CWE-400 · Uncontrolled Resource Consumption (page 32)
Page 32 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-8937 | High | 7.5 | 2020-06-01 | Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources. |
CVE-2020-13623 | High | 7.5 | 2020-05-27 | JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation. |
CVE-2019-11048 | Medium | 5.3 | 2020-05-20 | In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field name… |
CVE-2020-10995 | High | 7.5 | 2020-05-19 | PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found… |
CVE-2020-8616 | High | 8.6 | 2020-05-19 | A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the us… |
CVE-2020-12662 | High | 7.5 | 2020-05-19 | Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in N… |
CVE-2020-12667 | High | 7.5 | 2020-05-19 | Knot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker-controlled server, aka an "NXNSAttack" issue. This is trigger… |
CVE-2020-3334 | High | 7.4 | 2020-05-06 | A vulnerability in the ARP packet processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Fi… |
CVE-2020-3306 | High | 7.5 | 2020-05-06 | A vulnerability in the DHCP module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthe… |
CVE-2020-3305 | High | 7.5 | 2020-05-06 | A vulnerability in the implementation of the Border Gateway Protocol (BGP) module in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threa… |
CVE-2020-3303 | High | 7.5 | 2020-05-06 | A vulnerability in the Internet Key Exchange version 1 (IKEv1) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (… |
CVE-2020-3255 | High | 7.5 | 2020-05-06 | A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to caus… |
CVE-2020-3254 | High | 7.5 | 2020-05-06 | Multiple vulnerabilities in the Media Gateway Control Protocol (MGCP) inspection feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Thre… |
CVE-2020-3196 | High | 8.6 | 2020-05-06 | A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepowe… |
CVE-2020-3195 | High | 7.5 | 2020-05-06 | A vulnerability in the Open Shortest Path First (OSPF) implementation in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (F… |
CVE-2020-3189 | High | 8.6 | 2020-05-06 | A vulnerability in the VPN System Logging functionality for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to ca… |
CVE-2020-9481 | High | 7.5 | 2020-04-27 | Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack. |
CVE-2020-1722 | Medium | 5.3 | 2020-04-27 | A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing proce… |
CVE-2020-7486 | High | 7.5 | 2020-04-16 | **VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability could cause TCM modules to reset when under high network load in TCM v10.4.x and in system v10.3.x. Thi… |
CVE-2020-3260 | Medium | 6.5 | 2020-04-15 | A vulnerability in Cisco Aironet Series Access Points Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition o… |
CVE-2019-19301 | High | 7.5 | 2020-04-14 | A vulnerability has been identified in SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE X202-2IRT, SCALANCE X202-2P IRT, SCALANCE… |
CVE-2019-19300 | High | 7.5 | 2020-04-14 | A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P, K… |
CVE-2020-1625 | Medium | 6.5 | 2020-04-08 | The kernel memory usage represented as "temp" via 'show system virtual-memory' may constantly increase when Integrated Routing and Bridging (IRB) is configured… |
CVE-2019-17657 | High | 7.5 | 2020-04-07 | An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3 a… |
CVE-2020-5347 | Medium | 5.3 | 2020-04-04 | Dell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop… |
CVE-2019-18904 | Medium | 6.5 | 2020-04-03 | A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance C… |
CVE-2020-5527 | High | 7.5 | 2020-03-30 | When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versi… |
CVE-2020-10954 | High | 7.5 | 2020-03-27 | GitLab through 12.9 is affected by a potential DoS in repository archive download. |
CVE-2020-1950 | Medium | 5.5 | 2020-03-23 | A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23. |
CVE-2020-8136 | High | 7.5 | 2020-03-20 | Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a special… |
CVE-2020-0088 | Medium | 6.5 | 2020-03-15 | In parseTrackFragmentRun of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of ser… |
CVE-2020-9464 | High | 7.5 | 2020-03-12 | A Denial-of-Service vulnerability exists in BECKHOFF Ethernet TCP/IP Bus Coupler BK9000. After an attack has occurred, the device's functionality can be restor… |
CVE-2019-5149 | High | 7.5 | 2020-03-11 | The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use o… |
CVE-2019-19281 | High | 7.5 | 2020-03-10 | A vulnerability has been identified in SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V2.5 and < V20.8), SIMATIC S7-1… |
CVE-2019-18336 | High | 7.5 | 2020-03-10 | A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V3.X.17), SIMATIC TDC CP51M1 (A… |
CVE-2019-13011 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could… |
CVE-2019-13009 | Medium | 6.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible… |
CVE-2019-13007 | Medium | 4.9 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering… |
CVE-2019-13003 | High | 7.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion a… |
CVE-2020-7212 | High | 7.5 | 2020-03-06 | The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because… |
CVE-2020-6986 | High | 7.5 | 2020-03-05 | In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethern… |
CVE-2020-8661 | High | 7.5 | 2020-03-04 | CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests. |
CVE-2020-3190 | Medium | 5.8 | 2020-03-04 | A vulnerability in the IPsec packet processor of Cisco IOS XR Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condit… |
CVE-2020-3181 | Medium | 6.5 | 2020-03-04 | A vulnerability in the malware detection functionality in Cisco Advanced Malware Protection (AMP) in Cisco AsyncOS Software for Cisco Email Security Appliances… |
CVE-2020-3175 | High | 8.6 | 2020-02-26 | A vulnerability in the resource handling system of Cisco NX-OS Software for Cisco MDS 9000 Series Multilayer Switches could allow an unauthenticated, remote at… |
CVE-2020-3168 | High | 7.5 | 2020-02-26 | A vulnerability in the Secure Login Enhancements capability of Cisco Nexus 1000V Switch for VMware vSphere could allow an unauthenticated, remote attacker to c… |
CVE-2020-9369 | High | 7.5 | 2020-02-24 | Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listma… |
CVE-2012-0785 | High | 7.5 | 2020-02-24 | Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400… |
CVE-2015-4411 | High | 7.5 | 2020-02-20 | The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker… |
CVE-2012-5366 | High | 7.5 | 2020-02-20 | The IPv6 implementation in Apple Mac OS X (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6… |
CVE-2012-5365 | High | 7.5 | 2020-02-20 | The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICM… |
CVE-2012-5364 | High | 7.5 | 2020-02-20 | The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement pack… |
CVE-2012-5363 | High | 7.5 | 2020-02-20 | The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICM… |
CVE-2012-5362 | High | 7.5 | 2020-02-20 | The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation mes… |
CVE-2020-3132 | Medium | 5.9 | 2020-02-19 | A vulnerability in the email message scanning feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote… |
CVE-2020-8992 | Medium | 5.5 | 2020-02-14 | ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a cra… |
CVE-2020-3741 | High | 7.5 | 2020-02-13 | Adobe Experience Manager versions 6.5, and 6.4 have an uncontrolled resource consumption vulnerability. Successful exploitation could lead to denial-of-service. |
CVE-2013-4602 | Medium | 5.5 | 2020-02-12 | A Denial of Service (infinite loop) vulnerability exists in Avira AntiVir Engine before 8.2.12.58 via an unspecified function in the PDF Scanner Engine. |
CVE-2011-3336 | High | 7.5 | 2020-02-12 | regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion. |
CVE-2012-0810 | Medium | 5.5 | 2020-02-12 | The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stack corruption and pa… |
CVE-2019-13946 | High | 7.5 | 2020-02-11 | Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent… |
CVE-2019-13940 | Medium | 5.3 | 2020-02-11 | A vulnerability has been identified in SIMATIC ET 200pro IM154-8 PN/DP CPU (All versions < V3.X.17), SIMATIC ET 200pro IM154-8F PN/DP CPU (All versions < V3.X… |
CVE-2019-13926 | High | 7.5 | 2020-02-11 | A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All ver… |
CVE-2019-13925 | High | 7.5 | 2020-02-11 | A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All ver… |
CVE-2020-1700 | Medium | 6.5 | 2020-02-07 | A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disco… |
CVE-2016-1544 | Low | 3.3 | 2020-02-06 | nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion). |
CVE-2020-8123 | Medium | 4.9 | 2020-02-04 | A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of t… |
CVE-2019-9674 | High | 7.5 | 2020-02-04 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. |
CVE-2020-5236 | Medium | 5.7 | 2020-02-04 | Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x1… |
CVE-2019-20446 | Medium | 6.5 | 2020-02-02 | In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The at… |
CVE-2020-8492 | Medium | 6.5 | 2020-01-30 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression… |
CVE-2013-3074 | High | 7.5 | 2020-01-28 | NetGear WNDR4700 Media Server devices with firmware 1.0.0.34 allow remote attackers to cause a denial of service (device crash). |
CVE-2019-5472 | High | 7.5 | 2020-01-28 | An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments. |
CVE-2020-3131 | Medium | 6.5 | 2020-01-26 | A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial o… |
CVE-2019-16022 | High | 8.6 | 2020-01-26 | Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unaut… |
CVE-2019-16020 | High | 8.6 | 2020-01-26 | Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unaut… |
CVE-2019-16018 | Medium | 6.5 | 2020-01-26 | A vulnerability in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticate… |
CVE-2015-5333 | High | 7.5 | 2020-01-23 | Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number o… |
CVE-2012-6083 | High | 7.5 | 2020-01-23 | Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet. |
CVE-2019-14888 | High | 7.5 | 2020-01-23 | A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out… |
CVE-2013-4175 | Medium | 5.5 | 2020-01-23 | MySecureShell 1.31 has a Local Denial of Service Vulnerability |
CVE-2012-4863 | Medium | 6.5 | 2020-01-23 | IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability |
CVE-2008-7314 | High | 7.5 | 2020-01-23 | mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname. |
CVE-2019-15961 | High | 7.5 | 2020-01-15 | A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacke… |
CVE-2020-1600 | Medium | 6.5 | 2020-01-15 | In a Point-to-Multipoint (P2MP) Label Switched Path (LSP) scenario, an uncontrolled resource consumption vulnerability in the Routing Protocol Daemon (RPD) in… |
CVE-2020-6173 | Medium | 5.3 | 2020-01-14 | TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption. |
CVE-2019-20146 | Medium | 5.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. It allows Uncontrolled Resource Consumption. |
CVE-2014-3447 | High | 7.5 | 2020-01-09 | BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerability |
CVE-2014-3211 | High | 7.5 | 2020-01-09 | Publify before 8.0.1 is vulnerable to a Denial of Service attack |
CVE-2019-10775 | High | 7.5 | 2020-01-02 | ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application. |
CVE-2019-20201 | Medium | 6.5 | 2019-12-31 | An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML entities, leading to an infinite loop in which memory allocatio… |
CVE-2019-20176 | High | 7.5 | 2019-12-31 | In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c. |
CVE-2012-5645 | High | 7.5 | 2019-12-30 | A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain packets. A remote attacker could send a specially-… |
CVE-2011-1474 | Medium | 5.5 | 2019-12-26 | A locally locally exploitable DOS vulnerability was found in pax-linux versions 2.6.32.33-test79.patch, 2.6.38-test3.patch, and 2.6.37.4-test14.patch. A bad bo… |
CVE-2019-6683 | High | 7.5 | 2019-12-23 | On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IP virtual servers with Loose Initiation… |
CVE-2019-6682 | High | 7.5 | 2019-12-23 | On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP ASM system may consume excessive resources when p… |
CVE-2019-19922 | Medium | 5.5 | 2019-12-22 | kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service agai… |
CVE-2019-15584 | Medium | 6.5 | 2019-12-20 | A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affe… |
CVE-2019-16555 | Medium | 6.5 | 2019-12-17 | A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attac… |
CVE-2014-0212 | High | 7.5 | 2019-12-13 | qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors |