CWE-770 · Allocation of Resources Without Limits or Throttling (page 16)
Page 16 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52914 | High | 7.5 | 2024-11-18 | In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction. |
CVE-2024-52913 | Medium | 5.3 | 2024-11-18 | In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction, because transaction re-requests are mishandled. |
CVE-2019-25220 | High | 7.5 | 2024-11-18 | Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty header chains (aka a "Chain Width… |
CVE-2024-3760 | High | 7.5 | 2024-11-14 | In lunary-ai/lunary version 1.2.7, there is a lack of rate limiting on the forgot password page, leading to an email bombing vulnerability. Attackers can explo… |
CVE-2024-4311 | Medium | 5.4 | 2024-11-14 | zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-forc… |
CVE-2024-50955 | High | 7.5 | 2024-11-13 | An issue in how XINJE XD5E-24R and XL5E-16T v3.5.3b handles TCP protocol messages allows attackers to cause a Denial of Service (DoS) via a crafted TCP message. |
CVE-2024-43083 | Medium | 5.5 | 2024-11-13 | In validate of WifiConfigurationUtil.java , there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of ser… |
CVE-2024-48989 | High | 7.5 | 2024-11-13 | A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial of service, renderi… |
CVE-2024-21994 | Medium | 4.3 | 2024-11-08 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authent… |
CVE-2024-51428 | High | 7.5 | 2024-11-07 | An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet. |
CVE-2024-38286 | High | 8.6 | 2024-11-07 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from… |
CVE-2024-48809 | High | 7.5 | 2024-11-04 | An issue in Open Networking Foundations sdran-in-a-box v.1.4.3 and onos-a1t v.0.2.3 allows a remote attacker to cause a denial of service via the onos-a1t comp… |
CVE-2024-51557 | Medium | 6.5 | 2024-11-04 | This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this… |
CVE-2024-10599 | Medium | 5.3 | 2024-10-31 | A vulnerability, which was classified as problematic, has been found in Tongda OA 2017 up to 11.7. This issue affects some unknown processing of the file /inc/… |
CVE-2024-31152 | Medium | 5.3 | 2024-10-30 | The LevelOne WBR-6012 router with firmware R0.40e6 is vulnerable to improper resource allocation within its web application, where a series of crafted HTTP req… |
CVE-2024-7807 | High | 7.5 | 2024-10-29 | A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240628 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a lar… |
CVE-2024-10468 | Medium | 5.3 | 2024-10-29 | Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. This vulnerability affects Firefox < 13… |
CVE-2024-47401 | Medium | 4.3 | 2024-10-29 | Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allow… |
CVE-2024-38821 | Critical | 9.1 | 2024-10-28 | Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact… |
CVE-2024-49767 | High | 7.5 | 2024-10-25 | Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werk… |
CVE-2024-6826 | Medium | 6.5 | 2024-10-24 | An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. A denial of service co… |
CVE-2024-20526 | Medium | 5.3 | 2024-10-23 | A vulnerability in the SSH server of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a denial of serv… |
CVE-2024-31880 | Medium | 5.3 | 2024-10-23 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service, under specific configurations, as… |
CVE-2024-45526 | Medium | 5.3 | 2024-10-22 | An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78. A remote attacker can send requests with invalid credentials and ca… |
CVE-2024-50311 | Medium | 6.5 | 2024-10-22 | A denial of service (DoS) vulnerability was found in OpenShift. This flaw allows attackers to exploit the GraphQL batching functionality. The vulnerability ari… |
CVE-2024-45797 | High | 7.5 | 2024-10-16 | LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Prior to version 0.5.49, unbounded processing of HTTP request and resp… |
CVE-2024-41128 | | 2024-10-16 | Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1… | |
CVE-2024-47874 | | 2024-10-15 | Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit. Prior to version 0.40.0, Starlette treats `multipart/form-data` parts without a… | |
CVE-2024-8184 | Medium | 5.9 | 2024-10-14 | There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service… |
CVE-2024-6762 | Low | 3.1 | 2024-10-14 | Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory. |
CVE-2024-47509 | Medium | 6.5 | 2024-10-11 | An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an… |
CVE-2024-47508 | Medium | 6.5 | 2024-10-11 | An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an… |
CVE-2024-47505 | Medium | 6.5 | 2024-10-11 | An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an… |
CVE-2024-47502 | High | 7.5 | 2024-10-11 | An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network bas… |
CVE-2024-35202 | High | 7.5 | 2024-10-10 | Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in… |
CVE-2024-43567 | High | 7.5 | 2024-10-08 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2024-47969 | Medium | 6.2 | 2024-10-07 | Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of service. |
CVE-2024-47967 | Medium | 4.4 | 2024-10-07 | Improper resource initialization handling in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of service. |
CVE-2024-47614 | High | 7.5 | 2024-10-03 | async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead t… |
CVE-2024-46745 | Medium | 5.5 | 2024-09-18 | In the Linux kernel, the following vulnerability has been resolved: Input: uinput - reject requests with unreasonable number of slots When exercising uinput… |
CVE-2024-44459 | High | 7.5 | 2024-09-12 | A memory allocation issue in vernemq v2.0.1 allows attackers to cause a Denial of Service (DoS) via excessive memory consumption. |
CVE-2021-22532 | High | 7.6 | 2024-09-12 | Possible NLDAP Denial of Service attack Vulnerability in eDirectory has been discovered in OpenText™ eDirectory before 9.2.4.0000. |
CVE-2024-45014 | Medium | 5.5 | 2024-09-11 | In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid possible physmem_info segment corruption When physical memory for the ke… |
CVE-2024-45012 | Medium | 5.5 | 2024-09-11 | In the Linux kernel, the following vulnerability has been resolved: nouveau/firmware: use dma non-coherent allocator Currently, enabling SG_DEBUG in the kern… |
CVE-2024-45412 | Medium | 5.3 | 2024-09-10 | Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach… |
CVE-2024-23185 | High | 7.5 | 2024-09-10 | Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when… |
CVE-2024-23184 | Medium | 5.0 | 2024-09-10 | Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, a… |
CVE-2024-7734 | Medium | 5.3 | 2024-09-10 | An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the… |
CVE-2024-6509 | Medium | 6.5 | 2024-09-10 | Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which could lead to resource… |
CVE-2024-40680 | Medium | 5.5 | 2024-09-07 | IBM MQ 9.3 CD and 9.4 LTS/CD could allow a local user to cause a denial of service due to improper memory allocation causing a segmentation fault. |
CVE-2024-8391 | High | 7.5 | 2024-09-04 | In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.ve… |
CVE-2024-21658 | Medium | 4.3 | 2024-08-30 | discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is… |
CVE-2024-43783 | High | 7.5 | 2024-08-27 | The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Instances… |
CVE-2024-41175 | Medium | 5.5 | 2024-08-27 | The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local denial-of-service attack by a low privileged attacker. |
CVE-2024-43410 | High | 7.5 | 2024-08-21 | Russh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server. An SSH packet cons… |
CVE-2024-38808 | Medium | 4.3 | 2024-08-20 | In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language… |
CVE-2024-44083 | High | 7.5 | 2024-08-19 | ida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there is a section that has many jumps linked, and the final jump corresponds to the payload from where… |
CVE-2024-43856 | High | 7.8 | 2024-08-17 | In the Linux kernel, the following vulnerability has been resolved: dma: fix call order in dmam_free_coherent dmam_free_coherent() frees a DMA allocation, wh… |
CVE-2024-6098 | Medium | 5.3 | 2024-08-16 | When performing an online tag generation to devices which communicate using the ControlLogix protocol, a machine-in-the-middle, or a device that is not confi… |
CVE-2024-6004 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to deny printer connect… |
CVE-2024-5210 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to prevent printer serv… |
CVE-2024-5209 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to deny printing capabi… |
CVE-2024-4782 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to disrupt the printer'… |
CVE-2024-4781 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to crash printer commun… |
CVE-2024-41727 | High | 7.5 | 2024-08-14 | In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an inc… |
CVE-2024-7113 | | 2024-08-13 | If exploited, this vulnerability could cause a SuiteLink server to consume excessive system resources and slow down processing of Data I/O for the duration of… | |
CVE-2024-42258 | High | 7.1 | 2024-08-12 | In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines Yves-A… |
CVE-2024-36462 | High | 7.5 | 2024-08-12 | Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandw… |
CVE-2024-42247 | High | 7.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: wireguard: allowedips: avoid unaligned 64-bit memory accesses On the parisc platform, the… |
CVE-2024-42242 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE blk_queue_max_segment_size() ensured: … |
CVE-2024-42241 | Medium | 5.5 | 2024-08-07 | In the Linux kernel, the following vulnerability has been resolved: mm/shmem: disable PMD-sized page cache if needed For shmem files, it's possible that PMD-… |
CVE-2024-39944 | High | 7.5 | 2024-07-31 | A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to… |
CVE-2024-42145 | High | 7.5 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: IB/core: Implement a limit on UMAD receive List The existing behavior of ib_umad, which m… |
CVE-2024-42082 | Medium | 5.5 | 2024-07-29 | In the Linux kernel, the following vulnerability has been resolved: xdp: Remove WARN() from __xdp_reg_mem_model() syzkaller reports a warning in __xdp_reg_me… |
CVE-2024-1975 | High | 7.5 | 2024-07-23 | If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a cli… |
CVE-2024-1737 | High | 7.5 | 2024-07-23 | Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance… |
CVE-2024-0760 | High | 7.5 | 2024-07-23 | A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recov… |
CVE-2024-41132 | Medium | 5.3 | 2024-07-22 | ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive me… |
CVE-2024-6504 | Medium | 4.3 | 2024-07-18 | Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can… |
CVE-2024-41009 | High | 7.8 | 2024-07-17 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemente… |
CVE-2024-21174 | Low | 3.1 | 2024-07-16 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.23, 21.3-21.14 and 23.4. Difficult to expl… |
CVE-2024-38535 | High | 7.5 | 2024-07-11 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Suricata can run out of memory when parsi… |
CVE-2024-38534 | High | 7.5 | 2024-07-11 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Crafted modbus traffic can lead to unlimi… |
CVE-2024-6037 | Critical | 9.1 | 2024-07-10 | A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root… |
CVE-2024-31314 | Medium | 5.5 | 2024-07-09 | In multiple functions of ShortcutService.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with n… |
CVE-2024-6600 | Medium | 6.3 | 2024-07-09 | Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private s… |
CVE-2024-6598 | Medium | 6.5 | 2024-07-09 | A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with jo… |
CVE-2024-39876 | Medium | 4.0 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected applications do not properly handle log rotation. This… |
CVE-2024-33862 | High | 7.5 | 2024-07-05 | A buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could allow remote attackers to exhaust memory res… |
CVE-2024-39484 | Medium | 5.5 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: Don't strip remove function when driver is builtin Using __exit for the rem… |
CVE-2024-39482 | High | 7.8 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: bcache: fix variable length array abuse in btree_iter btree_iter is used in two ways: eit… |
CVE-2024-39478 | High | 7.8 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Do not free stack buffer RSA text data uses variable length buffer all… |
CVE-2024-39477 | High | 7.8 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not call vma_add_reservation upon ENOMEM sysbot reported a splat [1] on __… |
CVE-2024-39474 | Medium | 5.5 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL commit a421ef30… |
CVE-2024-39472 | High | 7.3 | 2024-07-05 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix log recovery buffer allocation for the legacy h_size fixup Commit a70f9fe52daa (… |
CVE-2024-6427 | High | 7.5 | 2024-07-03 | Uncontrolled Resource Consumption vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can use the "message" parameter to inject a… |
CVE-2024-37298 | High | 7.5 | 2024-07-01 | gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struc… |
CVE-2024-34703 | High | 7.5 | 2024-06-30 | Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parame… |
CVE-2024-38528 | High | 7.5 | 2024-06-28 | nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. Th… |
CVE-2024-35116 | Medium | 5.9 | 2024-06-28 | IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error applying configuration changes. IBM X-For… |