CWE-400 · Uncontrolled Resource Consumption (page 33)
Page 33 of 35 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-15529 | Medium | 6.2 | 2017-12-13 | Prior to 4.4.1.10, the Norton Family Android App can be susceptible to a Denial of Service (DoS) exploit. A DoS attack is a type of attack whereby the perpetra… |
CVE-2017-4920 | Medium | 5.9 | 2017-12-05 | The implementation of the OSPF protocol in VMware NSX-V Edge 6.2.x prior to 6.2.8 and NSX-V Edge 6.3.x prior to 6.3.3 doesn't correctly handle the link-state a… |
CVE-2017-17051 | High | 8.6 | 2017-12-05 | An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user ma… |
CVE-2017-15701 | High | 7.5 | 2017-12-01 | In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthe… |
CVE-2017-2734 | Medium | 5.5 | 2017-11-22 | P9 Plus smartphones with software versions earlier before VIE-AL10BC00B386 have a denial of service (DoS) vulnerability. An attacker tricks a user into install… |
CVE-2017-2690 | Medium | 5.5 | 2017-11-22 | SoftCo with software V200R003C20,eSpace U1910 with software V200R003C00, V200R003C20 and V200R003C30,eSpace U1911 with software V200R003C20, V200R003C30,eSpace… |
CVE-2017-12190 | Medium | 6.5 | 2017-11-22 | The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small c… |
CVE-2017-1000191 | High | 7.5 | 2017-11-17 | Jool 3.5.0-3.5.1 is vulnerable to a kernel crashing packet resulting in a DOS. |
CVE-2017-14028 | High | 7.5 | 2017-11-16 | A Resource Exhaustion issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 V… |
CVE-2017-12318 | High | 7.5 | 2017-11-16 | A vulnerability in the TCP state machine of Cisco RF Gateway 1 devices could allow an unauthenticated, remote attacker to prevent an affected device from deliv… |
CVE-2016-8610 | High | 7.5 | 2017-11-13 | A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets… |
CVE-2017-7132 | High | 7.8 | 2017-11-13 | An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Quick Look" component. It allows remote attackers… |
CVE-2017-13825 | High | 7.8 | 2017-11-13 | An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "CoreText" component. It allows remote attackers to… |
CVE-2017-14360 | Medium | 5.9 | 2017-11-08 | A potential security vulnerability has been identified in HPE Content Manager Workgroup Service v9.00. The vulnerability could be remotely exploited to allow D… |
CVE-2017-2889 | High | 7.5 | 2017-11-07 | An exploitable Denial of Service vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A large amount of simultaneous TCP connec… |
CVE-2017-2884 | High | 7.5 | 2017-11-07 | An exploitable vulnerability exists in the user photo update functionality of Circle with Disney running firmware 2.0.1. A repeated set of specially crafted AP… |
CVE-2017-6161 | Medium | 5.3 | 2017-10-27 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator software version 12.0.0 - 12.1.2, 11.6.0 - 11.6.1… |
CVE-2017-15882 | High | 7.5 | 2017-10-26 | The London Trust Media Private Internet Access (PIA) application before 1.3.3.1 for Android allows remote attackers to cause a denial of service (application c… |
CVE-2017-7086 | High | 7.5 | 2017-10-23 | An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is a… |
CVE-2017-12293 | High | 8.6 | 2017-10-19 | A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability… |
CVE-2014-7813 | Medium | 6.5 | 2017-10-18 | Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls… |
CVE-2017-15596 | Medium | 6.0 | 2017-10-18 | An issue was discovered in Xen 4.4.x through 4.9.x allowing ARM guest OS users to cause a denial of service (prevent physical CPU usage) because of lock mishan… |
CVE-2017-15595 | High | 8.8 | 2017-10-18 | An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion, stack consumption, and hyperviso… |
CVE-2014-9697 | High | 7.5 | 2017-10-17 | Huawei USG9560/9520/9580 before V300R001C01SPC300 allows remote attackers to cause a memory leak or denial of service (memory exhaustion, reboot and MPU switch… |
CVE-2016-8734 | Medium | 6.5 | 2017-10-16 | Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by… |
CVE-2017-15298 | Medium | 5.5 | 2017-10-14 | Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a crafted repository… |
CVE-2017-10621 | Medium | 5.3 | 2017-10-13 | A denial of service vulnerability in telnetd service on Juniper Networks Junos OS allows remote unauthenticated attackers to cause a denial of service. Affecte… |
CVE-2017-10614 | Medium | 5.3 | 2017-10-13 | A vulnerability in telnetd service on Junos OS allows a remote attacker to cause a limited memory and/or CPU consumption denial of service attack. This issue w… |
CVE-2017-10613 | Medium | 5.5 | 2017-10-13 | A vulnerability in a specific loopback filter action command, processed in a specific logical order of operation, in a running configuration of Juniper Network… |
CVE-2017-10608 | High | 7.5 | 2017-10-13 | Any Juniper Networks SRX series device with one or more ALGs enabled may experience a flowd crash when traffic is processed by the Sun/MS-RPC ALGs. This vulner… |
CVE-2017-15193 | High | 7.5 | 2017-10-10 | In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by… |
CVE-2015-7384 | High | 7.5 | 2017-10-10 | Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service. |
CVE-2017-5637 | High | 7.5 | 2017-10-10 | Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the s… |
CVE-2017-14086 | High | 7.5 | 2017-10-06 | Pre-authorization Start Remote Process vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan serv… |
CVE-2017-15010 | High | 7.5 | 2017-10-04 | A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP req… |
CVE-2017-14988 | Medium | 5.5 | 2017-10-03 | Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file… |
CVE-2015-3248 | Medium | 4.7 | 2017-09-26 | openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when quotas are not prope… |
CVE-2017-8247 | High | 7.8 | 2017-09-21 | In all Qualcomm products with Android releases from CAF using the Linux kernel, if there is more than one thread doing the device open operation, the device ma… |
CVE-2017-14616 | High | 7.5 | 2017-09-20 | An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empt… |
CVE-2017-14342 | Medium | 6.5 | 2017-09-12 | ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c via a crafted wpg image file. |
CVE-2017-14341 | Medium | 6.5 | 2017-09-12 | ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in coders/wpg.c, causing CPU exhaustion via a crafted wpg image file. |
CVE-2017-14223 | Medium | 6.5 | 2017-09-09 | In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a… |
CVE-2013-7428 | High | 7.5 | 2017-09-07 | The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter to plugin_googlemap2_proxy.php. |
CVE-2017-14158 | High | 7.5 | 2017-09-05 | Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are read into memory, which… |
CVE-2017-14108 | Medium | 5.5 | 2017-09-05 | libgedit.a in GNOME gedit through 3.22.1 allows remote attackers to cause a denial of service (CPU consumption) via a file that begins with many '\0' character… |
CVE-2017-14137 | High | 7.5 | 2017-09-04 | ReadWEBPImage in coders/webp.c in ImageMagick 7.0.6-5 has an issue where memory allocation is excessive because it depends only on a length field in a header. |
CVE-2015-5695 | Medium | 6.5 | 2017-08-31 | Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an… |
CVE-2017-12077 | Medium | 4.9 | 2017-08-28 | Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology Router Manager (SRM) before 1.1.4-6509 allows remote authenticate… |
CVE-2017-12076 | Medium | 4.9 | 2017-08-28 | Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows remote authenticated… |
CVE-2017-8264 | High | 7.8 | 2017-08-11 | A userspace process can cause a Denial of Service in the camera driver in all Qualcomm products with Android releases from CAF using the Linux kernel. |
CVE-2015-2313 | High | 7.5 | 2017-08-09 | Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows remote peers to cau… |
CVE-2015-2312 | High | 7.5 | 2017-08-09 | Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and possibly general resource consumption)… |
CVE-2017-12140 | Medium | 6.5 | 2017-08-02 | The ReadDCMImage function in coders\dcm.c in ImageMagick 7.0.6-1 has an integer signedness error leading to excessive memory consumption via a crafted DCM file. |
CVE-2017-9259 | Medium | 5.5 | 2017-07-27 | The TDStretch::acceptNewOverlapLength function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (mem… |
CVE-2015-1417 | High | 7.5 | 2017-07-25 | The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9.3-RELEASE-p21, and… |
CVE-2017-11530 | Medium | 6.5 | 2017-07-23 | The ReadEPTImage function in coders/ept.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory con… |
CVE-2017-11527 | Medium | 6.5 | 2017-07-23 | The ReadDPXImage function in coders/dpx.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory con… |
CVE-2017-11526 | Medium | 6.5 | 2017-07-23 | The ReadOneMNGImage function in coders/png.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (large l… |
CVE-2017-11521 | High | 7.5 | 2017-07-22 | The SdpContents::Session::Medium::parse function in resip/stack/SdpContents.cxx in reSIProcate 1.10.2 allows remote attackers to cause a denial of service (mem… |
CVE-2017-7063 | High | 7.5 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. watchOS before 3.2.3 is affected. The issue involves the "Messages" component… |
CVE-2017-7007 | High | 7.5 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the "EventKitUI" component. It allows remote attackers to… |
CVE-2017-7684 | High | 7.5 | 2017-07-17 | Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the se… |
CVE-2017-2348 | High | 7.5 | 2017-07-17 | The Juniper Enhanced jdhcpd daemon may experience high CPU utilization, or crash and restart upon receipt of an invalid IPv6 UDP packet. Both high CPU utilizat… |
CVE-2017-1000064 | High | 7.5 | 2017-07-17 | kittoframework kitto version 0.5.1 is vulnerable to memory exhaustion in the router resulting in DoS |
CVE-2016-6312 | Medium | 6.5 | 2017-07-17 | The mod_dontdothat component of the mod_dav_svn Apache module in Subversion as packaged in Red Hat Enterprise Linux 5.11 does not properly detect recursion dur… |
CVE-2017-9845 | High | 7.5 | 2017-07-12 | disp+work 7400.12.21.30308 in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request, aka SA… |
CVE-2017-7670 | High | 7.5 | 2017-07-10 | The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made… |
CVE-2017-11142 | High | 7.5 | 2017-07-10 | In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form… |
CVE-2017-11140 | Medium | 5.5 | 2017-07-10 | The ReadJPEGImage function in coders/jpeg.c in GraphicsMagick 1.3.26 creates a pixel cache before a successful read of a scanline, which allows remote attacker… |
CVE-2017-9627 | High | 8.6 | 2017-07-07 | An Uncontrolled Resource Consumption issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. The uncontroll… |
CVE-2017-0690 | Medium | 5.5 | 2017-07-06 | A denial of service vulnerability in the Android media framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A… |
CVE-2017-10922 | High | 7.5 | 2017-07-05 | The grant-table feature in Xen through 4.8.x mishandles MMIO region grant references, which allows guest OS users to cause a denial of service (loss of grant t… |
CVE-2017-10800 | Medium | 5.5 | 2017-07-03 | When GraphicsMagick 1.3.25 processes a MATLAB image in coders/mat.c, it can lead to a denial of service (OOM) in ReadMATImage() if the size specified for a MAT… |
CVE-2017-10799 | Medium | 5.5 | 2017-07-03 | When GraphicsMagick 1.3.25 processes a DPX image (with metadata indicating a large width) in coders/dpx.c, a denial of service (OOM) can occur in ReadDPXImage(… |
CVE-2017-6017 | High | 7.5 | 2017-06-30 | A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP341000, BMX… |
CVE-2017-7521 | Medium | 5.9 | 2017-06-27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issu… |
CVE-2017-6043 | High | 7.5 | 2017-06-21 | A Resource Consumption issue was discovered in Trihedral VTScada Versions prior to 11.2.26. The client does not properly validate the input or limit the amount… |
CVE-2017-9129 | Medium | 5.5 | 2017-06-21 | The wav_open_read function in frontend/input.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to cause a denial of service (large loop) v… |
CVE-2017-1000378 | Critical | 9.8 | 2017-06-19 | The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to determi… |
CVE-2017-1000373 | Medium | 6.5 | 2017-06-19 | The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to determ… |
CVE-2016-5004 | Medium | 6.5 | 2017-06-06 | The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumptio… |
CVE-2017-2535 | High | 7.8 | 2017-05-22 | An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Security" component. It allows attackers to conduc… |
CVE-2017-6632 | High | 7.5 | 2017-05-22 | A vulnerability in the logging configuration of Secure Sockets Layer (SSL) policies for Cisco FirePOWER System Software 5.3.0 through 6.2.2 could allow an unau… |
CVE-2017-9119 | Critical | 9.8 | 2017-05-21 | The i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memory consumption and application crash) or… |
CVE-2017-7935 | High | 7.5 | 2017-05-19 | A Resource Exhaustion issue was discovered in Phoenix Contact GmbH mGuard firmware versions 8.3.0 to 8.4.2. An attacker may compromise the device's availabilit… |
CVE-2017-8338 | High | 7.5 | 2017-05-18 | A vulnerability in MikroTik Version 6.38.5 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of UDP packets on port 500 (… |
CVE-2017-2681 | Medium | 6.5 | 2017-05-11 | Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial of service condition of that prod… |
CVE-2017-2680 | Medium | 6.5 | 2017-05-11 | Specially crafted PROFINET DCP broadcast packets could cause a denial of service condition of affected products on a local Ethernet segment (Layer 2). Human in… |
CVE-2017-6024 | Medium | 5.9 | 2017-05-06 | A Resource Exhaustion issue was discovered in Rockwell Automation ControlLogix 5580 controllers V28.011, V28.012, and V28.013; ControlLogix 5580 controllers V2… |
CVE-2017-8327 | Medium | 6.5 | 2017-04-29 | The bmpr_read_uncompressed function in imagew-bmp.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of service (m… |
CVE-2017-2322 | Medium | 5.5 | 2017-04-24 | A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1, may allow an authenticated user t… |
CVE-2017-1000359 | Medium | 5.3 | 2017-04-24 | Java out of memory error and significant increase in resource consumption. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw. Version: The test… |
CVE-2017-1000357 | High | 7.5 | 2017-04-24 | Denial of Service attack when the switch rejects to receive packets from the controller. Component: This vulnerability affects OpenDaylight odl-l2switch-switch… |
CVE-2017-2333 | Medium | 6.5 | 2017-04-24 | A persistent denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious… |
CVE-2017-2327 | Medium | 5.5 | 2017-04-24 | A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an authenticated malicio… |
CVE-2017-3793 | Medium | 4.0 | 2017-04-20 | A vulnerability in the TCP normalizer of Cisco Adaptive Security Appliance (ASA) Software (8.0 through 8.7 and 9.0 through 9.6) and Cisco Firepower Threat Defe… |
CVE-2017-7940 | Medium | 5.5 | 2017-04-18 | The iw_read_gif_file function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to consume an amount of available memory via… |
CVE-2016-3104 | High | 7.5 | 2017-04-14 | mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory consumption and process termination) by… |
CVE-2017-6019 | High | 7.5 | 2017-04-07 | An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830. A series of rapid requests to the dev… |
CVE-2017-3885 | Medium | 5.9 | 2017-04-07 | A vulnerability in the detection engine reassembly of Secure Sockets Layer (SSL) packets for Cisco Firepower System Software could allow an unauthenticated, re… |