CWE-400 · Uncontrolled Resource Consumption (page 35)
Page 35 of 39 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-16469 | High | 7.5 | 2018-10-30 | The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be p… |
CVE-2018-11828 | High | 7.5 | 2018-10-26 | When FW tries to get random mac address generated from new SW RNG and ADC values read are constant then DUT get struck in loop while trying to get random ADC s… |
CVE-2017-18299 | Medium | 5.5 | 2018-10-23 | Improper translation table consolidation logic leads to resource exhaustion and QSEE error in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in v… |
CVE-2018-0441 | High | 7.4 | 2018-10-17 | A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause… |
CVE-2018-0381 | Medium | 6.8 | 2018-10-17 | A vulnerability in the Cisco Aironet Series Access Points (APs) software could allow an authenticated, adjacent attacker to cause an affected device to reload… |
CVE-2018-17898 | High | 7.5 | 2018-10-12 | Yokogawa STARDOM Controllers FCJ,FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The controller application fails to prevent memory exhaustion by unau… |
CVE-2018-0063 | Medium | 6.5 | 2018-10-10 | A vulnerability in the IP next-hop index database in Junos OS 17.3R3 may allow a flood of ARP requests, sent to the management interface, to exhaust the privat… |
CVE-2018-0061 | Medium | 5.3 | 2018-10-10 | A denial of service vulnerability in the telnetd service on Junos OS allows remote unauthenticated users to cause high CPU usage which may affect system perfor… |
CVE-2018-0054 | Medium | 6.5 | 2018-10-10 | On QFX5000 Series and EX4600 switches, a high rate of Ethernet pause frames or an ARP packet storm received on the management interface (fxp0) can cause egress… |
CVE-2018-0048 | High | 7.5 | 2018-10-10 | A vulnerability in the Routing Protocols Daemon (RPD) with Juniper Extension Toolkit (JET) support can allow a network based unauthenticated attacker to cause… |
CVE-2018-13805 | High | 7.5 | 2018-10-10 | A vulnerability has been identified in SIMATIC ET 200SP Open Controller (All versions >= V2.0 and < V2.1.6), SIMATIC S7-1500 Software Controller (All versions… |
CVE-2018-17977 | Medium | 4.4 | 2018-10-08 | The Linux kernel 4.14.67 mishandles certain interaction among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets, which allows local users to ca… |
CVE-2018-15399 | Medium | 6.8 | 2018-10-05 | A vulnerability in the TCP syslog module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an u… |
CVE-2018-15396 | Medium | 6.8 | 2018-10-05 | A vulnerability in the Bulk Administration Tool (BAT) for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization… |
CVE-2018-15383 | High | 7.5 | 2018-10-05 | A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) S… |
CVE-2018-15377 | High | 8.6 | 2018-10-05 | A vulnerability in the Cisco Network Plug and Play agent, also referred to as the Cisco Open Plug-n-Play agent, of Cisco IOS Software and Cisco IOS XE Software… |
CVE-2018-0471 | High | 7.4 | 2018-10-05 | A vulnerability in the Cisco Discovery Protocol (CDP) module of Cisco IOS XE Software Releases 16.6.1 and 16.6.2 could allow an unauthenticated, adjacent attac… |
CVE-2018-17985 | Medium | 5.5 | 2018-10-04 | An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption problem caused by the cplus_demang… |
CVE-2018-14648 | High | 7.5 | 2018-09-28 | A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthentica… |
CVE-2018-17581 | Medium | 6.5 | 2018-09-28 | CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service. |
CVE-2018-8854 | High | 7.5 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not properly restrict the size or amount of resources requested or influen… |
CVE-2018-17281 | High | 7.5 | 2018-09-24 | There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and… |
CVE-2018-14827 | High | 7.5 | 2018-09-20 | Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. A remote, unauthenticated threat actor may intentionally send specially crafted Ethernet/IP pack… |
CVE-2017-1794 | High | 7.5 | 2018-09-19 | IBM Tivoli Monitoring 6.2.3 through 6.2.3.5 and 6.3.0 through 6.3.0.7 are vulnerable to both TEPS user privilege escalation and possible denial of service due… |
CVE-2018-14638 | High | 7.5 | 2018-09-14 | A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are… |
CVE-2018-16949 | High | 7.5 | 2018-09-12 | An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array typ… |
CVE-2018-1114 | Medium | 6.5 | 2018-09-11 | It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaus… |
CVE-2018-10935 | Medium | 6.5 | 2018-09-11 | A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort. |
CVE-2016-7068 | Medium | 5.3 | 2018-09-11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause… |
CVE-2016-7072 | Medium | 5.3 | 2018-09-10 | An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by op… |
CVE-2016-9040 | Medium | 5.5 | 2018-09-07 | An exploitable denial of service exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system ca… |
CVE-2018-16310 | Medium | 6.5 | 2018-09-06 | Technicolor TG588V V2 devices allow remote attackers to cause a denial of service (networking outage) via a flood of random MAC addresses, as demonstrated by m… |
CVE-2018-5391 | High | 7.5 | 2018-09-06 | The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An… |
CVE-2018-6923 | High | 7.5 | 2018-09-04 | In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p2, 11.1-RELEASE-p13, ip fragment reassembly code is vulnerable to a denial of service due to excessive system reso… |
CVE-2018-6554 | Medium | 5.5 | 2018-09-04 | Memory leak in the irda_bind function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users… |
CVE-2018-10924 | Medium | 5.3 | 2018-09-04 | It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service… |
CVE-2018-11056 | Medium | 6.5 | 2018-08-31 | RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contain an Uncontrolled R… |
CVE-2018-16131 | High | 7.5 | 2018-08-30 | The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a de… |
CVE-2018-16132 | High | 8.6 | 2018-08-29 | The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before… |
CVE-2018-15907 | Medium | 6.5 | 2018-08-29 | Technicolor (formerly RCA) TC8305C devices allow remote attackers to cause a denial of service (networking outage) via a flood of random MAC addresses, as demo… |
CVE-2018-8005 | Medium | 5.3 | 2018-08-29 | When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with… |
CVE-2018-15853 | Medium | 5.5 | 2018-08-25 | Endless recursion exists in xkbcomp/expr.c in xkbcommon and libxkbcommon before 0.8.1, which could be used by local attackers to crash xkbcommon users by suppl… |
CVE-2018-15852 | Medium | 6.5 | 2018-08-25 | Technicolor TC7200.20 devices allow remote attackers to cause a denial of service (networking outage) via a flood of random MAC addresses, as demonstrated by m… |
CVE-2018-1157 | Medium | 6.5 | 2018-08-23 | Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and i… |
CVE-2018-15671 | Medium | 6.5 | 2018-08-21 | An issue was discovered in the HDF HDF5 1.10.2 library. Excessive stack consumption has been detected in the function H5P__get_cb() in H5Pint.c during an attem… |
CVE-2018-15607 | Medium | 6.5 | 2018-08-21 | In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang o… |
CVE-2018-5243 | High | 7.5 | 2018-08-20 | The Symantec Encryption Management Server (SEMS) product, prior to version 3.4.2 MP1, may be susceptible to a denial of service (DoS) exploit. A DoS attack is… |
CVE-2018-15470 | Medium | 6.5 | 2018-08-17 | An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handling writes depended on the order of evaluation of expressions making up a tuple… |
CVE-2018-15469 | Medium | 6.5 | 2018-08-17 | An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in the hypervisor or in Linux. Unfortunately, an ARM guest… |
CVE-2016-9596 | Medium | 6.5 | 2018-08-16 | libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption)… |
CVE-2018-0418 | High | 8.6 | 2018-08-15 | A vulnerability in the Local Packet Transport Services (LPTS) feature set of Cisco ASR 9000 Series Aggregation Services Router Software could allow an unauthen… |
CVE-2018-0410 | High | 8.6 | 2018-08-15 | A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, remote attacker to e… |
CVE-2018-10864 | Medium | 5.3 | 2018-08-13 | An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may provide an existin… |
CVE-2018-6922 | Medium | 5.3 | 2018-08-09 | One of the data structures that holds TCP segments in all versions of FreeBSD prior to 11.2-RELEASE-p1, 11.1-RELEASE-p12, and 10.4-RELEASE-p10 uses an ineffici… |
CVE-2018-5390 | High | 7.5 | 2018-08-06 | Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can… |
CVE-2018-14940 | High | 7.5 | 2018-08-05 | PHPCMS 9 allows remote attackers to cause a denial of service (resource consumption) via large font_size, height, and width parameters in an api.php?op=checkco… |
CVE-2016-8611 | Medium | 4.3 | 2018-07-31 | A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenti… |
CVE-2017-5693 | High | 7.5 | 2018-07-31 | Firmware in the Intel Puma 5, 6, and 7 Series might experience resource depletion or timeout, which allows a network attacker to create a denial of service via… |
CVE-2018-10607 | High | 7.5 | 2018-07-31 | Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow the creation of new connections to one or more IOAs, without closi… |
CVE-2017-15119 | Medium | 5.8 | 2018-07-27 | The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. It could occur if a client sent large op… |
CVE-2018-5541 | High | 7.5 | 2018-07-25 | When F5 BIG-IP ASM 13.0.0-13.1.0.1, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.5.1-11.5.6 is processing HTTP requests, an unusually large number of parameters can… |
CVE-2018-5530 | High | 7.5 | 2018-07-25 | F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.1 virtual servers with HTTP/2 profiles enabled are vulnerable to "HPACK Bomb". |
CVE-2018-14596 | High | 7.5 | 2018-07-25 | wancms 1.0 through 5.0 allows remote attackers to cause a denial of service (resource consumption) via a checkcode (aka verification code) URI in which the val… |
CVE-2018-10632 | High | 7.5 | 2018-07-24 | In Moxa NPort 5210, 5230, and 5232 versions 2.9 build 17030709 and prior, the amount of resources requested by a malicious actor are not restricted, allowing f… |
CVE-2018-10608 | High | 7.5 | 2018-07-24 | SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP server, which may c… |
CVE-2018-0372 | High | 7.5 | 2018-07-18 | A vulnerability in the DHCPv6 feature of the Cisco Nexus 9000 Series Fabric Switches in Application-Centric Infrastructure (ACI) Mode could allow an unauthenti… |
CVE-2018-0031 | Medium | 5.3 | 2018-07-11 | Receipt of specially crafted UDP/IP packets over MPLS may be able to bypass a stateless firewall filter. The crafted UDP packets must be encapsulated and meet… |
CVE-2018-0030 | High | 7.5 | 2018-07-11 | Receipt of a specific MPLS packet may cause MPC7/8/9, PTX-FPC3 (FPC-P1, FPC-P2) line cards or PTX1K to crash and restart. By continuously sending specific MPLS… |
CVE-2018-0029 | Medium | 5.7 | 2018-07-11 | While experiencing a broadcast storm, placing the fxp0 interface into promiscuous mode via the 'monitor traffic interface fxp0' can cause the system to crash a… |
CVE-2016-10724 | High | 7.5 | 2018-07-05 | Bitcoin Core before v0.13.0 allows denial of service (memory exhaustion) triggered by the remote network alert system (deprecated since Q1 2016) if an attacker… |
CVE-2018-3767 | Critical | 9.1 | 2018-07-05 | `memjs` versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage. |
CVE-2018-13251 | Medium | 6.5 | 2018-07-05 | In libming 0.4.8, there is an excessive memory allocation attempt in the readBytes function of the util/read.c file, related to parseSWF_DEFINEBITSJPEG2. Remot… |
CVE-2018-1000518 | High | 7.5 | 2018-06-26 | aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unles… |
CVE-2018-12641 | Medium | 5.5 | 2018-06-22 | An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions… |
CVE-2018-0309 | High | 7.7 | 2018-06-21 | A vulnerability in the implementation of a specific CLI command and the associated Simple Network Management Protocol (SNMP) MIB for Cisco NX-OS (in standalone… |
CVE-2018-1333 | High | 7.5 | 2018-06-18 | By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed… |
CVE-2018-7164 | High | 7.5 | 2018-06-13 | Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from… |
CVE-2018-12066 | Medium | 5.5 | 2018-06-08 | BIRD Internet Routing Daemon before 1.6.4 allows local users to cause a denial of service (stack consumption and daemon crash) via BGP mask expressions in bird… |
CVE-2017-6779 | High | 7.5 | 2018-06-07 | Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow… |
CVE-2018-3739 | Critical | 9.1 | 2018-06-07 | https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setu… |
CVE-2017-16138 | High | 7.5 | 2018-06-07 | The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input. |
CVE-2017-16137 | Medium | 5.3 | 2018-06-07 | The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters… |
CVE-2017-16136 | High | 7.5 | 2018-06-07 | method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. met… |
CVE-2017-16129 | Medium | 5.9 | 2018-06-07 | The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes seve… |
CVE-2017-16119 | High | 7.5 | 2018-06-07 | Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is p… |
CVE-2017-16118 | High | 7.5 | 2018-06-07 | The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when… |
CVE-2017-16117 | High | 7.5 | 2018-06-07 | slug is a module to slugify strings, even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted in… |
CVE-2017-16116 | High | 7.5 | 2018-06-07 | The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically… |
CVE-2017-16115 | High | 7.5 | 2018-06-07 | The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around… |
CVE-2017-16114 | High | 7.5 | 2018-06-07 | The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for… |
CVE-2017-16113 | High | 7.5 | 2018-06-07 | The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed. |
CVE-2017-16111 | High | 7.5 | 2018-06-07 | The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to r… |
CVE-2017-16099 | High | 7.5 | 2018-06-07 | The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event loo… |
CVE-2017-16098 | High | 7.5 | 2018-06-07 | charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds… |
CVE-2017-16086 | High | 7.5 | 2018-06-07 | ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS (Regular Expression Denial of Service) attack when given a speciall… |
CVE-2017-16030 | High | 7.5 | 2018-06-04 | Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arb… |
CVE-2017-16025 | Medium | 5.9 | 2018-06-04 | Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an… |
CVE-2017-16023 | High | 7.5 | 2018-06-04 | Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a… |
CVE-2017-16021 | Medium | 6.5 | 2018-06-04 | uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-j… |
CVE-2017-16013 | High | 7.5 | 2018-06-04 | hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown… |