CWE-770 · Allocation of Resources Without Limits or Throttling (page 14)
Page 14 of 22 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25969 | Medium | 6.2 | 2024-05-14 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability. A local unauthenticated at… |
CVE-2024-4539 | Medium | 4.3 | 2024-05-14 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2024-32874 | Medium | 6.8 | 2024-05-14 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the fi… |
CVE-2024-2454 | Medium | 6.5 | 2024-05-14 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting fro… |
CVE-2024-28760 | Medium | 4.3 | 2024-05-14 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 dashboard is vulnerable to a denial of service due to improper restriction… |
CVE-2024-27804 | Medium | 5.5 | 2024-05-14 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.3, watchOS 10… |
CVE-2024-0027 | Medium | 5.5 | 2024-05-07 | In multiple functions of SnoozeHelper.java, there is a possible way to cause a boot loop due to resource exhaustion. This could lead to local denial of service… |
CVE-2024-0026 | Medium | 5.5 | 2024-05-07 | In multiple functions of SnoozeHelper.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of ser… |
CVE-2024-32663 | High | 7.5 | 2024-05-07 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, a small amount… |
CVE-2024-4140 | High | 7.5 | 2024-05-02 | An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The… |
CVE-2024-4029 | Medium | 4.1 | 2024-05-02 | A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause… |
CVE-2024-27013 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhost_worker will call t… |
CVE-2024-34046 | High | 7.5 | 2024-04-30 | The O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo->sctpParams->e2tCounters[IN_SUCC][MSG_COUNTER][Pr… |
CVE-2024-4183 | Medium | 4.3 | 2024-04-26 | Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows a… |
CVE-2024-22091 | Low | 3.1 | 2024-04-26 | Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs whic… |
CVE-2024-25026 | Medium | 5.9 | 2024-04-25 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused… |
CVE-2024-32660 | High | 7.5 | 2024-04-23 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid hug… |
CVE-2024-31208 | Medium | 6.5 | 2024-04-23 | Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch spe… |
CVE-2024-31994 | Medium | 6.5 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, an attacker can point the image request to an arbitrarily large file. Mealie will atte… |
CVE-2024-31992 | Medium | 6.5 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a r… |
CVE-2024-26894 | Medium | 6.0 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() After unregistering… |
CVE-2024-21060 | Medium | 4.9 | 2024-04-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Data Dictionary). Supported versions that are affected are 8.0.36 and prior and… |
CVE-2024-21011 | Low | 3.7 | 2024-04-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-31446 | High | 7.7 | 2024-04-16 | OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. A user can use OpenComputers to get a Computer thread stuck in the Lu… |
CVE-2024-3302 | Low | 3.7 | 2024-04-16 | There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the b… |
CVE-2024-1666 | Medium | 5.3 | 2024-04-16 | In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side c… |
CVE-2024-32035 | Medium | 5.3 | 2024-04-15 | ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive me… |
CVE-2024-29903 | Medium | 4.2 | 2024-04-10 | Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of s… |
CVE-2024-29902 | Medium | 4.2 | 2024-04-10 | Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial… |
CVE-2021-47182 | Medium | 5.5 | 2024-04-10 | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix scsi_mode_sense() buffer length handling Several problems exist with scsi… |
CVE-2024-3382 | High | 7.5 | 2024-04-10 | A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually pre… |
CVE-2024-26816 | Medium | 5.5 | 2024-04-10 | In the Linux kernel, the following vulnerability has been resolved: x86, relocs: Ignore relocations in .notes section When building with CONFIG_XEN_PV=y, .te… |
CVE-2024-26276 | Low | 3.3 | 2024-04-09 | A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207… |
CVE-2024-0081 | High | 8.6 | 2024-04-05 | NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr_webapp where an attacker may cause an allocation of resources without limits or throttl… |
CVE-2024-28949 | Medium | 4.3 | 2024-04-05 | Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which all… |
CVE-2024-27316 | High | 7.5 | 2024-04-04 | HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not sto… |
CVE-2024-30249 | High | 8.6 | 2024-04-04 | Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR1-20240330.101522-15` impacts pub… |
CVE-2024-27268 | Medium | 5.9 | 2024-04-04 | IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remot… |
CVE-2024-28871 | High | 7.5 | 2024-04-04 | LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic, leading to excessi… |
CVE-2024-28182 | Medium | 5.3 | 2024-04-04 | nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number… |
CVE-2024-22189 | High | 7.5 | 2024-04-04 | quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of… |
CVE-2024-26798 | Medium | 5.5 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: fbcon: always restore the old font data in fbcon_do_set_font() Commit a5a923038d70 (fbdev… |
CVE-2024-28870 | High | 7.5 | 2024-04-03 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata com… |
CVE-2024-26743 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: RDMA/qedr: Fix qedr_create_user_qp error flow Avoid the following warning by making sure… |
CVE-2024-26741 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished(). syzkalle… |
CVE-2024-26710 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Limit KASAN thread size increase to 32KB KASAN is seen to increase stack u… |
CVE-2024-26707 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() Syzkaller reported [1] hitti… |
CVE-2024-29086 | Low | 3.3 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause DOS through stack overflow. |
CVE-2024-26675 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_O… |
CVE-2024-22353 | Medium | 5.9 | 2024-03-31 | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remot… |
CVE-2024-2818 | Medium | 4.3 | 2024-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16… |
CVE-2023-43768 | High | 7.5 | 2024-03-27 | An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via lar… |
CVE-2024-26577 | High | 7.5 | 2024-03-26 | VSeeFace through 1.13.38.c2 allows attackers to cause a denial of service (application hang) via a spoofed UDP packet containing at least 10 digits in JSON dat… |
CVE-2024-22436 | Medium | 6.5 | 2024-03-26 | A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a denial of service. |
CVE-2024-26646 | High | 7.8 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: thermal: intel: hfi: Add syscore callbacks for system-wide PM The kernel allocates a memo… |
CVE-2023-52622 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing failures due to oversized flex bg When we online resize an ex… |
CVE-2024-29025 | Medium | 5.3 | 2024-03-25 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `Htt… |
CVE-2021-47170 | Medium | 5.5 | 2024-03-25 | In the Linux kernel, the following vulnerability has been resolved: USB: usbfs: Don't WARN about excessively large memory allocations Syzbot found that the k… |
CVE-2021-47137 | Critical | 9.8 | 2024-03-25 | In the Linux kernel, the following vulnerability has been resolved: net: lantiq: fix memory corruption in RX ring In a situation where memory allocation or d… |
CVE-2024-30156 | High | 7.5 | 2024-03-24 | Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 co… |
CVE-2024-28863 | Medium | 6.5 | 2024-03-21 | node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker wh… |
CVE-2024-28102 | Medium | 6.8 | 2024-03-21 | JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by pas… |
CVE-2023-41038 | High | 7.5 | 2024-03-20 | Firebird is a relational database. Versions 4.0.0 through 4.0.3 and version 5.0 beta1 are vulnerable to a server crash when a user uses a specific form of SET… |
CVE-2021-47130 | High | 7.5 | 2024-03-15 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix freeing unallocated p2pmem In case p2p device was found but the p2p pool is em… |
CVE-2024-2446 | Medium | 4.3 | 2024-03-15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per me… |
CVE-2024-28053 | Low | 3.1 | 2024-03-15 | Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker t… |
CVE-2020-11862 | High | 8.6 | 2024-03-13 | Allocation of Resources Without Limits or Throttling vulnerability in OpenText NetIQ Privileged Account Manager on Linux, Windows, 64 bit allows Flooding.This… |
CVE-2024-1765 | Medium | 5.9 | 2024-03-12 | Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the… |
CVE-2024-26618 | Medium | 5.5 | 2024-03-11 | In the Linux kernel, the following vulnerability has been resolved: arm64/sme: Always exit sme_alloc() early with existing storage When sme_alloc() is called… |
CVE-2023-52606 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: powerpc/lib: Validate size for vector operations Some of the fp/vmx code in sstep.c assum… |
CVE-2023-45290 | Medium | 6.5 | 2024-03-05 | When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFi… |
CVE-2024-22255 | High | 7.1 | 2024-03-05 | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access t… |
CVE-2023-52529 | Medium | 6.0 | 2024-03-02 | In the Linux kernel, the following vulnerability has been resolved: HID: sony: Fix a potential memory leak in sony_probe() If an error occurs after a success… |
CVE-2023-52518 | Medium | 5.5 | 2024-03-02 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_codec: Fix leaking content of local_codecs The following memory leak can b… |
CVE-2021-47057 | Medium | 5.5 | 2024-02-29 | In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map In the case where… |
CVE-2024-1953 | Medium | 4.3 | 2024-02-29 | Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowi… |
CVE-2024-26461 | High | 7.5 | 2024-02-29 | Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. |
CVE-2024-20321 | High | 8.6 | 2024-02-29 | A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause… |
CVE-2023-50658 | High | 7.5 | 2024-02-29 | The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. |
CVE-2023-45873 | Medium | 6.5 | 2024-02-28 | An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (application exist) because of the OOM killer. |
CVE-2024-23837 | High | 7.5 | 2024-02-26 | LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. Thi… |
CVE-2024-23836 | High | 7.5 | 2024-02-26 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 6.0.16 and 7.0.3, an at… |
CVE-2024-23835 | High | 7.5 | 2024-02-26 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.3, excessive memory… |
CVE-2024-22201 | High | 7.5 | 2024-02-26 | Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attack… |
CVE-2022-34357 | Medium | 6.5 | 2024-02-26 | IBM Cognos Analytics Mobile Server 11.1.7, 11.2.4, and 12.0.0 is vulnerable to Denial of Service due to due to weak or absence of rate limiting. By making unli… |
CVE-2023-51393 | Medium | 5.3 | 2024-02-23 | Due to an allocation of resources without limits, an uncontrolled resource consumption vulnerability exists in Silicon Labs Ember ZNet SDK prior to v7.4.0.0 (d… |
CVE-2024-0563 | Medium | 4.3 | 2024-02-23 | Denial of service condition in M-Files Server in versions before 24.2 (excluding 23.2 SR7 and 23.8 SR5) allows anonymous user to cause denial of service agains… |
CVE-2024-26265 | Medium | 5.0 | 2024-02-20 | The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4… |
CVE-2024-25978 | High | 7.5 | 2024-02-19 | Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality. |
CVE-2024-26308 | Medium | 5.5 | 2024-02-19 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26… |
CVE-2024-20968 | Medium | 4.4 | 2024-02-17 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.34 and prior and 8.1.0… |
CVE-2024-23979 | High | 7.5 | 2024-02-14 | When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is configured on a virtual server, undisclos… |
CVE-2024-21771 | High | 7.5 | 2024-02-14 | For unspecified traffic patterns, BIG-IP AFM IPS engine may spend an excessive amount of time matching the traffic against signatures, resulting in Traffic Ma… |
CVE-2023-50387 | High | 7.5 | 2024-02-14 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumpti… |
CVE-2023-6516 | High | 7.5 | 2024-02-13 | To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, includin… |
CVE-2024-21875 | Medium | 6.5 | 2024-02-11 | Allocation of Resources Without Limits or Throttling vulnerability in Badge leading to a denial of service attack.Team Hacker Hotel Badge 2024 on risc-v (billb… |
CVE-2023-52428 | High | 7.5 | 2024-02-11 | In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration c… |
CVE-2023-52427 | High | 7.5 | 2024-02-11 | In OpenDDS through 3.27, there is a segmentation fault for a DataWriter with a large value of resource_limits.max_samples. NOTE: the vendor's position is that… |
CVE-2024-1066 | Medium | 6.5 | 2024-02-07 | An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an at… |
CVE-2024-25143 | Medium | 6.5 | 2024-02-07 | The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix… |