CWE-770 · Allocation of Resources Without Limits or Throttling (page 18)
Page 18 of 22 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25231 | High | 7.5 | 2022-08-23 | The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, w… |
CVE-2022-24381 | High | 7.5 | 2022-08-23 | All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single se… |
CVE-2022-24298 | High | 7.5 | 2022-08-23 | All versions of package freeopcua/freeopcua are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sendin… |
CVE-2022-36155 | Medium | 5.5 | 2022-08-16 | tifig v0.2.2 was discovered to contain a resource allocation issue via operator new(unsigned long) at asan_new_delete.cpp. |
CVE-2022-36146 | Medium | 5.5 | 2022-08-16 | SWFMill commit 53d7690 was discovered to contain a memory allocation issue via operator new[](unsigned long) at asan_new_delete.cpp. |
CVE-2022-35111 | Medium | 5.5 | 2022-08-16 | SWFTools commit 772e55a2 was discovered to contain a stack overflow via __sanitizer::StackDepotNode::hash(__sanitizer::StackTrace const&) at /sanitizer_common/… |
CVE-2022-35107 | Medium | 5.5 | 2022-08-16 | SWFTools commit 772e55a2 was discovered to contain a stack overflow via vfprintf at /stdio-common/vfprintf.c. |
CVE-2022-35009 | Medium | 6.5 | 2022-08-16 | PNGDec commit 8abf6be was discovered to contain a memory allocation problem via asan_malloc_linux.cpp. |
CVE-2020-14322 | High | 7.5 | 2022-08-16 | In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, yui_combo needed to limit the amount of files it can load to help mitigate the risk of denial of service. |
CVE-2022-38155 | High | 7.5 | 2022-08-11 | TEE_Malloc in Samsung mTower through 0.3.0 allows a trusted application to achieve Excessive Memory Allocation via a large len value, as demonstrated by a Numa… |
CVE-2022-36324 | High | 7.5 | 2022-08-10 | Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TCP brute fo… |
CVE-2022-36124 | High | 7.5 | 2022-08-09 | It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications… |
CVE-2022-35724 | High | 7.5 | 2022-08-09 | It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache A… |
CVE-2022-31118 | Medium | 6.5 | 2022-08-04 | Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and p… |
CVE-2022-35505 | High | 7.5 | 2022-08-03 | A segmentation fault in TripleCross v0.1.0 occurs when sending a control command from the client to the server. This occurs because there is no limit to the le… |
CVE-2022-35221 | Medium | 5.4 | 2022-08-02 | Teamplus Pro community discussion has an ‘allocation of resource without limits or throttling’ vulnerability on thread subject field. A remote attacker with ge… |
CVE-2022-35220 | High | 7.7 | 2022-08-02 | Teamplus Pro community discussion function has an ‘allocation of resource without limits or throttling’ vulnerability. A remote attacker with general user priv… |
CVE-2022-35219 | Medium | 5.5 | 2022-08-02 | The NHI card’s web service component has a stack-based buffer overflow vulnerability due to insufficient validation for network packet key parameter. A LAN att… |
CVE-2022-35218 | Medium | 5.5 | 2022-08-02 | The NHI card’s web service component has a heap-based buffer overflow vulnerability due to insufficient validation for packet origin parameter length. A LAN at… |
CVE-2022-35922 | High | 7.5 | 2022-08-01 | Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory (OOM) p… |
CVE-2022-35915 | Medium | 5.3 | 2022-08-01 | OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas… |
CVE-2022-31184 | Medium | 6.5 | 2022-08-01 | Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been incl… |
CVE-2022-22212 | High | 7.5 | 2022-07-20 | An Allocation of Resources Without Limits or Throttling vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved allows unauthe… |
CVE-2022-32958 | High | 7.7 | 2022-07-20 | A remote attacker with general user privilege can send a message to Teamplus Pro’s chat group that exceeds message size limit, to terminate other recipients’ T… |
CVE-2022-29286 | High | 7.5 | 2022-07-17 | Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resource mishandling. |
CVE-2022-2406 | Medium | 4.3 | 2022-07-14 | The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated atta… |
CVE-2022-31080 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31079 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31078 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31075 | Medium | 4.9 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2021-31645 | High | 7.5 | 2022-07-07 | An issue was discovered in glFTPd 2.11a that allows remote attackers to cause a denial of service via exceeding the connection limit. |
CVE-2022-32206 | Medium | 6.5 | 2022-07-07 | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different alg… |
CVE-2022-32205 | Medium | 4.3 | 2022-07-07 | A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large a… |
CVE-2022-34750 | High | 7.5 | 2022-06-28 | An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this le… |
CVE-2021-40609 | Medium | 5.5 | 2022-06-28 | The GetHintFormat function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. |
CVE-2021-40607 | Medium | 5.5 | 2022-06-28 | The schm_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. |
CVE-2021-40941 | High | 7.5 | 2022-06-27 | In Bento4 1.6.0-638, there is an allocator is out of memory in the function AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity in Ap4Array.h:172, as demonstrated b… |
CVE-2022-31016 | Medium | 6.5 | 2022-06-25 | Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allo… |
CVE-2022-21952 | High | 7.5 | 2022-06-22 | A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to e… |
CVE-2022-27871 | High | 7.8 | 2022-06-21 | Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may be used to write beyond the allocated bu… |
CVE-2022-22979 | High | 7.5 | 2022-06-21 | In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a deni… |
CVE-2022-2134 | Medium | 6.5 | 2022-06-20 | Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0. |
CVE-2022-29863 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation. |
CVE-2022-20143 | Medium | 5.5 | 2022-06-15 | In addAutomaticZenRule of ZenModeHelper.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of se… |
CVE-2022-32559 | Critical | 9.1 | 2022-06-14 | An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics. |
CVE-2021-35096 | High | 7.5 | 2022-06-14 | Improper memory allocation during counter check DLM handling can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna… |
CVE-2022-31287 | Medium | 5.5 | 2022-06-10 | An issue was discovered in Bento4 v1.2. There is an allocation size request error in /Ap4RtpAtom.cpp. |
CVE-2022-31285 | Medium | 5.5 | 2022-06-10 | An issue was discovered in Bento4 1.2. The allocator is out of memory in /Source/C++/Core/Ap4Array.h. |
CVE-2022-30522 | High | 7.5 | 2022-06-09 | If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excess… |
CVE-2022-29404 | High | 7.5 | 2022-06-09 | In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit o… |
CVE-2022-1708 | High | 7.5 | 2022-06-07 | A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs co… |
CVE-2022-29767 | Medium | 6.5 | 2022-06-03 | adbyby v2.7 allows external users to make connections via port 8118. This can cause a program logic error and lead to a Denial of Service (DoS) via high CPU us… |
CVE-2022-25169 | Medium | 5.5 | 2022-05-16 | The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files. |
CVE-2022-30775 | Medium | 5.5 | 2022-05-16 | xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by (for example) sending a crafted PDF document to the pdftoppm b… |
CVE-2022-22971 | Medium | 6.5 | 2022-05-12 | In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denia… |
CVE-2022-22970 | Medium | 5.3 | 2022-05-12 | In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if the… |
CVE-2022-1428 | Medium | 4.3 | 2022-05-11 | An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 be… |
CVE-2021-39670 | Medium | 5.5 | 2022-05-10 | In setStream of WallpaperManager.java, there is a possible way to cause a permanent DoS due to improper input validation. This could lead to local denial of se… |
CVE-2022-20767 | High | 8.6 | 2022-05-03 | A vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause… |
CVE-2022-20757 | High | 8.6 | 2022-05-03 | A vulnerability in the connection handling function in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a… |
CVE-2022-20751 | High | 8.6 | 2022-05-03 | A vulnerability in the Snort detection engine integration for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to… |
CVE-2022-29973 | Medium | 4.7 | 2022-05-02 | relan exFAT 1.3.0 allows local users to obtain sensitive information (data from deleted files in the filesystem) in certain situations involving offsets beyond… |
CVE-2022-22278 | High | 7.5 | 2022-04-27 | A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access p… |
CVE-2022-29701 | High | 7.5 | 2022-04-27 | A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user… |
CVE-2022-28871 | Medium | 4.3 | 2022-04-25 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the fsicapd component used in certain F-Secure products while scanning larger… |
CVE-2021-44502 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can control the size of a memset that… |
CVE-2022-20717 | Medium | 5.5 | 2022-04-15 | A vulnerability in the NETCONF process of Cisco SD-WAN vEdge Routers could allow an authenticated, local attacker to cause an affected device to run out of mem… |
CVE-2022-20622 | High | 8.6 | 2022-04-15 | A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points Software could allow an unauthenticated… |
CVE-2022-1337 | Medium | 4.3 | 2022-04-13 | The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attack… |
CVE-2022-1333 | Low | 3.5 | 2022-04-13 | Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to… |
CVE-2022-27819 | Medium | 5.3 | 2022-04-07 | SWHKD 1.1.5 allows unsafe parsing via the -c option. An information leak might occur but there is a simple denial of service (memory exhaustion) upon an attemp… |
CVE-2022-1121 | Medium | 5.3 | 2022-04-04 | A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an… |
CVE-2022-22950 | Medium | 6.5 | 2022-04-01 | n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may ca… |
CVE-2022-22404 | Medium | 6.5 | 2022-04-01 | IBM App Connect Enterprise Certified Container Dashboard UI (IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1) may be vulnerable to d… |
CVE-2021-43662 | Medium | 6.5 | 2022-03-31 | totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumption. |
CVE-2017-20016 | Medium | 4.3 | 2022-03-28 | A vulnerability has been found in WEKA INTEREST Security Scanner up to 1.8 and classified as problematic. This vulnerability affects unknown code of the compon… |
CVE-2022-21822 | High | 7.5 | 2022-03-17 | NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, w… |
CVE-2021-32476 | High | 7.5 | 2022-03-11 | A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6… |
CVE-2022-24741 | Low | 3.5 | 2022-03-09 | Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading spec… |
CVE-2022-26336 | Medium | 5.5 | 2022-03-04 | A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF file… |
CVE-2022-21716 | High | 7.5 | 2022-03-03 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to acce… |
CVE-2022-24685 | High | 7.5 | 2022-02-28 | HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0… |
CVE-2022-24614 | Medium | 5.5 | 2022-02-24 | When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-mem… |
CVE-2016-20013 | High | 7.5 | 2022-02-19 | sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the s… |
CVE-2022-23228 | High | 7.5 | 2022-02-18 | Pexip Infinity before 27.0 has improper WebRTC input validation. An unauthenticated remote attacker can use excessive resources, temporarily causing denial of… |
CVE-2021-22050 | High | 7.5 | 2022-02-16 | ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a… |
CVE-2022-21698 | High | 7.5 | 2022-02-15 | client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers… |
CVE-2022-23913 | High | 7.5 | 2022-02-04 | In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memor… |
CVE-2021-32036 | Medium | 5.4 | 2022-02-04 | An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource dep… |
CVE-2022-21732 | Medium | 4.3 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `ThreadPoolHandle` can be used to trigger a denial of service attack by allocati… |
CVE-2021-41840 | High | 8.2 | 2022-02-03 | An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the Syste… |
CVE-2022-24196 | Medium | 6.5 | 2022-02-01 | iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attacker… |
CVE-2021-28096 | Medium | 5.3 | 2022-01-27 | An issue was discovered in Stormshield SNS before 4.2.3 (when the proxy is used). An attacker can saturate the proxy connection table. This would result in the… |
CVE-2021-44988 | High | 7.8 | 2022-01-25 | Jerryscript v3.0.0 and below was discovered to contain a stack overflow via ecma_find_named_property in ecma-helpers.c. |
CVE-2021-39293 | High | 7.5 | 2022-01-24 | In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader o… |
CVE-2021-39480 | High | 7.5 | 2022-01-21 | Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS). |
CVE-2022-23837 | High | 7.5 | 2022-01-21 | In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting… |
CVE-2022-21294 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a… |
CVE-2022-22153 | High | 7.5 | 2022-01-19 | An Insufficient Algorithmic Complexity combined with an Allocation of Resources Without Limits or Throttling vulnerability in the flow processing daemon (flowd… |
CVE-2021-46050 | Medium | 5.5 | 2022-01-10 | A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function. |