CWE-770 · Allocation of Resources Without Limits or Throttling (page 16)
Page 16 of 22 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-27540 | Medium | 5.9 | 2023-07-10 | IBM Watson CP4D Data Stores 4.6.0 does not properly allocate resources without limits or throttling which could allow a remote attacker with information specif… |
CVE-2023-36461 | High | 7.5 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read o… |
CVE-2023-36814 | High | 7.5 | 2023-07-03 | Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input i… |
CVE-2023-34450 | Low | 3.7 | 2023-07-03 | CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine and replicates it on many machines. An internal modification made… |
CVE-2023-21176 | Medium | 4.4 | 2023-06-28 | In list_key_entries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local denial of service wit… |
CVE-2023-20108 | High | 7.5 | 2023-06-28 | A vulnerability in the XCP Authentication Service of the Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an un… |
CVE-2023-32385 | Medium | 5.5 | 2023-06-23 | A denial-of-service issue was addressed with improved memory handling. This issue is fixed in iOS 16.5 and iPadOS 16.5, macOS Ventura 13.4. Opening a PDF file… |
CVE-2023-34462 | Medium | 6.5 | 2023-06-22 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `Sni… |
CVE-2023-36357 | High | 7.7 | 2023-06-22 | An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackers to cause a Denial… |
CVE-2023-36371 | High | 7.5 | 2023-06-22 | An issue in the GDKfree component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36370 | High | 7.5 | 2023-06-22 | An issue in the gc_col component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36369 | High | 7.5 | 2023-06-22 | An issue in the list_append component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36368 | High | 7.5 | 2023-06-22 | An issue in the cs_bind_ubat component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36367 | High | 7.5 | 2023-06-22 | An issue in the BLOBcmp component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36366 | High | 7.5 | 2023-06-22 | An issue in the log_create_delta component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause Denial of Service (DoS) via crafted SQL statement… |
CVE-2023-36365 | High | 7.5 | 2023-06-22 | An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL state… |
CVE-2023-2828 | High | 7.5 | 2023-06-21 | Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to author… |
CVE-2023-34166 | High | 7.5 | 2023-06-19 | Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the system to restart. |
CVE-2022-48498 | High | 7.5 | 2023-06-19 | Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. |
CVE-2023-30903 | Medium | 5.5 | 2023-06-16 | HP-UX could be exploited locally to create a Denial of Service (DoS) when any physical interface is configured with IPv6/inet6. |
CVE-2023-21144 | High | 7.5 | 2023-06-15 | In doInBackground of NotificationContentInflater.java, there is a possible temporary denial or service due to long running operations. This could lead to remot… |
CVE-2023-34455 | High | 7.5 | 2023-06-15 | snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1… |
CVE-2023-35116 | Medium | 4.7 | 2023-06-14 | jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. N… |
CVE-2023-34396 | Medium | 4.3 | 2023-06-14 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30… |
CVE-2023-34149 | Medium | 4.3 | 2023-06-14 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30… |
CVE-2023-29767 | Medium | 5.5 | 2023-06-09 | An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files. |
CVE-2023-0121 | Medium | 6.5 | 2023-06-07 | A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15… |
CVE-2023-2253 | Medium | 6.5 | 2023-06-06 | A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (quer… |
CVE-2023-0921 | Medium | 4.3 | 2023-06-06 | A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticate… |
CVE-2022-48441 | Medium | 5.5 | 2023-06-06 | In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48440 | Medium | 5.5 | 2023-06-06 | In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2023-23603 | Medium | 6.5 | 2023-06-02 | Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting for external URLs. Da… |
CVE-2023-0616 | Medium | 6.5 | 2023-06-02 | If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause T… |
CVE-2023-32699 | Medium | 6.5 | 2023-05-30 | MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. The `checkUserPassword` method is used… |
CVE-2023-33656 | Medium | 5.5 | 2023-05-30 | A memory leak vulnerability exists in NanoMQ 0.17.2. The vulnerability is located in the file message.c. An attacker could exploit this vulnerability to cause… |
CVE-2023-29737 | Medium | 5.5 | 2023-05-30 | An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause a denial of service via the database files. |
CVE-2023-2650 | Medium | 6.5 | 2023-05-30 | Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_… |
CVE-2023-33720 | Medium | 6.5 | 2023-05-26 | mp4v2 v2.1.2 was discovered to contain a memory leak via the class MP4BytesProperty. |
CVE-2023-21110 | High | 7.8 | 2023-05-15 | In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion. This could lead to local escalatio… |
CVE-2023-20930 | Medium | 5.5 | 2023-05-15 | In pushDynamicShortcut of ShortcutPackage.java, there is a possible way to get the device into a boot loop due to resource exhaustion. This could lead to local… |
CVE-2023-31914 | Medium | 5.5 | 2023-05-12 | Jerryscript 3.0 (commit 05dbbd1) was discovered to contain out-of-memory issue in malloc. |
CVE-2023-2666 | High | 7.5 | 2023-05-12 | Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16. |
CVE-2023-28356 | High | 7.5 | 2023-05-11 | A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enter a hot loop on one… |
CVE-2023-25568 | High | 8.2 | 2023-05-10 | Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able alloca… |
CVE-2021-46760 | Critical | 9.8 | 2023-05-09 | A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access that may potentia… |
CVE-2023-31472 | High | 7.5 | 2023-05-09 | An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. Thi… |
CVE-2023-27958 | Critical | 9.1 | 2023-05-08 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A remote user ma… |
CVE-2023-30551 | High | 7.5 | 2023-05-08 | Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading… |
CVE-2023-26285 | Medium | 5.9 | 2023-05-05 | IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow a remote attacker to cause a denial of service due to an error processing invalid data. IBM X-Force ID… |
CVE-2023-30455 | High | 7.5 | 2023-04-28 | An issue was discovered in ebankIT before 7. A Denial-of-Service attack is possible through the GET parameter EStatementsIds located on the /Controls/Generic/E… |
CVE-2023-28882 | High | 7.5 | 2023-04-28 | Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in t… |
CVE-2023-27556 | Medium | 6.5 | 2023-04-28 | IBM Counter Fraud Management for Safer Payments 6.1.0.00, 6.2.0.00, 6.3.0.00 through 6.3.1.03, 6.4.0.00 through 6.4.2.02 and 6.5.0.00 does not properly allocat… |
CVE-2023-29779 | High | 7.5 | 2023-04-25 | Sengled Dimmer Switch V0.0.9 contains a denial of service (DOS) vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable… |
CVE-2023-30408 | Medium | 5.5 | 2023-04-24 | Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry. |
CVE-2023-30406 | Medium | 5.5 | 2023-04-24 | Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c. |
CVE-2023-29479 | Medium | 5.3 | 2023-04-24 | Ribose RNP before 0.16.3 may hang when the input is malformed. |
CVE-2023-29570 | Medium | 5.5 | 2023-04-24 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_ffi_cb_free at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (Do… |
CVE-2023-29575 | Medium | 5.5 | 2023-04-21 | Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component. |
CVE-2023-0383 | High | 7.5 | 2023-04-20 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption. |
CVE-2023-26048 | Medium | 5.3 | 2023-04-18 | Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `H… |
CVE-2023-28968 | Medium | 5.3 | 2023-04-17 | An Improperly Controlled Sequential Memory Allocation vulnerability in the Juniper Networks Deep Packet Inspection-Decoder (JDPI-Decoder) Application Signature… |
CVE-2018-15472 | High | 7.5 | 2023-04-15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The diff formatter using roug… |
CVE-2023-27653 | High | 7.5 | 2023-04-14 | An issue found in WHOv.1.0.28, v.1.0.30, v.1.0.32 allows an attacker to cause a denial of service via the SharedPreference files. |
CVE-2023-27643 | High | 7.5 | 2023-04-14 | An issue found in POWERAMP 925-bundle-play and Poweramp 954-uni allows a remote attacker to cause a denial of service via the Rescan button in Queue and Select… |
CVE-2023-30636 | High | 7.5 | 2023-04-13 | TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error, with RpcStatus UNAVAILABLE for "not leader") upon an attempt to start a node in a… |
CVE-2023-29573 | Medium | 5.5 | 2023-04-13 | Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component. |
CVE-2023-25414 | Medium | 5.3 | 2023-04-11 | Aten PE8108 2.4.232 is vulnerable to denial of service (DOS). |
CVE-2023-26964 | High | 7.5 | 2023-04-11 | An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and… |
CVE-2022-43768 | High | 7.5 | 2023-04-11 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) (All versions… |
CVE-2023-27191 | High | 7.5 | 2023-04-11 | An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files. |
CVE-2023-24536 | High | 7.5 | 2023-04-06 | Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several… |
CVE-2023-0382 | Medium | 6.5 | 2023-04-05 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption. |
CVE-2023-27492 | Medium | 4.8 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the Lua fi… |
CVE-2023-28837 | Medium | 4.9 | 2023-04-03 | Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of… |
CVE-2022-48357 | High | 7.5 | 2023-03-27 | Some products have the double fetch vulnerability. Successful exploitation of this vulnerability may cause denial of service (DoS) attacks to the kernel. |
CVE-2022-46416 | Critical | 9.1 | 2023-03-27 | Parrot Bebop 4.7.1. allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker… |
CVE-2023-28867 | High | 7.5 | 2023-03-27 | In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4… |
CVE-2023-1544 | Medium | 6.0 | 2023-03-23 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge numb… |
CVE-2023-20067 | High | 7.4 | 2023-03-23 | A vulnerability in the HTTP-based client profiling feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjacen… |
CVE-2023-28119 | High | 7.5 | 2023-03-22 | The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` d… |
CVE-2022-42334 | Medium | 6.5 | 2023-03-21 | x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… |
CVE-2022-42333 | High | 8.6 | 2023-03-21 | x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… |
CVE-2023-28428 | Medium | 6.2 | 2023-03-20 | PDFio is a C library for reading and writing PDF files. In versions 1.1.0 and prior, a denial of service vulnerability exists in the pdfio parser. Crafted pdf… |
CVE-2021-46877 | High | 7.5 | 2023-03-18 | jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read… |
CVE-2023-28107 | Medium | 4.5 | 2023-03-17 | Discourse is an open-source discussion platform. Prior to version 3.0.2 of the `stable` branch and version 3.1.0.beta3 of the `beta` and `tests-passed` branche… |
CVE-2023-28104 | High | 7.5 | 2023-03-16 | `silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql quer… |
CVE-2023-28338 | High | 7.5 | 2023-03-15 | Any request send to a Netgear Nighthawk Wifi6 Router (RAX30)'s web service containing a “Content-Type” of “multipartboundary=” will result in the request body… |
CVE-2023-27596 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, OpenSIPS crashes when a malformed SDP body is sent mu… |
CVE-2023-27530 | High | 7.5 | 2023-03-10 | A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to… |
CVE-2023-27901 | High | 7.5 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introdu… |
CVE-2023-27900 | High | 7.5 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introdu… |
CVE-2022-41727 | Medium | 5.5 | 2023-02-28 | An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of serv… |
CVE-2022-41725 | High | 7.5 | 2023-02-28 | A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm… |
CVE-2023-23916 | Medium | 6.5 | 2023-02-23 | An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that… |
CVE-2022-31394 | High | 7.5 | 2023-02-21 | Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform… |
CVE-2023-26249 | High | 7.5 | 2023-02-21 | Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of service. Specificall… |
CVE-2021-32848 | High | 7.5 | 2023-02-20 | Octobox is software for managing GitHub notifications. Prior to pull request (PR) 2807, a user of the system can provide a specifically crafted search query st… |
CVE-2023-25656 | High | 7.5 | 2023-02-20 | notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users… |
CVE-2023-24998 | High | 7.5 | 2023-02-20 | Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS wi… |
CVE-2023-24785 | Medium | 5.5 | 2023-02-17 | An issue in Giorgio Tani peazip v.9.0.0 allows attackers to cause a denial of service via the End of Archive tag function of the peazip/pea UNPEA feature. |