CWE-400 · Uncontrolled Resource Consumption (page 33)
Page 33 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2013-3691 | High | 7.5 | 2019-12-11 | AirLive POE-2600HD allows remote attackers to cause a denial of service (device reset) via a long URL. |
CVE-2013-4120 | High | 7.5 | 2019-12-10 | Katello has a Denial of Service vulnerability in API OAuth authentication |
CVE-2019-16671 | Medium | 6.5 | 2019-12-06 | An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Remo… |
CVE-2019-14901 | Critical | 9.8 | 2019-11-29 | A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote… |
CVE-2019-6667 | High | 7.5 | 2019-11-27 | On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.5.1-11.6.5, under certain conditions, TMM may consume exces… |
CVE-2019-14867 | High | 8.8 | 2019-11-27 | A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function… |
CVE-2019-6477 | High | 7.5 | 2019-11-26 | With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelinin… |
CVE-2011-4082 | High | 7.5 | 2019-11-26 | A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-Language" HTTP header. A remote attacker… |
CVE-2019-16764 | Medium | 6.5 | 2019-11-25 | The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from… |
CVE-2019-11287 | High | 7.5 | 2019-11-23 | Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versio… |
CVE-2019-15593 | Medium | 6.5 | 2019-11-22 | GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Commen… |
CVE-2012-0877 | High | 7.5 | 2019-11-22 | PyXML: Hash table collisions CPU usage Denial of Service |
CVE-2019-6661 | High | 7.5 | 2019-11-15 | When the BIG-IP APM 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.4.1, or 11.5.1-11.6.5 system processes certain requests, the APD/APMD daemon may… |
CVE-2019-6660 | High | 7.5 | 2019-11-15 | On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of systems resources which may lead to a den… |
CVE-2019-13555 | Medium | 5.9 | 2019-11-13 | In Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU: serial number 21081 and prior, Q04/06/13/26UDPVCPU: serial number 21081 and prior, and Q03UDECPU… |
CVE-2019-17360 | High | 7.5 | 2019-11-12 | A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.7.0-00 allows an unauthenticated remote user to trigger a denial of service (DoS) condition becau… |
CVE-2012-1572 | High | 7.5 | 2019-11-12 | OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space |
CVE-2012-0049 | Medium | 4.3 | 2019-11-07 | OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server. |
CVE-2019-10504 | Medium | 6.5 | 2019-11-06 | Firmware not able to send EXT scan response to host within 1 sec due to resource consumption issue in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Indu… |
CVE-2011-1459 | Medium | 6.5 | 2019-11-05 | The WebKit::WebPluginContainerImpl::handleEvent function in Google Chrome before Blink M11 allows an attacker to cause a denial of service (crash) via the html… |
CVE-2018-19167 | High | 7.5 | 2019-11-05 | CloakCoin through 2.2.2.0 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small… |
CVE-2018-19166 | High | 7.5 | 2019-11-05 | peercoin through 0.6.4 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small am… |
CVE-2018-19165 | High | 7.5 | 2019-11-05 | neblio through 1.5.1 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amou… |
CVE-2018-19164 | High | 7.5 | 2019-11-05 | reddcoin through 2.1.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small… |
CVE-2018-19163 | High | 7.5 | 2019-11-05 | stratisX through 2.0.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small… |
CVE-2018-19162 | High | 7.5 | 2019-11-05 | Divi through 4.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount… |
CVE-2018-19161 | High | 7.5 | 2019-11-05 | alqo through 4.1 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount o… |
CVE-2018-19160 | High | 7.5 | 2019-11-05 | Diamond through 3.0.1.2 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small a… |
CVE-2018-19159 | High | 7.5 | 2019-11-05 | lux through 5.2.2 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount… |
CVE-2018-19157 | High | 7.5 | 2019-11-05 | Phore through 1.3.3.1 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amo… |
CVE-2018-19156 | High | 7.5 | 2019-11-05 | PIVX through 3.1.03 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amoun… |
CVE-2018-19155 | High | 7.5 | 2019-11-05 | navcoin through 4.3.0 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack re… |
CVE-2018-19154 | High | 7.5 | 2019-11-05 | HTMLCOIN through 2.12 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack re… |
CVE-2018-19153 | High | 7.5 | 2019-11-05 | particl through 0.17 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack req… |
CVE-2018-19152 | High | 7.5 | 2019-11-05 | emercoin through 0.7 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack req… |
CVE-2019-12625 | High | 7.5 | 2019-11-05 | ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sendi… |
CVE-2019-5043 | High | 7.5 | 2019-10-31 | An exploitable denial-of-service vulnerability exists in the Weave daemon of the Nest Cam IQ Indoor, version 4620002. A set of TCP connections can cause unrest… |
CVE-2019-7620 | High | 7.5 | 2019-10-30 | Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who is able to connect to… |
CVE-2018-19151 | High | 7.5 | 2019-10-29 | qtum through 0.16 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack requir… |
CVE-2019-15264 | Medium | 6.5 | 2019-10-16 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol implementation of Cisco Aironet and Catalyst 9100 Access Points (AP… |
CVE-2019-17592 | High | 7.5 | 2019-10-14 | The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expres… |
CVE-2019-13921 | High | 7.5 | 2019-10-10 | A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1). Affected versions of the software contain a vulnerability that… |
CVE-2019-10936 | High | 7.5 | 2019-10-10 | Affected devices improperly handle large amounts of specially crafted UDP packets. This could allow an unauthenticated remote attacker to trigger a denial o… |
CVE-2019-10923 | High | 7.5 | 2019-10-10 | An attacker with network access to an affected product may cause a denial of service condition by breaking the real-time synchronization (IRT) of the affected… |
CVE-2019-0059 | High | 7.5 | 2019-10-09 | A memory leak vulnerability in the of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending specific command… |
CVE-2019-15226 | High | 7.5 | 2019-10-09 | Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a m… |
CVE-2019-6015 | High | 7.5 | 2019-10-04 | FON2601E-SE, FON2601E-RE, FON2601E-FSW-S, and FON2601E-FSW-B with firmware versions 1.1.7 and earlier contain an issue where they may behave as open resolvers… |
CVE-2019-15256 | High | 8.6 | 2019-10-02 | A vulnerability in the Internet Key Exchange version 1 (IKEv1) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (… |
CVE-2019-12714 | Medium | 6.5 | 2019-10-02 | A vulnerability in the web-based management interface of Cisco IC3000 Industrial Compute Gateway could allow an authenticated, remote attacker to cause a denia… |
CVE-2019-12700 | Medium | 6.5 | 2019-10-02 | A vulnerability in the configuration of the Pluggable Authentication Module (PAM) used in Cisco Firepower Threat Defense (FTD) Software, Cisco Firepower Manage… |
CVE-2019-12698 | High | 7.5 | 2019-10-02 | A vulnerability in the WebVPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unau… |
CVE-2019-9349 | Medium | 6.5 | 2019-09-27 | In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional exe… |
CVE-2019-12659 | High | 7.5 | 2019-09-25 | A vulnerability in the HTTP server code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the HTTP server to crash. The vulnera… |
CVE-2019-12658 | High | 7.5 | 2019-09-25 | A vulnerability in the filesystem resource management code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to exhaust filesystem resou… |
CVE-2019-9717 | Medium | 6.5 | 2019-09-19 | In Libav 12.3, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because srt_to_ass in l… |
CVE-2019-4183 | High | 7.5 | 2019-09-17 | IBM Cognos Analytics 11.0, and 11.1 is vulnerable to a denial of service attack that could allow a remote user to send specially crafted requests that would co… |
CVE-2019-1967 | High | 7.5 | 2019-08-30 | A vulnerability in the Network Time Protocol (NTP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service… |
CVE-2019-11060 | High | 7.5 | 2019-08-29 | The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial o… |
CVE-2019-1965 | High | 7.7 | 2019-08-28 | A vulnerability in the Virtual Shell (VSH) session management for Cisco NX-OS Software could allow an authenticated, remote attacker to cause a VSH process to… |
CVE-2019-15549 | High | 7.5 | 2019-08-26 | An issue was discovered in the asn1_der crate before 0.6.2 for Rust. Attackers can trigger memory exhaustion by supplying a large value in a length field. |
CVE-2019-15538 | High | 7.5 | 2019-08-25 | An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of be… |
CVE-2019-10750 | Critical | 9.8 | 2019-08-23 | deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.p… |
CVE-2019-10747 | Critical | 9.8 | 2019-08-23 | set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Ob… |
CVE-2019-4049 | Medium | 5.5 | 2019-08-20 | IBM MQ 9.1.0.0, 9.1.0.1, 9.1.1, and 9.1.0.2 is vulnerable to a denial of service due to a local user being able to fill up the disk space of the underlying fil… |
CVE-2019-9583 | High | 8.2 | 2019-08-14 | eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login. This allows a Denial of Service and is a starting point for other attacks. Affected versions for… |
CVE-2019-9518 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with a… |
CVE-2019-9517 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 w… |
CVE-2019-9516 | Medium | 6.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length… |
CVE-2019-9515 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to t… |
CVE-2019-9514 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an in… |
CVE-2019-9513 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and con… |
CVE-2019-9512 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, ca… |
CVE-2019-9511 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The… |
CVE-2019-10942 | High | 8.6 | 2019-08-13 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl… |
CVE-2019-14233 | High | 7.5 | 2019-08-02 | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django… |
CVE-2019-14232 | High | 7.5 | 2019-08-02 | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() meth… |
CVE-2019-10162 | High | 7.5 | 2019-07-30 | A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the server to exit by insert… |
CVE-2019-13655 | Medium | 6.5 | 2019-07-29 | Imgix through 2019-06-19 allows remote attackers to cause a denial of service (resource consumption) by manipulating a small JPEG file to specify dimensions of… |
CVE-2019-10972 | Medium | 5.5 | 2019-07-26 | Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability can be triggered when an attacker provides the target with a rogue project fi… |
CVE-2019-1010172 | High | 7.5 | 2019-07-25 | Jsish 2.4.84 2.0484 is affected by: Uncontrolled Resource Consumption. The impact is: denial of service. The component is: function jsiValueGetString (jsiUtils… |
CVE-2019-14262 | High | 7.5 | 2019-07-25 | MetadataExtractor 2.1.0 allows stack consumption. |
CVE-2019-1010266 | Medium | 6.5 | 2019-07-17 | lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attac… |
CVE-2019-0046 | Medium | 6.5 | 2019-07-11 | A vulnerability in the pfe-chassisd Chassis Manager (CMLC) daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the EX4… |
CVE-2019-5445 | Medium | 4.9 | 2019-07-10 | DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands. |
CVE-2019-1873 | High | 8.6 | 2019-07-10 | A vulnerability in the cryptographic driver for Cisco Adaptive Security Appliance Software (ASA) and Firepower Threat Defense (FTD) Software could allow an una… |
CVE-2019-11890 | High | 7.5 | 2019-07-09 | Sony Bravia Smart TV devices allow remote attackers to cause a denial of service (device hang or reboot) via a SYN flood attack over a wired or Wi-Fi LAN. |
CVE-2019-13232 | Low | 3.3 | 2019-07-04 | Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" iss… |
CVE-2019-11478 | Medium | 5.3 | 2019-06-19 | Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP S… |
CVE-2019-2259 | Critical | 9.8 | 2019-06-14 | Resource allocation error while playing the video whose dimensions are more than supported dimension in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect… |
CVE-2019-10636 | Medium | 4.6 | 2019-06-04 | Marvell SSD Controller (88SS1074, 88SS1079, 88SS1080, 88SS1093, 88SS1092, 88SS1095, 88SS9174, 88SS9175, 88SS9187, 88SS9188, 88SS9189, 88SS9190, 88SS1085, 88SS1… |
CVE-2018-11936 | Critical | 9.8 | 2019-05-24 | Index of array is processed in a wrong way inside a while loop and result in invalid index (-1 or something else) leads to out of bound memory access. in Snapd… |
CVE-2019-10977 | High | 7.5 | 2019-05-23 | In Mitsubishi Electric MELSEC-Q series Ethernet module QJ71E71-100 serial number 20121 and prior, an attacker could send crafted TCP packets against the FTP se… |
CVE-2018-7821 | High | 7.5 | 2019-05-22 | An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which… |
CVE-2019-0820 | High | 7.5 | 2019-05-16 | A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Servic… |
CVE-2019-10113 | High | 7.5 | 2019-05-16 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Making concurrent GET /api/v4… |
CVE-2019-1814 | High | 8.6 | 2019-05-16 | A vulnerability in the interactions between the DHCP and TFTP features for Cisco Small Business 300 Series (Sx300) Managed Switches could allow an unauthentica… |
CVE-2019-6578 | High | 7.5 | 2019-05-14 | A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G28), S… |
CVE-2018-19037 | High | 7.5 | 2019-05-13 | On Virgin Media wireless router 3.0 hub devices, the web interface is vulnerable to denial of service. When POST requests are sent and keep the connection open… |
CVE-2017-12806 | High | 7.5 | 2019-05-09 | In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial of service. |
CVE-2017-12805 | High | 7.5 | 2019-05-09 | In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a denial of service. |