CWE-770 · Allocation of Resources Without Limits or Throttling (page 17)
Page 17 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-31919 | Medium | 5.9 | 2024-06-28 | IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service attack caused by an error processing mess… |
CVE-2024-37681 | Medium | 6.5 | 2024-06-24 | An issue the background management system of Shanxi Internet Chuangxiang Technology Co., Ltd v1.0.1 allows a remote attacker to cause a denial of service via t… |
CVE-2024-34027 | High | 7.8 | 2024-06-24 | In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock It need… |
CVE-2024-6176 | | 2024-06-20 | Allocation of Resources Without Limits or Throttling vulnerability in LG Electronics LG SuperSign CMS allows Port Scanning.This issue affects LG SuperSign CMS… | |
CVE-2024-5208 | Medium | 6.5 | 2024-06-19 | An uncontrolled resource consumption vulnerability exists in the `upload-link` endpoint of mintplex-labs/anything-llm. This vulnerability allows attackers to c… |
CVE-2024-37309 | Medium | 5.3 | 2024-06-13 | CrateDB is a distributed SQL database. A high-risk vulnerability has been identified in versions prior to 5.7.2 where the TLS endpoint (port 4200) permits clie… |
CVE-2023-49559 | Low | 3.7 | 2024-06-12 | An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives fu… |
CVE-2024-31881 | Medium | 6.5 | 2024-06-12 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using… |
CVE-2024-28762 | Medium | 5.3 | 2024-06-12 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under… |
CVE-2024-34055 | Medium | 6.5 | 2024-06-05 | Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single c… |
CVE-2022-28656 | Medium | 5.5 | 2024-06-04 | is_closing_session() allows users to consume RAM in the Apport process |
CVE-2022-28655 | High | 7.1 | 2024-06-04 | is_closing_session() allows users to create arbitrary tcp dbus connections |
CVE-2022-28654 | Medium | 5.5 | 2024-06-04 | is_closing_session() allows users to fill up apport.log |
CVE-2024-32871 | High | 7.5 | 2024-06-04 | Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing… |
CVE-2024-36378 | Medium | 5.9 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens |
CVE-2024-35238 | Medium | 5.3 | 2024-05-27 | Minder by Stacklok is an open source software supply chain security platform. Minder prior to version 0.0.51 is vulnerable to a denial-of-service (DoS) attack… |
CVE-2024-35231 | High | 8.6 | 2024-05-27 | rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable t… |
CVE-2021-47551 | High | 7.8 | 2024-05-24 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again In SRIOV conf… |
CVE-2024-2874 | Medium | 6.5 | 2024-05-23 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered w… |
CVE-2024-31617 | Medium | 5.3 | 2024-05-22 | OpenLiteSpeed before 1.8.1 mishandles chunked encoding. |
CVE-2021-47374 | High | 7.5 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: dma-debug: prevent an error message from causing runtime problems For some drivers, that… |
CVE-2024-35969 | High | 8.8 | 2024-05-20 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifad… |
CVE-2023-47717 | Medium | 4.4 | 2024-05-16 | IBM Security Guardium 12.0 could allow a privileged user to perform unauthorized actions that could lead to a denial of service. IBM X-Force ID: 271690. |
CVE-2024-35185 | Medium | 5.3 | 2024-05-16 | Minder is a software supply chain security platform. Prior to version 0.0.49, the Minder REST ingester is vulnerable to a denial of service attack via an attac… |
CVE-2024-35176 | Medium | 5.3 | 2024-05-16 | REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute va… |
CVE-2024-34358 | Medium | 5.3 | 2024-05-14 | TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1… |
CVE-2024-33495 | Medium | 6.5 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-25969 | Medium | 6.2 | 2024-05-14 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability. A local unauthenticated at… |
CVE-2024-4539 | Medium | 4.3 | 2024-05-14 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2024-32874 | Medium | 6.8 | 2024-05-14 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the fi… |
CVE-2024-2454 | Medium | 6.5 | 2024-05-14 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting fro… |
CVE-2024-28760 | Medium | 4.3 | 2024-05-14 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 dashboard is vulnerable to a denial of service due to improper restriction… |
CVE-2024-27804 | Medium | 5.5 | 2024-05-14 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.3, watchOS 10… |
CVE-2024-0027 | Medium | 5.5 | 2024-05-07 | In multiple functions of SnoozeHelper.java, there is a possible way to cause a boot loop due to resource exhaustion. This could lead to local denial of service… |
CVE-2024-0026 | Medium | 5.5 | 2024-05-07 | In multiple functions of SnoozeHelper.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of ser… |
CVE-2024-32663 | High | 7.5 | 2024-05-07 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, a small amount… |
CVE-2024-4140 | High | 7.5 | 2024-05-02 | An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The… |
CVE-2024-4029 | Medium | 4.1 | 2024-05-02 | A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause… |
CVE-2024-27013 | Medium | 5.5 | 2024-05-01 | In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhost_worker will call t… |
CVE-2024-34046 | High | 7.5 | 2024-04-30 | The O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo->sctpParams->e2tCounters[IN_SUCC][MSG_COUNTER][Pr… |
CVE-2024-4183 | Medium | 4.3 | 2024-04-26 | Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows a… |
CVE-2024-22091 | Low | 3.1 | 2024-04-26 | Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs whic… |
CVE-2024-25026 | Medium | 5.9 | 2024-04-25 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused… |
CVE-2024-32660 | High | 7.5 | 2024-04-23 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid hug… |
CVE-2024-31208 | Medium | 6.5 | 2024-04-23 | Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch spe… |
CVE-2024-31994 | Medium | 6.5 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, an attacker can point the image request to an arbitrarily large file. Mealie will atte… |
CVE-2024-31992 | Medium | 6.5 | 2024-04-19 | Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safe_scrape_html function utilizes a user-controlled URL to issue a request to a r… |
CVE-2024-26894 | Medium | 6.0 | 2024-04-17 | In the Linux kernel, the following vulnerability has been resolved: ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() After unregistering… |
CVE-2024-21060 | Medium | 4.9 | 2024-04-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Data Dictionary). Supported versions that are affected are 8.0.36 and prior and… |
CVE-2024-21011 | Low | 3.7 | 2024-04-16 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versi… |
CVE-2024-31446 | High | 7.7 | 2024-04-16 | OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. A user can use OpenComputers to get a Computer thread stuck in the Lu… |
CVE-2024-3302 | Low | 3.7 | 2024-04-16 | There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the b… |
CVE-2024-1666 | Medium | 5.3 | 2024-04-16 | In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side c… |
CVE-2024-32035 | Medium | 5.3 | 2024-04-15 | ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive me… |
CVE-2024-29903 | Medium | 4.2 | 2024-04-10 | Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of s… |
CVE-2024-29902 | Medium | 4.2 | 2024-04-10 | Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial… |
CVE-2021-47182 | Medium | 5.5 | 2024-04-10 | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix scsi_mode_sense() buffer length handling Several problems exist with scsi… |
CVE-2024-3382 | High | 7.5 | 2024-04-10 | A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually pre… |
CVE-2024-26816 | Medium | 5.5 | 2024-04-10 | In the Linux kernel, the following vulnerability has been resolved: x86, relocs: Ignore relocations in .notes section When building with CONFIG_XEN_PV=y, .te… |
CVE-2024-26276 | Low | 3.3 | 2024-04-09 | A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207… |
CVE-2024-0081 | High | 8.6 | 2024-04-05 | NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr_webapp where an attacker may cause an allocation of resources without limits or throttl… |
CVE-2024-28949 | Medium | 4.3 | 2024-04-05 | Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which all… |
CVE-2024-27316 | High | 7.5 | 2024-04-04 | HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not sto… |
CVE-2024-30249 | High | 8.6 | 2024-04-04 | Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR1-20240330.101522-15` impacts pub… |
CVE-2024-27268 | Medium | 5.9 | 2024-04-04 | IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remot… |
CVE-2024-28871 | High | 7.5 | 2024-04-04 | LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic, leading to excessi… |
CVE-2024-28182 | Medium | 5.3 | 2024-04-04 | nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number… |
CVE-2024-22189 | High | 7.5 | 2024-04-04 | quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of… |
CVE-2024-26798 | Medium | 5.5 | 2024-04-04 | In the Linux kernel, the following vulnerability has been resolved: fbcon: always restore the old font data in fbcon_do_set_font() Commit a5a923038d70 (fbdev… |
CVE-2024-28870 | High | 7.5 | 2024-04-03 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata com… |
CVE-2024-26743 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: RDMA/qedr: Fix qedr_create_user_qp error flow Avoid the following warning by making sure… |
CVE-2024-26741 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished(). syzkalle… |
CVE-2024-26710 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Limit KASAN thread size increase to 32KB KASAN is seen to increase stack u… |
CVE-2024-26707 | Medium | 5.5 | 2024-04-03 | In the Linux kernel, the following vulnerability has been resolved: net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() Syzkaller reported [1] hitti… |
CVE-2024-29086 | Low | 3.3 | 2024-04-02 | in OpenHarmony v3.2.4 and prior versions allow a local attacker cause DOS through stack overflow. |
CVE-2024-26675 | Medium | 5.5 | 2024-04-02 | In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_O… |
CVE-2024-22353 | Medium | 5.9 | 2024-03-31 | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remot… |
CVE-2024-2818 | Medium | 4.3 | 2024-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16… |
CVE-2023-43768 | High | 7.5 | 2024-03-27 | An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via lar… |
CVE-2024-26577 | High | 7.5 | 2024-03-26 | VSeeFace through 1.13.38.c2 allows attackers to cause a denial of service (application hang) via a spoofed UDP packet containing at least 10 digits in JSON dat… |
CVE-2024-22436 | Medium | 6.5 | 2024-03-26 | A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a denial of service. |
CVE-2024-26646 | High | 7.8 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: thermal: intel: hfi: Add syscore callbacks for system-wide PM The kernel allocates a memo… |
CVE-2023-52622 | Medium | 5.5 | 2024-03-26 | In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing failures due to oversized flex bg When we online resize an ex… |
CVE-2024-29025 | Medium | 5.3 | 2024-03-25 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `Htt… |
CVE-2021-47170 | Medium | 5.5 | 2024-03-25 | In the Linux kernel, the following vulnerability has been resolved: USB: usbfs: Don't WARN about excessively large memory allocations Syzbot found that the k… |
CVE-2021-47137 | Critical | 9.8 | 2024-03-25 | In the Linux kernel, the following vulnerability has been resolved: net: lantiq: fix memory corruption in RX ring In a situation where memory allocation or d… |
CVE-2024-30156 | High | 7.5 | 2024-03-24 | Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 co… |
CVE-2024-28863 | Medium | 6.5 | 2024-03-21 | node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker wh… |
CVE-2024-28102 | Medium | 6.8 | 2024-03-21 | JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by pas… |
CVE-2023-41038 | High | 7.5 | 2024-03-20 | Firebird is a relational database. Versions 4.0.0 through 4.0.3 and version 5.0 beta1 are vulnerable to a server crash when a user uses a specific form of SET… |
CVE-2021-47130 | High | 7.5 | 2024-03-15 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix freeing unallocated p2pmem In case p2p device was found but the p2p pool is em… |
CVE-2024-2446 | Medium | 4.3 | 2024-03-15 | Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per me… |
CVE-2024-28053 | Low | 3.1 | 2024-03-15 | Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker t… |
CVE-2020-11862 | High | 8.6 | 2024-03-13 | Allocation of Resources Without Limits or Throttling vulnerability in OpenText NetIQ Privileged Account Manager on Linux, Windows, 64 bit allows Flooding.This… |
CVE-2024-1765 | Medium | 5.9 | 2024-03-12 | Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the… |
CVE-2024-26618 | Medium | 5.5 | 2024-03-11 | In the Linux kernel, the following vulnerability has been resolved: arm64/sme: Always exit sme_alloc() early with existing storage When sme_alloc() is called… |
CVE-2023-52606 | High | 7.8 | 2024-03-06 | In the Linux kernel, the following vulnerability has been resolved: powerpc/lib: Validate size for vector operations Some of the fp/vmx code in sstep.c assum… |
CVE-2023-45290 | Medium | 6.5 | 2024-03-05 | When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFi… |
CVE-2024-22255 | High | 7.1 | 2024-03-05 | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access t… |
CVE-2023-52529 | Medium | 6.0 | 2024-03-02 | In the Linux kernel, the following vulnerability has been resolved: HID: sony: Fix a potential memory leak in sony_probe() If an error occurs after a success… |