CWE-770 · Allocation of Resources Without Limits or Throttling (page 20)
Page 20 of 22 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21274 | Medium | 4.3 | 2021-02-26 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2020-28491 | High | 7.5 | 2021-02-18 | This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked alloca… |
CVE-2021-22174 | Low | 3.7 | 2021-02-17 | Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file |
CVE-2021-26931 | Medium | 5.5 | 2021-02-17 | An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, delibera… |
CVE-2021-0338 | Medium | 5.5 | 2021-02-10 | In SystemSettingsValidators, there is a possible permanent denial of service due to missing bounds checks on UI settings. This could lead to local denial of se… |
CVE-2021-25666 | Medium | 4.3 | 2021-02-09 | A vulnerability has been identified in SCALANCE W780 and W740 (IEEE 802.11n) family (All versions < V6.3). Sending specially crafted packets through the ARP pr… |
CVE-2020-24685 | High | 8.6 | 2021-02-09 | An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service (DoS) vulnerability. Vulnerability allows attac… |
CVE-2021-21294 | High | 7.5 | 2021-02-02 | Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnera… |
CVE-2021-21293 | High | 7.5 | 2021-02-02 | blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by… |
CVE-2021-20185 | Medium | 5.3 | 2021-01-28 | It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result… |
CVE-2021-1350 | Medium | 5.3 | 2021-01-20 | A vulnerability in the web UI of Cisco Umbrella could allow an unauthenticated, remote attacker to negatively affect the performance of this service. The vulne… |
CVE-2021-25173 | High | 7.8 | 2021-01-18 | An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vulnerability exists when reading malforme… |
CVE-2021-0217 | High | 7.4 | 2021-01-15 | A vulnerability in processing of certain DHCP packets from adjacent clients on EX Series and QFX Series switches running Juniper Networks Junos OS with DHCP lo… |
CVE-2021-21607 | Medium | 6.5 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request cra… |
CVE-2021-1057 | High | 7.8 | 2021-01-08 | NVIDIA Virtual GPU Manager NVIDIA vGPU manager contains a vulnerability in the vGPU plugin in which it allows guests to allocate some resources for which the g… |
CVE-2020-36049 | High | 7.5 | 2021-01-08 | socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used. |
CVE-2020-35896 | High | 7.5 | 2020-12-31 | An issue was discovered in the ws crate through 2020-09-25 for Rust. The outgoing buffer is not properly limited, leading to a remote memory-consumption attack. |
CVE-2020-5806 | Medium | 5.5 | 2020-12-29 | An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequest in messaging.dll… |
CVE-2020-5802 | High | 7.5 | 2020-12-29 | An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specially crafted ConfigureItems message to TC… |
CVE-2020-35359 | High | 7.5 | 2020-12-26 | Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit. |
CVE-2020-24658 | High | 7.8 | 2020-12-24 | Arm Compiler 5 through 5.06u6 has an error in a stack protection feature designed to help spot stack-based buffer overflows in local arrays. When this feature… |
CVE-2020-29487 | High | 7.5 | 2020-12-15 | An issue was discovered in Xen XAPI before 2020-12-15. Certain xenstore keys provide feedback from the guest, and are therefore watched by toolstack. Specifica… |
CVE-2020-29486 | Medium | 6.0 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Nodes in xenstore have an ownership. In oxenstored, a owner could give a node away. However, node ownership has… |
CVE-2020-29570 | Medium | 6.2 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into the control block is… |
CVE-2020-29568 | Medium | 6.5 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events… |
CVE-2020-29567 | Medium | 6.2 | 2020-12-15 | An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of IRQ handling, IRQ vectors are dynamically allocated and de-alloc… |
CVE-2020-27029 | Medium | 6.5 | 2020-12-15 | In TextView of TextView.java, there is a possible app hang due to improper input validation. This could lead to remote denial of service with no additional exe… |
CVE-2020-25652 | Medium | 5.5 | 2020-11-26 | A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in `/run/… |
CVE-2020-25650 | Medium | 5.5 | 2020-11-25 | A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user wit… |
CVE-2020-8037 | High | 7.5 | 2020-11-04 | The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. |
CVE-2020-28030 | High | 7.5 | 2020-11-02 | In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset a… |
CVE-2020-27978 | High | 7.5 | 2020-10-28 | Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhau… |
CVE-2020-25648 | High | 7.5 | 2020-10-20 | A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a… |
CVE-2020-27173 | High | 7.5 | 2020-10-16 | In vm-superio before 0.1.1, the serial console FIFO can grow to unlimited memory usage when data is sent to the input source (i.e., standard input). This behav… |
CVE-2020-13342 | Low | 2.7 | 2020-10-07 | An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email |
CVE-2020-5982 | Medium | 4.4 | 2020-10-02 | NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) scheduler, in which the software does not pro… |
CVE-2020-15213 | Medium | 4.0 | 2020-09-25 | In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a denial of service by causing an out of memory allocation in the impl… |
CVE-2020-3569 | High | 8.6 | 2020-09-23 | Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote atta… |
CVE-2020-0353 | Medium | 6.5 | 2020-09-17 | In libmp4extractor, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execu… |
CVE-2020-10758 | High | 7.5 | 2020-09-16 | A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, al… |
CVE-2020-13306 | Low | 3.7 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attack… |
CVE-2020-15168 | Low | 2.6 | 2020-09-10 | node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the l… |
CVE-2020-3566 | High | 8.6 | 2020-08-29 | A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to e… |
CVE-2020-8203 | High | 7.4 | 2020-07-15 | Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. |
CVE-2020-15100 | Low | 2.8 | 2020-07-14 | In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been patched in 0.1.1. |
CVE-2020-15570 | Medium | 5.5 | 2020-07-06 | The parse_report() function in whoopsie.c in Whoopsie through 0.2.69 mishandles memory allocation failures, which allows an attacker to cause a denial of servi… |
CVE-2020-12605 | High | 7.5 | 2020-07-01 | Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with… |
CVE-2020-9494 | High | 7.5 | 2020-06-24 | Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to… |
CVE-2017-18899 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting. |
CVE-2019-20880 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a denial of service (memory consumption) via… |
CVE-2019-20845 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a large Slack import. |
CVE-2020-14405 | Medium | 6.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size. |
CVE-2020-13250 | High | 7.5 | 2020-06-11 | HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of… |
CVE-2020-0160 | High | 8.8 | 2020-06-11 | In setSyncSampleParams of SampleTable.cpp, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service wit… |
CVE-2020-10705 | High | 7.5 | 2020-06-10 | A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memor… |
CVE-2019-20818 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows memory consumption because data is created for each page of an application level. |
CVE-2019-20814 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.12. It allows memory consumption because data is created for each page of an application level. |
CVE-2020-13114 | High | 7.5 | 2020-05-21 | An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of comp… |
CVE-2020-12697 | Medium | 5.3 | 2020-05-13 | The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries. |
CVE-2020-10717 | Low | 3.3 | 2020-05-04 | A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs is meant to share a… |
CVE-2019-15234 | High | 7.5 | 2020-04-27 | SHAREit through 4.0.6.177 does not check the full message length from the received packet header (which is used to allocate memory for the next set of data). T… |
CVE-2019-14941 | High | 7.5 | 2020-04-27 | SHAREit through 4.0.6.177 does not check the body length from the received packet header (which is used to allocate memory for the next set of data). This coul… |
CVE-2020-11612 | High | 7.5 | 2020-04-07 | The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large Zl… |
CVE-2020-8552 | Medium | 5.3 | 2020-03-27 | The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack… |
CVE-2020-8551 | Medium | 4.3 | 2020-03-27 | The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet… |
CVE-2020-10364 | High | 7.5 | 2020-03-23 | The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and ca… |
CVE-2020-9345 | Medium | 6.5 | 2020-03-20 | An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. It is possible to perform a Denial of Service att… |
CVE-2019-11939 | High | 7.5 | 2020-03-18 | Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients co… |
CVE-2019-3553 | High | 7.5 | 2020-03-10 | C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could… |
CVE-2019-11938 | High | 7.5 | 2020-03-10 | Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients coul… |
CVE-2020-8659 | High | 7.5 | 2020-03-04 | CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks. |
CVE-2018-21035 | High | 7.5 | 2020-02-28 | In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier… |
CVE-2019-4720 | High | 7.5 | 2020-01-31 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker… |
CVE-2020-7219 | High | 7.5 | 2020-01-31 | HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of servic… |
CVE-2020-7218 | High | 7.5 | 2020-01-31 | HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service… |
CVE-2020-8416 | High | 7.5 | 2020-01-29 | IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port. |
CVE-2020-7052 | Medium | 6.5 | 2020-01-24 | CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition. |
CVE-2020-7226 | High | 7.5 | 2020-01-24 | CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode o… |
CVE-2020-6610 | Medium | 6.5 | 2020-01-08 | GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read_sections_map in decode_r2007.c. |
CVE-2019-14834 | Low | 3.7 | 2020-01-07 | A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory consumption) via v… |
CVE-2019-20019 | Medium | 6.5 | 2019-12-27 | An attempted excessive memory allocation was discovered in Mat_VarRead5 in mat5.c in matio 1.5.17. |
CVE-2019-20015 | Medium | 6.5 | 2019-12-27 | An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_LWPOLYLINE_private in dwg.spec. |
CVE-2019-20013 | Medium | 6.5 | 2019-12-27 | An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in decode_3dsolid in dwg.spec. |
CVE-2019-20012 | Medium | 6.5 | 2019-12-27 | An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_HATCH_private in dwg.spec. |
CVE-2019-20009 | Medium | 6.5 | 2019-12-27 | An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_SPLINE_private in dwg.sp… |
CVE-2019-19958 | Medium | 6.5 | 2019-12-24 | In libIEC61850 1.4.0, StringUtils_createStringFromBuffer in common/string_utilities.c has an integer signedness issue that could lead to an attempted excessive… |
CVE-2019-16770 | Medium | 5.3 | 2019-12-05 | In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service atta… |
CVE-2019-11923 | High | 7.5 | 2019-12-04 | In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced, allowing for reso… |
CVE-2019-15593 | Medium | 6.5 | 2019-11-22 | GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Commen… |
CVE-2019-12406 | Medium | 6.5 | 2019-11-06 | Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial… |
CVE-2019-6120 | High | 7.5 | 2019-11-06 | An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a larg… |
CVE-2019-5043 | High | 7.5 | 2019-10-31 | An exploitable denial-of-service vulnerability exists in the Weave daemon of the Nest Cam IQ Indoor, version 4620002. A set of TCP connections can cause unrest… |
CVE-2019-10079 | High | 7.5 | 2019-10-22 | Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent f… |
CVE-2019-12611 | Medium | 4.4 | 2019-10-17 | An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reliability of the product. Specially crafted packets… |
CVE-2019-17583 | High | 7.5 | 2019-10-14 | idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonstrated by the adminc… |
CVE-2018-5743 | High | 7.5 | 2019-10-09 | By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable paramete… |
CVE-2019-17359 | High | 7.5 | 2019-10-08 | The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted… |
CVE-2019-17351 | Medium | 6.5 | 2019-10-08 | An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of… |
CVE-2019-16865 | High | 7.5 | 2019-10-04 | An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memor… |
CVE-2019-15165 | Medium | 5.3 | 2019-10-03 | sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. |