to an mbuf leak when processing a specific MPLS packet. Appr… |
CVE-2017-12093 | Medium | 5.3 | 2018-04-05 | An exploitable insufficient resource pool vulnerability exists in the session communication functionality of Allen Bradley Micrologix 1400 Series B Firmware 21… |
CVE-2017-12090 | High | 7.7 | 2018-04-05 | An exploitable denial of service vulnerability exists in the processing of snmp-set commands of the Allen Bradley Micrologix 1400 Series B FRN 21.2 and below… |
CVE-2018-8777 | High | 7.5 | 2018-04-03 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted… |
CVE-2018-4100 | High | 7.5 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. watchOS before 4.2.2 is affected. The issue… |
CVE-2018-1064 | High | 7.5 | 2018-03-28 | libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now al… |
CVE-2014-2885 | High | 7.1 | 2018-03-19 | Multiple integer overflows in TrueCrypt 7.1a allow local users to (1) obtain sensitive information via vectors involving a crafted item->OriginalLength value i… |
CVE-2016-9589 | High | 7.5 | 2018-03-12 | Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen… |
CVE-2017-15323 | Medium | 5.5 | 2018-03-09 | Huawei DP300 V500R002C00, NIP6600 V500R001C00, V500R001C20, V500R001C30, Secospace USG6500 V500R001C00, V500R001C20, V500R001C30, TE60 V100R001C01, V100R001C10… |
CVE-2018-7876 | Medium | 6.5 | 2018-03-08 | In libming 0.4.8, a memory exhaustion vulnerability was found in the function parseSWF_ACTIONRECORD in util/parser.c, which allows remote attackers to cause a… |
CVE-2017-12174 | High | 7.5 | 2018-03-07 | It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an… |
CVE-2018-1000115 | High | 7.5 | 2018-03-05 | Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the mem… |
CVE-2017-18214 | High | 7.5 | 2018-03-04 | The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-20… |
CVE-2018-7651 | Medium | 5.9 | 2018-03-04 | index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode functionality via a long b… |
CVE-2017-15130 | Medium | 5.9 | 2018-03-02 | A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups… |
CVE-2018-7048 | High | 7.5 | 2018-03-01 | An issue was discovered in Wowza Streaming Engine before 4.7.1. There is a denial of service (memory consumption) via a crafted HTTP request. |
CVE-2018-5501 | Medium | 5.9 | 2018-03-01 | In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile allows excessive buffer… |
CVE-2018-5500 | Medium | 5.9 | 2018-03-01 | On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, every Multipath TCP (MCTCP) connection established leaks a small amount of memory… |
CVE-2018-7540 | Medium | 6.5 | 2018-02-27 | An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (host OS CPU hang) via non-preemptable L3/L4 pagetabl… |
CVE-2018-6532 | High | 7.5 | 2018-02-27 | An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted (authenticated and unauthenticated) requests, an attacker can exhaust a lot o… |
CVE-2015-9253 | Medium | 6.5 | 2018-02-19 | An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endle… |
CVE-2017-17290 | High | 7.5 | 2018-02-15 | The Light Directory Access Protocol (LDAP) clients of Huawei TE60 with software V600R006C00, ViewPoint 9030 with software V100R011C02, V100R011C03 have a resou… |
CVE-2017-17166 | Medium | 5.3 | 2018-02-15 | Huawei DP300 V500R002C00, Secospace USG6300 V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6500 V500R001C00, V500R001C20, V500R001C30, V500R0… |
CVE-2017-15345 | Medium | 5.3 | 2018-02-15 | Huawei Smartphones with software LON-L29DC721B186 have a denial of service vulnerability. An attacker could make an loop exit condition that cannot be reached… |
CVE-2017-13233 | Medium | 6.5 | 2018-02-12 | In ihevcd_ctb_boundary_strength_pbslice of libhevc, there is possible resource exhaustion. This could lead to a remote temporary denial of service with no addi… |
CVE-2018-6389 | High | 7.5 | 2018-02-06 | In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (fro… |
CVE-2017-6198 | Medium | 6.5 | 2018-02-06 | The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to cause a denial of service by launching a… |
CVE-2015-4412 | Critical | 9.8 | 2018-02-05 | BSON injection vulnerability in the legal? function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resourc… |
CVE-2018-6616 | Medium | 5.5 | 2018-02-04 | In OpenJPEG 2.3.0, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to caus… |
CVE-2017-14180 | High | 7.8 | 2018-02-02 | Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an atta… |
CVE-2017-14179 | High | 7.8 | 2018-02-02 | Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker cou… |
CVE-2017-14177 | High | 7.8 | 2018-02-02 | Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could lev… |
CVE-2017-15133 | High | 7.5 | 2018-01-29 | A denial of service flaw was found in miekg-dns before 1.0.4. A remote attacker could use carefully timed TCP packets to block the DNS server from accepting ne… |
CVE-2018-6352 | Medium | 5.5 | 2018-01-27 | In PoDoFo 0.9.5, there is an Excessive Iteration in the PdfParser::ReadObjectsInternal function of base/PdfParser.cpp. Remote attackers could leverage this vul… |
CVE-2017-3768 | High | 7.5 | 2018-01-26 | An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Lenovo System x and ea… |
CVE-2017-15132 | High | 7.5 | 2018-01-25 | A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login process… |
CVE-2018-5954 | High | 7.5 | 2018-01-25 | phpFreeChat 1.7 and earlier allows remote attackers to cause a denial of service by sending a large number of connect commands. |
CVE-2018-5748 | High | 7.5 | 2018-01-25 | qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply. |
CVE-2018-4837 | High | 7.5 | 2018-01-25 | A vulnerability has been identified in TeleControl Server Basic < V3.1. An attacker with access to the TeleControl Server Basic's webserver (port 80/tcp or 443… |
CVE-2018-5784 | Medium | 6.5 | 2018-01-19 | In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote attackers could leverage this vulnerabili… |
CVE-2018-0094 | High | 7.5 | 2018-01-18 | A vulnerability in IPv6 ingress packet processing for Cisco UCS Central Software could allow an unauthenticated, remote attacker to cause a denial of service (… |
CVE-2018-0090 | High | 7.5 | 2018-01-18 | A vulnerability in management interface access control list (ACL) configuration of Cisco NX-OS System Software could allow an unauthenticated, remote attacker… |
CVE-2018-0086 | High | 8.6 | 2018-01-18 | A vulnerability in the application server of the Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to cause a denial of… |
CVE-2017-13211 | High | 7.5 | 2018-01-12 | In bta_scan_results_cb_impl of btif_ble_scanner.cc, there is possible resource exhaustion if a large number of repeated BLE scan results are received. This cou… |
CVE-2018-0004 | Medium | 6.5 | 2018-01-10 | A sustained sequence of different types of normal transit traffic can trigger a high CPU consumption denial of service condition in the Junos OS register and s… |
CVE-2017-1000476 | Medium | 6.5 | 2018-01-03 | ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allows attackers to cause a denial of ser… |
CVE-2017-17901 | High | 7.5 | 2017-12-29 | ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (CPU consumption) via a flood of IP packets with a TTL of 1. |
CVE-2014-3651 | High | 7.5 | 2017-12-29 | JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/q… |
CVE-2017-12741 | High | 7.5 | 2017-12-26 | Specially crafted packets sent to port 161/udp could cause a denial of service condition. The affected devices must be restarted manually. |
CVE-2017-17682 | Medium | 6.5 | 2017-12-14 | In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, which allows attackers to cause a denial o… |