CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification) (page 2)
Page 2 of 2 — CVEs classified under CWE-409, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43499 | High | 7.5 | 2024-11-12 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2024-1947 | Medium | 4.3 | 2024-05-23 | A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17… |
CVE-2024-3572 | High | 7.5 | 2024-04-16 | The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without pro… |
CVE-2024-28101 | High | 7.5 | 2024-03-21 | The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Den… |
CVE-2024-28180 | Medium | 4.3 | 2024-03-09 | Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compre… |
CVE-2023-26483 | Medium | 5.3 | 2023-03-03 | gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of… |
CVE-2023-0821 | Medium | 6.5 | 2023-02-16 | HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. F… |
CVE-2023-0475 | Medium | 4.2 | 2023-02-16 | HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0. |
CVE-2022-37439 | Medium | 5.5 | 2022-08-16 | In Splunk Enterprise and Universal Forwarder versions in the following table, indexing a specially crafted ZIP file using the file monitoring input can result… |
CVE-2022-29225 | High | 7.5 | 2022-06-09 | Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overw… |
CVE-2017-16129 | Medium | 5.9 | 2018-06-07 | The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes seve… |