CWE-770 · Allocation of Resources Without Limits or Throttling (page 15)
Page 15 of 22 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-22819 | Medium | 4.9 | 2024-02-05 | An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventua… |
CVE-2023-45028 | Medium | 5.5 | 2024-02-02 | An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could al… |
CVE-2024-24752 | Medium | 6.5 | 2024-02-01 | Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lam… |
CVE-2024-23826 | Medium | 6.8 | 2024-01-29 | spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an a… |
CVE-2024-23820 | Medium | 5.3 | 2024-01-26 | OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model… |
CVE-2021-42142 | Critical | 9.8 | 2024-01-23 | An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers mishandle the early use of a large epoch number. This vulnerability… |
CVE-2023-47746 | Medium | 5.3 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user with CONNECT privileges to cause a den… |
CVE-2024-21655 | Medium | 4.3 | 2024-01-12 | Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause… |
CVE-2023-28899 | Medium | 4.7 | 2024-01-12 | By sending a specific reset UDS request via OBDII port of Skoda vehicles, it is possible to cause vehicle engine shutdown and denial of service of other vehicl… |
CVE-2024-21604 | High | 7.5 | 2024-01-12 | An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-ba… |
CVE-2023-37934 | Medium | 4.3 | 2024-01-10 | An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiPAM 1.0 all versions allows an authenticated attacker to perform a deni… |
CVE-2023-6476 | Medium | 6.5 | 2024-01-09 | A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount… |
CVE-2024-22164 | Medium | 4.3 | 2024-01-09 | In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigatio… |
CVE-2024-0241 | High | 7.5 | 2024-01-04 | encoded_id-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might ca… |
CVE-2024-21634 | High | 7.5 | 2024-01-03 | Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for application… |
CVE-2023-46738 | Medium | 6.5 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow… |
CVE-2023-3171 | High | 7.5 | 2023-12-27 | A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed… |
CVE-2023-50730 | High | 7.5 | 2023-12-22 | Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form… |
CVE-2023-6910 | Medium | 6.5 | 2023-12-20 | A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaust server storage… |
CVE-2023-6563 | High | 7.7 | 2023-12-14 | An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500… |
CVE-2023-5379 | High | 7.5 | 2023-12-12 | A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by… |
CVE-2023-50247 | Low | 3.7 | 2023-12-12 | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack (quicly), as used by H2O up to commit 43f86e5 (in version 2.3.0-beta and pri… |
CVE-2023-50455 | High | 7.5 | 2023-12-10 | An issue was discovered in Zammad before 6.2.0. Due to lack of rate limiting in the "email address verification" feature, an attacker could send many requests… |
CVE-2023-6337 | High | 7.5 | 2023-12-08 | HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthent… |
CVE-2023-4486 | High | 7.5 | 2023-12-07 | Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines pri… |
CVE-2023-48831 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion. |
CVE-2023-4912 | Low | 2.6 | 2023-12-01 | An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions… |
CVE-2023-34389 | Medium | 4.5 | 2023-11-30 | An allocation of resources without limits or throttling vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated att… |
CVE-2023-42504 | Medium | 5.8 | 2023-11-28 | An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of servic… |
CVE-2023-6117 | Medium | 5.7 | 2023-11-22 | A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23… |
CVE-2023-38543 | High | 7.8 | 2023-11-15 | A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulne… |
CVE-2023-47108 | High | 7.5 | 2023-11-10 | OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary S… |
CVE-2023-47120 | High | 7.5 | 2023-11-10 | Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the `stable` branch and versions 3.1.0,beta6 through 3.2.0.be… |
CVE-2023-46130 | Medium | 4.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-5963 | Low | 3.1 | 2023-11-06 | An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that c… |
CVE-2023-3246 | Medium | 4.3 | 2023-11-06 | An issue has been discovered in GitLab EE/CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions startin… |
CVE-2023-44271 | High | 7.5 | 2023-11-03 | An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a… |
CVE-2023-46695 | High | 7.5 | 2023-11-02 | An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, djan… |
CVE-2023-20155 | High | 7.5 | 2023-11-01 | A vulnerability in a logging API in Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to cause the device to bec… |
CVE-2023-5625 | Medium | 5.3 | 2023-11-01 | A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419… |
CVE-2023-29973 | Medium | 4.9 | 2023-10-25 | Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall. |
CVE-2023-45862 | Medium | 5.5 | 2023-10-14 | An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially exte… |
CVE-2023-45130 | High | 7.5 | 2023-10-13 | Frontier is Substrate's Ethereum compatibility layer. Prior to commit aea528198b3b226e0d20cce878551fd4c0e3d5d0, at the end of a contract execution, when opcode… |
CVE-2023-5573 | Medium | 6.5 | 2023-10-13 | Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0. |
CVE-2023-44191 | High | 7.5 | 2023-10-13 | An Allocation of Resources Without Limits or Throttling vulnerability in Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause… |
CVE-2023-5072 | High | 7.5 | 2023-10-12 | Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite am… |
CVE-2023-45142 | High | 7.5 | 2023-10-12 | OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http… |
CVE-2023-39325 | High | 7.5 | 2023-10-11 | A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of… |
CVE-2023-45129 | Medium | 4.9 | 2023-10-10 | Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impa… |
CVE-2023-40542 | High | 7.5 | 2023-10-10 | When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource util… |
CVE-2023-25822 | Medium | 6.3 | 2023-10-09 | ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the `com.epam.reportportal:service-api` module, corresponding to ReportPorta… |
CVE-2023-5330 | Medium | 4.3 | 2023-10-09 | Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4… |
CVE-2023-45371 | High | 7.5 | 2023-10-09 | An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate… |
CVE-2023-5371 | Medium | 5.3 | 2023-10-04 | RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file |
CVE-2023-3153 | Medium | 5.3 | 2023-10-04 | A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of se… |
CVE-2023-3967 | Medium | 5.3 | 2023-10-03 | Allocation of Resources Without Limits or Throttling vulnerability in Hitachi Ops Center Common Services on Linux allows DoS.This issue affects Hitachi Ops Cen… |
CVE-2023-0809 | Medium | 5.8 | 2023-10-02 | In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets. |
CVE-2023-5289 | High | 8.8 | 2023-09-29 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4. |
CVE-2023-20033 | High | 8.6 | 2023-09-27 | A vulnerability in Cisco IOS XE Software for Cisco Catalyst 3650 and Catalyst 3850 Series Switches could allow an unauthenticated, remote attacker to cause an… |
CVE-2023-43642 | High | 7.5 | 2023-09-25 | snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of… |
CVE-2023-42457 | High | 7.5 | 2023-09-21 | plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when… |
CVE-2023-43632 | Critical | 9.0 | 2023-09-21 | As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port 8877 in EVE, exposing limited functionality of the TPM to the cli… |
CVE-2023-37279 | High | 7.5 | 2023-09-20 | Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a craft… |
CVE-2022-47562 | High | 7.5 | 2023-09-20 | Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial of service (DoS) condition. |
CVE-2023-32186 | High | 7.5 | 2023-09-19 | A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6… |
CVE-2023-32187 | High | 7.5 | 2023-09-18 | An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6… |
CVE-2023-41043 | Medium | 6.5 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-41042 | Medium | 4.9 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-40588 | Medium | 6.5 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-40019 | High | 7.5 | 2023-09-15 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2023-38706 | Medium | 6.5 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-38507 | High | 7.3 | 2023-09-15 | Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen… |
CVE-2023-38039 | High | 7.5 | 2023-09-15 | When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not hav… |
CVE-2023-4578 | Medium | 6.5 | 2023-09-11 | When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`. A path in the function coul… |
CVE-2023-39322 | High | 7.5 | 2023-09-08 | QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause u… |
CVE-2023-34994 | Low | 3.1 | 2023-09-05 | An improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0… |
CVE-2023-4647 | Medium | 5.3 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions sta… |
CVE-2023-40710 | Medium | 6.8 | 2023-08-24 | An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web… |
CVE-2023-40709 | Medium | 6.8 | 2023-08-24 | An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have… |
CVE-2022-48064 | Medium | 5.5 | 2023-08-22 | GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwar… |
CVE-2023-33953 | High | 7.5 | 2023-08-09 | gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Th… |
CVE-2023-39533 | High | 7.5 | 2023-08-08 | go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a… |
CVE-2023-39269 | High | 7.5 | 2023-08-08 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RU… |
CVE-2023-38532 | Low | 3.3 | 2023-08-08 | A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.0.254), Parasolid V35.1 (All versions <… |
CVE-2023-4138 | Medium | 6.5 | 2023-08-03 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0. |
CVE-2023-29408 | Medium | 6.5 | 2023-08-02 | The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms… |
CVE-2022-46485 | High | 7.5 | 2023-08-02 | Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment Fiel… |
CVE-2023-4011 | Medium | 4.3 | 2023-08-02 | An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resultin… |
CVE-2023-4046 | Medium | 5.3 | 2023-08-01 | In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially… |
CVE-2023-38684 | Medium | 5.3 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-38498 | Medium | 4.3 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-37906 | Medium | 4.3 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-38492 | Medium | 5.3 | 2023-07-27 | Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user acco… |
CVE-2023-37900 | Low | 3.4 | 2023-07-27 | Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privi… |
CVE-2023-3242 | High | 8.6 | 2023-07-26 | Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated network-based attackers… |
CVE-2023-32481 | Medium | 4.9 | 2023-07-20 | Wyse Management Suite versions prior to 4.0 contain a denial-of-service vulnerability. An authenticated malicious user can flood the configured SMTP server wi… |
CVE-2023-38405 | High | 7.5 | 2023-07-17 | On Crestron 3-Series Control Systems before 1.8001.0187, crafting and sending a specific BACnet packet can cause a crash. |
CVE-2023-29449 | Medium | 5.9 | 2023-07-13 | JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configu… |
CVE-2023-36521 | High | 8.6 | 2023-07-11 | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4… |
CVE-2023-3566 | Low | 3.5 | 2023-07-10 | A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /confi… |