CWE-400 · Uncontrolled Resource Consumption (page 40)
Page 40 of 41 — CVEs classified under CWE-400, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-9129 | Medium | 5.5 | 2017-06-21 | The wav_open_read function in frontend/input.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to cause a denial of service (large loop) v… |
CVE-2017-1000378 | Critical | 9.8 | 2017-06-19 | The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to determi… |
CVE-2017-1000373 | Medium | 6.5 | 2017-06-19 | The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to determ… |
CVE-2016-5004 | Medium | 6.5 | 2017-06-06 | The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumptio… |
CVE-2017-2535 | High | 7.8 | 2017-05-22 | An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Security" component. It allows attackers to conduc… |
CVE-2017-6632 | High | 7.5 | 2017-05-22 | A vulnerability in the logging configuration of Secure Sockets Layer (SSL) policies for Cisco FirePOWER System Software 5.3.0 through 6.2.2 could allow an unau… |
CVE-2017-9119 | Critical | 9.8 | 2017-05-21 | The i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memory consumption and application crash) or… |
CVE-2017-7935 | High | 7.5 | 2017-05-19 | A Resource Exhaustion issue was discovered in Phoenix Contact GmbH mGuard firmware versions 8.3.0 to 8.4.2. An attacker may compromise the device's availabilit… |
CVE-2017-8338 | High | 7.5 | 2017-05-18 | A vulnerability in MikroTik Version 6.38.5 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of UDP packets on port 500 (… |
CVE-2017-2681 | Medium | 6.5 | 2017-05-11 | Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial of service condition of that prod… |
CVE-2017-2680 | Medium | 6.5 | 2017-05-11 | Specially crafted PROFINET DCP broadcast packets could cause a denial of service condition of affected products on a local Ethernet segment (Layer 2). Human in… |
CVE-2017-6024 | Medium | 5.9 | 2017-05-06 | A Resource Exhaustion issue was discovered in Rockwell Automation ControlLogix 5580 controllers V28.011, V28.012, and V28.013; ControlLogix 5580 controllers V2… |
CVE-2017-8327 | Medium | 6.5 | 2017-04-29 | The bmpr_read_uncompressed function in imagew-bmp.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of service (m… |
CVE-2017-2322 | Medium | 5.5 | 2017-04-24 | A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1, may allow an authenticated user t… |
CVE-2017-1000359 | Medium | 5.3 | 2017-04-24 | Java out of memory error and significant increase in resource consumption. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw. Version: The test… |
CVE-2017-1000357 | High | 7.5 | 2017-04-24 | Denial of Service attack when the switch rejects to receive packets from the controller. Component: This vulnerability affects OpenDaylight odl-l2switch-switch… |
CVE-2017-2333 | Medium | 6.5 | 2017-04-24 | A persistent denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious… |
CVE-2017-2327 | Medium | 5.5 | 2017-04-24 | A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an authenticated malicio… |
CVE-2017-3793 | Medium | 4.0 | 2017-04-20 | A vulnerability in the TCP normalizer of Cisco Adaptive Security Appliance (ASA) Software (8.0 through 8.7 and 9.0 through 9.6) and Cisco Firepower Threat Defe… |
CVE-2017-7940 | Medium | 5.5 | 2017-04-18 | The iw_read_gif_file function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to consume an amount of available memory via… |
CVE-2016-3104 | High | 7.5 | 2017-04-14 | mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory consumption and process termination) by… |
CVE-2017-6019 | High | 7.5 | 2017-04-07 | An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830. A series of rapid requests to the dev… |
CVE-2017-3885 | Medium | 5.9 | 2017-04-07 | A vulnerability in the detection engine reassembly of Secure Sockets Layer (SSL) packets for Cisco Firepower System Software could allow an unauthenticated, re… |
CVE-2017-7397 | High | 7.5 | 2017-04-03 | BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian source IP addresses (as… |
CVE-2016-8780 | Medium | 6.5 | 2017-04-02 | Huawei CloudEngine 6800 V100R006C00, CloudEngine 7800 V100R006C00, CloudEngine 8800 V100R006C00, and CloudEngine 12800 V100R006C00 allow remote attackers with… |
CVE-2017-2461 | High | 7.5 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before… |
CVE-2017-7285 | High | 7.5 | 2017-03-29 | A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaust all available CPU… |
CVE-2016-2225 | High | 7.5 | 2017-03-24 | The __read_etc_hosts_r function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via a c… |
CVE-2016-2224 | High | 7.5 | 2017-03-24 | The __decode_dotted function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via vector… |
CVE-2016-10058 | Medium | 5.5 | 2017-03-23 | Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick before 6.9.6-3 allows remote attackers to cause a denial of service (memory consumptio… |
CVE-2016-10047 | Medium | 5.5 | 2017-03-23 | Memory leak in the NewXMLTree function in magick/xml-tree.c in ImageMagick before 6.9.4-7 allows remote attackers to cause a denial of service (memory consumpt… |
CVE-2017-3857 | High | 7.5 | 2017-03-22 | A vulnerability in the Layer 2 Tunneling Protocol (L2TP) parsing function of Cisco IOS (12.0 through 12.4 and 15.0 through 15.6) and Cisco IOS XE (3.1 through… |
CVE-2017-3856 | High | 7.5 | 2017-03-22 | A vulnerability in the web user interface of Cisco IOS XE 3.1 through 3.17 could allow an unauthenticated, remote attacker to cause an affected device to reloa… |
CVE-2014-9849 | High | 7.5 | 2017-03-20 | The png coder in ImageMagick allows remote attackers to cause a denial of service (crash). |
CVE-2014-9842 | High | 7.5 | 2017-03-20 | Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (memory consumption) via… |
CVE-2017-6444 | High | 7.5 | 2017-03-12 | The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast network connection, which allows remote att… |
CVE-2017-6552 | High | 7.5 | 2017-03-09 | Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 devices have an insufficiently large default value for the maximum IPv6 routing table size: it can be filled within min… |
CVE-2016-9643 | High | 7.5 | 2017-03-07 | The regex code in Webkit 2.4.11 allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large number of ($ (open parenth… |
CVE-2017-5867 | Medium | 6.5 | 2017-03-03 | ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service (s… |
CVE-2017-5972 | High | 7.5 | 2017-02-14 | The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows rem… |
CVE-2016-9367 | High | 7.5 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-8374 | High | 7.5 | 2017-02-13 | An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis… |
CVE-2016-8367 | Medium | 5.3 | 2017-02-13 | An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis… |
CVE-2016-6171 | High | 8.6 | 2017-02-09 | Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service (memory exhaustion and slave server crash) via a large zone transfer for (1) DDNS… |
CVE-2016-4571 | Medium | 5.5 | 2017-02-03 | The mxml_write_node function in mxml-file.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via… |
CVE-2016-4570 | Medium | 5.5 | 2017-02-03 | The mxmlDelete function in mxml-node.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via craf… |
CVE-2016-9039 | Medium | 6.2 | 2017-01-31 | An exploitable denial of service exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with… |
CVE-2015-7978 | High | 7.5 | 2017-01-30 | NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which trigger… |
CVE-2016-4055 | Medium | 6.5 | 2017-01-23 | The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string… |
CVE-2017-5544 | Medium | 5.9 | 2017-01-23 | An issue was discovered on FiberHome Fengine S5800 switches V210R240. An unauthorized attacker can access the device's SSH service, using a password cracking t… |
CVE-2016-9310 | Medium | 6.5 | 2017-01-13 | The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet. |
CVE-2016-7428 | Medium | 4.3 | 2017-01-13 | ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the poll interval in a broadcast packet. |
CVE-2016-7427 | Medium | 4.3 | 2017-01-13 | The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode pa… |
CVE-2016-7426 | High | 7.5 | 2017-01-13 | NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers… |
CVE-2017-5351 | High | 7.5 | 2017-01-12 | Samsung Note devices with KK(4.4), L(5.0/5.1), and M(6.0) software allow attackers to crash the system by creating an arbitrarily large number of active VR ser… |
CVE-2016-6831 | High | 7.5 | 2017-01-10 | The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak. This could be abu… |
CVE-2016-9685 | Medium | 5.5 | 2016-12-28 | Multiple memory leaks in error paths in fs/xfs/xfs_attr_list.c in the Linux kernel before 4.5.1 allow local users to cause a denial of service (memory consumpt… |
CVE-2016-6213 | Medium | 4.7 | 2016-12-28 | fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of s… |
CVE-2016-8858 | High | 7.5 | 2016-12-09 | The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending… |
CVE-2016-8666 | High | 7.5 | 2016-10-16 | The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified oth… |
CVE-2016-6307 | Medium | 5.9 | 2016-09-26 | The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remote attackers to… |
CVE-2016-6172 | Medium | 6.8 | 2016-09-26 | PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS serve… |
CVE-2016-5403 | Medium | 5.5 | 2016-08-02 | The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process… |
CVE-2016-4592 | Medium | 6.5 | 2016-07-22 | WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to cause a denial of service (memory consumption) via a cr… |
CVE-2014-3672 | Medium | 6.5 | 2016-05-25 | The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout o… |
CVE-2016-4037 | Medium | 6.0 | 2016-05-23 | The ehci_advance_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumpti… |
CVE-2016-1784 | Medium | 6.5 | 2016-03-24 | The History implementation in WebKit in Apple iOS before 9.3, Safari before 9.1, and tvOS before 9.2 allows remote attackers to cause a denial of service (reso… |
CVE-2016-0747 | Medium | 5.3 | 2016-02-15 | The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service… |
CVE-2015-1779 | High | 8.6 | 2016-01-12 | The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or… |
CVE-2015-5600 | High | 8.1 | 2015-08-03 | The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices withi… |
CVE-2015-1916 | High | 7.5 | 2015-07-02 | Unspecified vulnerability in IBM Java 8 before SR1 allows remote attackers to cause a denial of service via unknown vectors related to SSL/TLS and the Secure S… |
CVE-2014-5418 | | 2015-01-17 | GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 an… | |
CVE-2014-8124 | | 2014-12-12 | OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine… | |
CVE-2014-7255 | High | 7.5 | 2014-12-05 | Internet Initiative Japan Inc. SEIL Series routers SEIL/X1 2.50 through 4.62, SEIL/X2 2.50 through 4.62, SEIL/B1 2.50 through 4.62, and SEIL/x86 Fuji 1.70 thro… |
CVE-2014-3407 | | 2014-11-28 | The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet… | |
CVE-2014-8559 | Medium | 5.5 | 2014-11-10 | The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of rename_lock, which allows local users to caus… |
CVE-2014-3690 | Medium | 5.5 | 2014-11-10 | arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remain… |
CVE-2014-3687 | High | 7.5 | 2014-11-10 | The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to caus… |
CVE-2014-7970 | Medium | 5.5 | 2014-10-13 | The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which… |
CVE-2014-3328 | | 2014-07-26 | The Intercluster Sync Agent Service in Cisco Unified Presence Server allows remote attackers to cause a denial of service via a TCP SYN flood, aka Bug ID CSCun… | |
CVE-2014-0118 | | 2014-07-20 | The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled… | |
CVE-2013-5567 | | 2014-07-14 | Cisco Adaptive Security Appliance (ASA) Software 8.4(.6) and earlier, when using an unsupported configuration with overlapping criteria for filtering and inspe… | |
CVE-2014-2343 | | 2014-05-30 | Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows physically proximate attackers to cause a denial of service (excessive data processing) via a cr… | |
CVE-2014-2342 | | 2014-05-30 | Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 pac… | |
CVE-2014-3122 | | 2014-05-11 | The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel before 3.14.3 does not properly consider which pages must be locked, which allows local user… | |
CVE-2014-1500 | | 2014-03-19 | Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (resource consumption and application hang) via onbef… | |
CVE-2012-6638 | | 2014-02-15 | The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resou… | |
CVE-2013-2128 | Medium | 5.5 | 2013-06-07 | The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a de… |
CVE-2013-2763 | | 2013-04-04 | The Schneider Electric M340 PLC modules allow remote attackers to cause a denial of service (resource consumption) via unspecified vectors. NOTE: the vendor r… | |
CVE-2010-5107 | High | 7.5 | 2013-03-07 | The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easie… |
CVE-2011-2491 | | 2013-03-01 | The Network Lock Manager (NLM) protocol implementation in the NFS client functionality in the Linux kernel before 3.0 allows local users to cause a denial of s… | |
CVE-2012-0876 | | 2012-07-03 | The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows con… | |
CVE-2012-0260 | Medium | 6.5 | 2012-06-05 | The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a… |
CVE-2011-2918 | Medium | 5.5 | 2012-05-24 | The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overflows associated with PERF_COUNT_SW_CPU_CLOCK events, which… |
CVE-2011-2906 | Medium | 5.5 | 2012-05-24 | Integer signedness error in the pmcraid_ioctl_passthrough function in drivers/scsi/pmcraid.c in the Linux kernel before 3.1 might allow local users to cause a… |
CVE-2012-0879 | Medium | 5.5 | 2012-05-17 | The I/O implementation for block devices in the Linux kernel before 2.6.33 does not properly handle the CLONE_IO feature, which allows local users to cause a d… |
CVE-2012-0058 | Medium | 5.5 | 2012-05-17 | The kiocb_batch_free function in fs/aio.c in the Linux kernel before 3.2.2 allows local users to cause a denial of service (OOPS) via vectors that trigger inco… |
CVE-2012-0382 | High | 7.5 | 2012-03-29 | The Multicast Source Discovery Protocol (MSDP) implementation in Cisco IOS 12.0, 12.2 through 12.4, and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3… |
CVE-2011-3954 | | 2012-02-09 | Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (application crash) via vectors that trigger a large amount of database u… | |
CVE-2012-0024 | | 2012-01-08 | MaraDNS before 1.3.07.12 and 1.4.x before 1.4.08 computes hash values for DNS data without restricting the ability to trigger hash collisions predictably, whic… |