CWE-770 · Allocation of Resources Without Limits or Throttling (page 19)
Page 19 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4578 | Medium | 6.5 | 2023-09-11 | When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`. A path in the function coul… |
CVE-2023-39322 | High | 7.5 | 2023-09-08 | QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause u… |
CVE-2023-34994 | Low | 3.1 | 2023-09-05 | An improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0… |
CVE-2023-4647 | Medium | 5.3 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions sta… |
CVE-2023-40710 | Medium | 6.8 | 2023-08-24 | An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web… |
CVE-2023-40709 | Medium | 6.8 | 2023-08-24 | An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have… |
CVE-2022-48064 | Medium | 5.5 | 2023-08-22 | GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwar… |
CVE-2023-33953 | High | 7.5 | 2023-08-09 | gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Th… |
CVE-2023-39533 | High | 7.5 | 2023-08-08 | go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a… |
CVE-2023-39269 | High | 7.5 | 2023-08-08 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RU… |
CVE-2023-38532 | Low | 3.3 | 2023-08-08 | A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.0.254), Parasolid V35.1 (All versions <… |
CVE-2023-4138 | Medium | 6.5 | 2023-08-03 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0. |
CVE-2023-29408 | Medium | 6.5 | 2023-08-02 | The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms… |
CVE-2022-46485 | High | 7.5 | 2023-08-02 | Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment Fiel… |
CVE-2023-4011 | Medium | 4.3 | 2023-08-02 | An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resultin… |
CVE-2023-4046 | Medium | 5.3 | 2023-08-01 | In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially… |
CVE-2023-38684 | Medium | 5.3 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-38498 | Medium | 4.3 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-37906 | Medium | 4.3 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-38492 | Medium | 5.3 | 2023-07-27 | Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user acco… |
CVE-2023-37900 | Low | 3.4 | 2023-07-27 | Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privi… |
CVE-2023-3242 | High | 8.6 | 2023-07-26 | Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated network-based attackers… |
CVE-2023-32481 | Medium | 4.9 | 2023-07-20 | Wyse Management Suite versions prior to 4.0 contain a denial-of-service vulnerability. An authenticated malicious user can flood the configured SMTP server wi… |
CVE-2023-38405 | High | 7.5 | 2023-07-17 | On Crestron 3-Series Control Systems before 1.8001.0187, crafting and sending a specific BACnet packet can cause a crash. |
CVE-2023-29449 | Medium | 5.9 | 2023-07-13 | JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configu… |
CVE-2023-36521 | High | 8.6 | 2023-07-11 | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4… |
CVE-2023-3566 | Low | 3.5 | 2023-07-10 | A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /confi… |
CVE-2023-27540 | Medium | 5.9 | 2023-07-10 | IBM Watson CP4D Data Stores 4.6.0 does not properly allocate resources without limits or throttling which could allow a remote attacker with information specif… |
CVE-2023-36461 | High | 7.5 | 2023-07-06 | Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read o… |
CVE-2023-36814 | High | 7.5 | 2023-07-03 | Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input i… |
CVE-2023-34450 | Low | 3.7 | 2023-07-03 | CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine and replicates it on many machines. An internal modification made… |
CVE-2023-21176 | Medium | 4.4 | 2023-06-28 | In list_key_entries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local denial of service wit… |
CVE-2023-20108 | High | 7.5 | 2023-06-28 | A vulnerability in the XCP Authentication Service of the Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an un… |
CVE-2023-32385 | Medium | 5.5 | 2023-06-23 | A denial-of-service issue was addressed with improved memory handling. This issue is fixed in iOS 16.5 and iPadOS 16.5, macOS Ventura 13.4. Opening a PDF file… |
CVE-2023-34462 | Medium | 6.5 | 2023-06-22 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `Sni… |
CVE-2023-36357 | High | 7.7 | 2023-06-22 | An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackers to cause a Denial… |
CVE-2023-36371 | High | 7.5 | 2023-06-22 | An issue in the GDKfree component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36370 | High | 7.5 | 2023-06-22 | An issue in the gc_col component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36369 | High | 7.5 | 2023-06-22 | An issue in the list_append component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36368 | High | 7.5 | 2023-06-22 | An issue in the cs_bind_ubat component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36367 | High | 7.5 | 2023-06-22 | An issue in the BLOBcmp component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-36366 | High | 7.5 | 2023-06-22 | An issue in the log_create_delta component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause Denial of Service (DoS) via crafted SQL statement… |
CVE-2023-36365 | High | 7.5 | 2023-06-22 | An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL state… |
CVE-2023-2828 | High | 7.5 | 2023-06-21 | Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to author… |
CVE-2023-34166 | High | 7.5 | 2023-06-19 | Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerability may cause the system to restart. |
CVE-2022-48498 | High | 7.5 | 2023-06-19 | Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability. |
CVE-2023-30903 | Medium | 5.5 | 2023-06-16 | HP-UX could be exploited locally to create a Denial of Service (DoS) when any physical interface is configured with IPv6/inet6. |
CVE-2023-21144 | High | 7.5 | 2023-06-15 | In doInBackground of NotificationContentInflater.java, there is a possible temporary denial or service due to long running operations. This could lead to remot… |
CVE-2023-34455 | High | 7.5 | 2023-06-15 | snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1… |
CVE-2023-35116 | Medium | 4.7 | 2023-06-14 | jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. N… |
CVE-2023-34396 | Medium | 4.3 | 2023-06-14 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30… |
CVE-2023-34149 | Medium | 4.3 | 2023-06-14 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30… |
CVE-2023-29767 | Medium | 5.5 | 2023-06-09 | An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files. |
CVE-2023-0121 | Medium | 6.5 | 2023-06-07 | A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15… |
CVE-2023-2253 | Medium | 6.5 | 2023-06-06 | A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (quer… |
CVE-2023-0921 | Medium | 4.3 | 2023-06-06 | A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticate… |
CVE-2022-48441 | Medium | 5.5 | 2023-06-06 | In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2022-48440 | Medium | 5.5 | 2023-06-06 | In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges. |
CVE-2023-23603 | Medium | 6.5 | 2023-06-02 | Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting for external URLs. Da… |
CVE-2023-0616 | Medium | 6.5 | 2023-06-02 | If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause T… |
CVE-2023-32699 | Medium | 6.5 | 2023-05-30 | MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. The `checkUserPassword` method is used… |
CVE-2023-33656 | Medium | 5.5 | 2023-05-30 | A memory leak vulnerability exists in NanoMQ 0.17.2. The vulnerability is located in the file message.c. An attacker could exploit this vulnerability to cause… |
CVE-2023-29737 | Medium | 5.5 | 2023-05-30 | An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause a denial of service via the database files. |
CVE-2023-2650 | Medium | 6.5 | 2023-05-30 | Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_… |
CVE-2023-33720 | Medium | 6.5 | 2023-05-26 | mp4v2 v2.1.2 was discovered to contain a memory leak via the class MP4BytesProperty. |
CVE-2023-21110 | High | 7.8 | 2023-05-15 | In several functions of SnoozeHelper.java, there is a possible way to grant notifications access due to resource exhaustion. This could lead to local escalatio… |
CVE-2023-20930 | Medium | 5.5 | 2023-05-15 | In pushDynamicShortcut of ShortcutPackage.java, there is a possible way to get the device into a boot loop due to resource exhaustion. This could lead to local… |
CVE-2023-31914 | Medium | 5.5 | 2023-05-12 | Jerryscript 3.0 (commit 05dbbd1) was discovered to contain out-of-memory issue in malloc. |
CVE-2023-2666 | High | 7.5 | 2023-05-12 | Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16. |
CVE-2023-28356 | High | 7.5 | 2023-05-11 | A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enter a hot loop on one… |
CVE-2023-25568 | High | 8.2 | 2023-05-10 | Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able alloca… |
CVE-2021-46760 | Critical | 9.8 | 2023-05-09 | A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access that may potentia… |
CVE-2023-31472 | High | 7.5 | 2023-05-09 | An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. Thi… |
CVE-2023-27958 | Critical | 9.1 | 2023-05-08 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A remote user ma… |
CVE-2023-30551 | High | 7.5 | 2023-05-08 | Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading… |
CVE-2023-26285 | Medium | 5.9 | 2023-05-05 | IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow a remote attacker to cause a denial of service due to an error processing invalid data. IBM X-Force ID… |
CVE-2023-30455 | High | 7.5 | 2023-04-28 | An issue was discovered in ebankIT before 7. A Denial-of-Service attack is possible through the GET parameter EStatementsIds located on the /Controls/Generic/E… |
CVE-2023-28882 | High | 7.5 | 2023-04-28 | Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in t… |
CVE-2023-27556 | Medium | 6.5 | 2023-04-28 | IBM Counter Fraud Management for Safer Payments 6.1.0.00, 6.2.0.00, 6.3.0.00 through 6.3.1.03, 6.4.0.00 through 6.4.2.02 and 6.5.0.00 does not properly allocat… |
CVE-2023-29779 | High | 7.5 | 2023-04-25 | Sengled Dimmer Switch V0.0.9 contains a denial of service (DOS) vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable… |
CVE-2023-30408 | Medium | 5.5 | 2023-04-24 | Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry. |
CVE-2023-30406 | Medium | 5.5 | 2023-04-24 | Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c. |
CVE-2023-29479 | Medium | 5.3 | 2023-04-24 | Ribose RNP before 0.16.3 may hang when the input is malformed. |
CVE-2023-29570 | Medium | 5.5 | 2023-04-24 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_ffi_cb_free at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (Do… |
CVE-2023-29575 | Medium | 5.5 | 2023-04-21 | Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component. |
CVE-2023-0383 | High | 7.5 | 2023-04-20 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption. |
CVE-2023-26048 | Medium | 5.3 | 2023-04-18 | Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `H… |
CVE-2023-28968 | Medium | 5.3 | 2023-04-17 | An Improperly Controlled Sequential Memory Allocation vulnerability in the Juniper Networks Deep Packet Inspection-Decoder (JDPI-Decoder) Application Signature… |
CVE-2018-15472 | High | 7.5 | 2023-04-15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The diff formatter using roug… |
CVE-2023-27653 | High | 7.5 | 2023-04-14 | An issue found in WHOv.1.0.28, v.1.0.30, v.1.0.32 allows an attacker to cause a denial of service via the SharedPreference files. |
CVE-2023-27643 | High | 7.5 | 2023-04-14 | An issue found in POWERAMP 925-bundle-play and Poweramp 954-uni allows a remote attacker to cause a denial of service via the Rescan button in Queue and Select… |
CVE-2023-30636 | High | 7.5 | 2023-04-13 | TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error, with RpcStatus UNAVAILABLE for "not leader") upon an attempt to start a node in a… |
CVE-2023-29573 | Medium | 5.5 | 2023-04-13 | Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component. |
CVE-2023-25414 | Medium | 5.3 | 2023-04-11 | Aten PE8108 2.4.232 is vulnerable to denial of service (DOS). |
CVE-2023-26964 | High | 7.5 | 2023-04-11 | An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and… |
CVE-2022-43768 | High | 7.5 | 2023-04-11 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) (All versions… |
CVE-2023-27191 | High | 7.5 | 2023-04-11 | An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files. |
CVE-2023-24536 | High | 7.5 | 2023-04-06 | Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several… |
CVE-2023-0382 | Medium | 6.5 | 2023-04-05 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption. |
CVE-2023-27492 | Medium | 4.8 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the Lua fi… |