CWE-770 · Allocation of Resources Without Limits or Throttling (page 19)
Page 19 of 22 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-9059 | Medium | 6.5 | 2022-01-10 | Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resource consumption leading to battery exhaus… |
CVE-2021-43045 | High | 7.5 | 2022-01-06 | A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue a… |
CVE-2021-28715 | Medium | 6.5 | 2022-01-06 | Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspec… |
CVE-2021-28714 | Medium | 6.5 | 2022-01-06 | Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspec… |
CVE-2021-44591 | Medium | 6.5 | 2022-01-06 | In libming 0.4.8, the parseSWF_DEFINELOSSLESS2 function in util/parser.c lacks a boundary check that would lead to denial-of-service attacks via a crafted SWF… |
CVE-2021-44590 | Medium | 6.5 | 2022-01-06 | In libming 0.4.8, a memory exhaustion vulnerability exist in the function cws2fws in util/main.c. Remote attackers could launch denial of service attacks by su… |
CVE-2021-37111 | High | 7.5 | 2022-01-03 | There is a Memory leakage vulnerability in Smartphone.Successful exploitation of this vulnerability may cause memory exhaustion. |
CVE-2021-45699 | High | 7.5 | 2021-12-27 | An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by trig… |
CVE-2020-35210 | Medium | 6.5 | 2021-12-16 | A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages. |
CVE-2021-38244 | High | 7.5 | 2021-12-16 | A regular expression denial of service (ReDoS) vulnerability exits in cbioportal 3.6.21 and older via a POST request to /ProteinArraySignificanceTest.json. |
CVE-2021-31787 | Medium | 6.5 | 2021-11-30 | The Bluetooth Classic implementation on Actions ATS2815 chipsets does not properly handle the reception of continuous unsolicited LMP responses, allowing attac… |
CVE-2021-28706 | High | 8.6 | 2021-11-24 | guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its… |
CVE-2021-29329 | High | 7.8 | 2021-11-19 | OpenSource Moddable v10.5.0 was discovered to contain a stack overflow in the fxBinaryExpressionNodeDistribute function at /moddable/xs/sources/xsTree.c. |
CVE-2021-29324 | High | 7.8 | 2021-11-19 | OpenSource Moddable v10.5.0 was discovered to contain a stack overflow via the component /moddable/xs/sources/xsScript.c. |
CVE-2021-3912 | Medium | 4.2 | 2021-11-11 | OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a reposi… |
CVE-2021-39912 | Medium | 5.3 | 2021-11-05 | A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7. Using a malformed TIFF images was possible to trigger memory exhaustio… |
CVE-2021-39907 | Medium | 5.3 | 2021-11-05 | A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from certain images resulted in high CPU us… |
CVE-2021-34741 | High | 7.5 | 2021-11-04 | A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attac… |
CVE-2021-36174 | Medium | 4.3 | 2021-11-02 | A memory allocation with excessive size value vulnerability in the license verification function of FortiPortal before 6.0.6 may allow an attacker to perform a… |
CVE-2021-1121 | Medium | 5.5 | 2021-10-29 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager kernel driver, where a vGPU can cause resource starvation among other vGPUs hosted on… |
CVE-2021-22461 | Medium | 5.5 | 2021-10-28 | A component of the HarmonyOS has a Allocation of Resources Without Limits or Throttling vulnerability. Local attackers may exploit this vulnerability to cause… |
CVE-2021-40114 | Medium | 6.8 | 2021-10-27 | Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remot… |
CVE-2021-34854 | High | 7.8 | 2021-10-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain t… |
CVE-2021-38465 | High | 8.0 | 2021-10-22 | The webinstaller is a Golang web server executable that enables the generation of an Auvesy image agent. Resource consumption can be achieved by generating lar… |
CVE-2021-38463 | High | 7.3 | 2021-10-22 | The affected product does not properly control the allocation of resources. A user may be able to allocate unlimited memory buffers using API functions. |
CVE-2021-41167 | High | 7.5 | 2021-10-20 | modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two… |
CVE-2021-31369 | Medium | 5.3 | 2021-10-19 | On MX Series platforms with MS-MPC/MS-MIC, an Allocation of Resources Without Limits or Throttling vulnerability in Juniper Networks Junos OS allows an unauthe… |
CVE-2021-41546 | High | 7.5 | 2021-10-12 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All… |
CVE-2021-41800 | Medium | 5.3 | 2021-10-11 | MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometime… |
CVE-2021-41799 | High | 7.5 | 2021-10-11 | MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). ApiQueryBacklinks (action=query&list=backli… |
CVE-2021-34735 | High | 8.8 | 2021-10-06 | Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injection attack resulting… |
CVE-2021-34710 | High | 8.8 | 2021-10-06 | Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injection attack resulting… |
CVE-2021-35492 | Medium | 6.5 | 2021-10-05 | Wowza Streaming Engine through 4.8.11+5 could allow an authenticated, remote attacker to exhaust filesystem resources via the /enginemanager/server/vhost/histo… |
CVE-2021-32675 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory acco… |
CVE-2021-41593 | High | 8.6 | 2021-10-04 | Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure. |
CVE-2021-41592 | Critical | 9.4 | 2021-10-04 | Blockstream c-lightning through 0.10.1 allows loss of funds because of dust HTLC exposure. |
CVE-2021-41591 | Critical | 9.4 | 2021-10-04 | ACINQ Eclair before 0.6.3 allows loss of funds because of dust HTLC exposure. |
CVE-2021-34415 | High | 7.5 | 2021-09-27 | The Zone Controller service in the Zoom On-Premise Meeting Connector Controller before version 4.6.358.20210205 does not verify the cnt field sent in incoming… |
CVE-2021-0424 | Medium | 5.5 | 2021-09-27 | In memory management driver, there is a possible system crash due to a missing bounds check. This could lead to local denial of service with no additional exec… |
CVE-2021-0422 | Medium | 5.5 | 2021-09-27 | In memory management driver, there is a possible system crash due to a missing bounds check. This could lead to local denial of service with no additional exec… |
CVE-2021-29763 | Medium | 5.1 | 2021-09-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 under very specific conditions, could allow a local user to keep running a proc… |
CVE-2021-23053 | Medium | 5.3 | 2021-09-14 | On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP Advanced WAF or BIG-IP A… |
CVE-2021-33011 | Medium | 4.3 | 2021-09-10 | All versions of the afffected TOYOPUC-PC10 Series,TOYOPUC-Plus Series,TOYOPUC-PC3J/PC2J Series, TOYOPUC-Nano Series products may not be able to properly proces… |
CVE-2021-37629 | Medium | 5.3 | 2021-09-07 | Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint… |
CVE-2021-33831 | Medium | 6.5 | 2021-09-07 | api/account/register in the TH Wildau COVID-19 Contact Tracing application through 2021-09-01 has Incorrect Access Control. An attacker can interfere with trac… |
CVE-2021-22029 | High | 7.5 | 2021-08-31 | VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/system/admins/session could cause an API de… |
CVE-2021-28700 | Medium | 4.9 | 2021-08-27 | xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunate… |
CVE-2021-1592 | Medium | 4.3 | 2021-08-25 | A vulnerability in the way Cisco UCS Manager software handles SSH sessions could allow an authenticated, remote attacker to cause a denial of service (DoS) con… |
CVE-2018-10790 | High | 7.5 | 2021-08-25 | The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), related to a memory… |
CVE-2021-22246 | High | 7.7 | 2021-08-20 | A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abused to perform denial of service attacks. |
CVE-2020-18899 | Medium | 6.5 | 2021-08-19 | An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a cr… |
CVE-2021-0420 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible system crash due to a missing bounds check. This could lead to local denial of service with no additional exec… |
CVE-2021-32068 | Low | 3.7 | 2021-08-13 | The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple s… |
CVE-2021-36798 | High | 7.5 | 2021-08-09 | A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. It allows remote attackers to crash the C2 serv… |
CVE-2021-22919 | High | 7.5 | 2021-08-05 | A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN… |
CVE-2021-33320 | Medium | 4.3 | 2021-08-03 | The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit… |
CVE-2020-19464 | Medium | 5.5 | 2021-07-21 | An issue has been found in function XRef::fetch in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a stack overflow . |
CVE-2020-19463 | Medium | 5.5 | 2021-07-21 | An issue has been found in function vfprintf in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a stack overflow. |
CVE-2021-33910 | Medium | 5.5 | 2021-07-20 | basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a… |
CVE-2021-0285 | High | 7.5 | 2021-07-15 | An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker sending large a… |
CVE-2021-29725 | High | 7.5 | 2021-07-15 | IBM Secure External Authentication Server 2.4.3.2, 6.0.1, 6.0.2 and IBM Secure Proxy 3.4.3.2, 6.0.1, 6.0.2 could allow a remote user to consume resources causi… |
CVE-2021-25671 | Medium | 4.3 | 2021-07-13 | A vulnerability has been identified in RWG1.M12 (All versions < V1.16.16), RWG1.M12D (All versions < V1.16.16), RWG1.M8 (All versions < V1.16.16). Sending spec… |
CVE-2020-28400 | High | 7.5 | 2021-07-13 | Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerability can be triggered i… |
CVE-2021-35517 | High | 7.5 | 2021-07-13 | When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for ve… |
CVE-2021-35516 | High | 7.5 | 2021-07-13 | When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for ver… |
CVE-2021-36155 | High | 7.5 | 2021-07-09 | LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier allocates buffers of arbitrary length, which allows remote attackers to cause uncontrolled resource… |
CVE-2021-3637 | High | 7.5 | 2021-07-09 | A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boun… |
CVE-2020-28200 | Medium | 4.3 | 2021-06-28 | The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the re… |
CVE-2021-33541 | High | 7.5 | 2021-06-25 | Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protoc… |
CVE-2021-32699 | Medium | 6.5 | 2021-06-22 | Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vulnerable t… |
CVE-2021-22363 | High | 7.5 | 2021-06-22 | There is a resource management error vulnerability in eCNS280_TD V100R005C10SPC650. An attacker needs to perform specific operations to exploit the vulnerabili… |
CVE-2021-29063 | High | 7.5 | 2021-06-21 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called. |
CVE-2021-29061 | High | 7.5 | 2021-06-21 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Vfsjfilechooser2 version 0.2.9 and below which occurs when the application attem… |
CVE-2021-29060 | Medium | 5.3 | 2021-06-21 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provid… |
CVE-2021-29059 | High | 7.5 | 2021-06-21 | A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is pro… |
CVE-2021-31811 | Medium | 5.5 | 2021-06-12 | In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and… |
CVE-2021-33176 | High | 7.5 | 2021-06-08 | VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of un… |
CVE-2021-33175 | High | 7.5 | 2021-06-08 | EMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted… |
CVE-2021-28848 | High | 7.5 | 2021-06-03 | Mintty before 3.4.5 allows remote servers to cause a denial of service (Windows GUI hang) by telling the Mintty window to change its title repeatedly at high s… |
CVE-2020-14336 | Medium | 6.5 | 2021-06-02 | A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allows an attacker to ca… |
CVE-2021-22360 | Medium | 4.9 | 2021-05-27 | There is a resource management error vulnerability in the verisions V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 of USG9500. An authentication attac… |
CVE-2021-3527 | Medium | 5.5 | 2021-05-26 | A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead… |
CVE-2021-21000 | Medium | 5.3 | 2021-05-24 | On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of servic… |
CVE-2021-29511 | Medium | 6.5 | 2021-05-12 | evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use `e… |
CVE-2021-27383 | High | 7.5 | 2021-05-12 | A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI C… |
CVE-2021-22210 | Medium | 5.3 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, GitLab was ignoring… |
CVE-2020-22785 | High | 7.5 | 2021-04-28 | Etherpad < 1.8.3 is affected by a missing lock check which could cause a denial of service. Aggressively targeting random pad import endpoints with empty data… |
CVE-2021-22207 | Medium | 5.5 | 2021-04-23 | Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injection or crafted captu… |
CVE-2021-0261 | High | 7.5 | 2021-04-22 | A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Ca… |
CVE-2021-0242 | Medium | 6.5 | 2021-04-22 | A vulnerability due to the improper handling of direct memory access (DMA) buffers on EX4300 switches on Juniper Networks Junos OS allows an attacker sending s… |
CVE-2021-0224 | Medium | 6.5 | 2021-04-22 | A vulnerability in the handling of internal resources necessary to bring up a large number of Layer 2 broadband remote access subscriber (BRAS) nodes in Junipe… |
CVE-2021-29453 | Medium | 5.7 | 2021-04-19 | matrix-media-repo is an open-source multi-domain media repository for Matrix. Versions 1.2.6 and earlier of matrix-media-repo do not properly handle malicious… |
CVE-2021-29430 | High | 7.5 | 2021-04-15 | Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP req… |
CVE-2021-29932 | High | 7.5 | 2021-04-01 | An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service (CPU and memory consumption)… |
CVE-2021-28994 | High | 7.5 | 2021-03-31 | kopano-ical (formerly zarafa-ical) in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x t… |
CVE-2021-3479 | Medium | 5.5 | 2021-03-31 | There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenE… |
CVE-2021-3478 | Medium | 5.5 | 2021-03-31 | There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenE… |
CVE-2020-24994 | High | 8.8 | 2021-03-23 | Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code exec… |
CVE-2021-28302 | High | 7.5 | 2021-03-12 | A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a chi… |
CVE-2021-28038 | Medium | 6.5 | 2021-03-05 | An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such… |