CWE-770 · Allocation of Resources Without Limits or Throttling (page 20)
Page 20 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28837 | Medium | 4.9 | 2023-04-03 | Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of… |
CVE-2022-48357 | High | 7.5 | 2023-03-27 | Some products have the double fetch vulnerability. Successful exploitation of this vulnerability may cause denial of service (DoS) attacks to the kernel. |
CVE-2022-46416 | Critical | 9.1 | 2023-03-27 | Parrot Bebop 4.7.1. allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker… |
CVE-2023-28867 | High | 7.5 | 2023-03-27 | In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4… |
CVE-2023-1544 | Medium | 6.0 | 2023-03-23 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge numb… |
CVE-2023-20067 | High | 7.4 | 2023-03-23 | A vulnerability in the HTTP-based client profiling feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjacen… |
CVE-2023-28119 | High | 7.5 | 2023-03-22 | The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` d… |
CVE-2022-42334 | Medium | 6.5 | 2023-03-21 | x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… |
CVE-2022-42333 | High | 8.6 | 2023-03-21 | x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… |
CVE-2023-28428 | Medium | 6.2 | 2023-03-20 | PDFio is a C library for reading and writing PDF files. In versions 1.1.0 and prior, a denial of service vulnerability exists in the pdfio parser. Crafted pdf… |
CVE-2021-46877 | High | 7.5 | 2023-03-18 | jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read… |
CVE-2023-28107 | Medium | 4.5 | 2023-03-17 | Discourse is an open-source discussion platform. Prior to version 3.0.2 of the `stable` branch and version 3.1.0.beta3 of the `beta` and `tests-passed` branche… |
CVE-2023-28104 | High | 7.5 | 2023-03-16 | `silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql quer… |
CVE-2023-28338 | High | 7.5 | 2023-03-15 | Any request send to a Netgear Nighthawk Wifi6 Router (RAX30)'s web service containing a “Content-Type” of “multipartboundary=” will result in the request body… |
CVE-2023-27596 | High | 7.5 | 2023-03-15 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, OpenSIPS crashes when a malformed SDP body is sent mu… |
CVE-2023-27530 | High | 7.5 | 2023-03-10 | A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to… |
CVE-2023-27901 | High | 7.5 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introdu… |
CVE-2023-27900 | High | 7.5 | 2023-03-10 | Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introdu… |
CVE-2022-41727 | Medium | 5.5 | 2023-02-28 | An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of serv… |
CVE-2022-41725 | High | 7.5 | 2023-02-28 | A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm… |
CVE-2023-23916 | Medium | 6.5 | 2023-02-23 | An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that… |
CVE-2022-31394 | High | 7.5 | 2023-02-21 | Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform… |
CVE-2023-26249 | High | 7.5 | 2023-02-21 | Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of service. Specificall… |
CVE-2021-32848 | High | 7.5 | 2023-02-20 | Octobox is software for managing GitHub notifications. Prior to pull request (PR) 2807, a user of the system can provide a specifically crafted search query st… |
CVE-2023-25656 | High | 7.5 | 2023-02-20 | notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users… |
CVE-2023-24998 | High | 7.5 | 2023-02-20 | Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS wi… |
CVE-2023-24785 | Medium | 5.5 | 2023-02-17 | An issue in Giorgio Tani peazip v.9.0.0 allows attackers to cause a denial of service via the End of Archive tag function of the peazip/pea UNPEA feature. |
CVE-2023-25153 | Medium | 6.2 | 2023-02-16 | containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read… |
CVE-2023-0568 | High | 7.5 | 2023-02-16 | In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths… |
CVE-2023-25578 | High | 7.5 | 2023-02-15 | Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 1.5.2, the request body parsing in `starlite` allows a potentially unau… |
CVE-2023-25171 | High | 7.5 | 2023-02-15 | Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service atta… |
CVE-2023-25156 | High | 7.5 | 2023-02-15 | Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks ag… |
CVE-2023-25577 | High | 7.5 | 2023-02-14 | Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts… |
CVE-2023-25576 | High | 7.5 | 2023-02-14 | @fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of serv… |
CVE-2023-25193 | High | 7.5 | 2023-02-04 | hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base… |
CVE-2023-23969 | High | 7.5 | 2023-02-01 | In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsi… |
CVE-2023-22323 | High | 7.5 | 2023-02-01 | In BIP-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when OCSP authen… |
CVE-2023-23846 | High | 7.5 | 2023-02-01 | Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headers in GPRS tunneling… |
CVE-2023-22740 | Medium | 4.3 | 2023-01-27 | Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Allocation of Resources W… |
CVE-2023-22739 | Medium | 6.5 | 2023-01-26 | Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-passed) are subject… |
CVE-2022-20494 | Medium | 5.5 | 2023-01-26 | In AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion. This could lead to local denial of service with no… |
CVE-2022-20492 | High | 7.8 | 2023-01-26 | In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local es… |
CVE-2022-20490 | High | 7.8 | 2023-01-26 | In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to loca… |
CVE-2022-20489 | High | 7.8 | 2023-01-26 | In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local es… |
CVE-2022-20456 | High | 7.8 | 2023-01-26 | In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local… |
CVE-2023-20047 | Medium | 6.5 | 2023-01-20 | A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco Webex Room Phone and Cisco Webex Share devices could allow an unauthenticated, adj… |
CVE-2021-36630 | High | 7.5 | 2023-01-18 | DDOS reflection amplification vulnerability in eAut module of Ruckus Wireless SmartZone controller that allows remote attackers to perform DOS attacks via craf… |
CVE-2023-22403 | High | 7.5 | 2023-01-13 | An Allocation of Resources Without Limits or Throttling vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a network-base… |
CVE-2023-22397 | Medium | 6.1 | 2023-01-13 | An Allocation of Resources Without Limits or Throttling weakness in the memory management of the Packet Forwarding Engine (PFE) on Juniper Networks Junos OS Ev… |
CVE-2020-36568 | High | 7.5 | 2022-12-27 | Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation. |
CVE-2022-45434 | Medium | 5.9 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. After bypassing the firewall access contr… |
CVE-2022-4723 | Medium | 6.5 | 2022-12-27 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-42531 | High | 7.8 | 2022-12-16 | In mmu_map_for_fw of gs_ldfw_load.c, there is a possible mitigation bypass due to Permissive Memory Allocation. This could lead to local escalation of privileg… |
CVE-2022-23524 | Medium | 5.3 | 2022-12-15 | Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting i… |
CVE-2022-41288 | Low | 3.3 | 2022-12-13 | A vulnerability has been identified in JT2Go (All versions < V14.1.0.6), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V… |
CVE-2022-20487 | High | 7.8 | 2022-12-13 | In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to… |
CVE-2022-20486 | High | 7.8 | 2022-12-13 | In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to… |
CVE-2022-20485 | High | 7.8 | 2022-12-13 | In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to… |
CVE-2022-20484 | High | 7.8 | 2022-12-13 | In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to… |
CVE-2022-20480 | High | 7.8 | 2022-12-13 | In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to… |
CVE-2022-20479 | High | 7.8 | 2022-12-13 | In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to… |
CVE-2022-20478 | High | 7.8 | 2022-12-13 | In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to… |
CVE-2022-22488 | Medium | 4.9 | 2022-12-12 | IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of t… |
CVE-2022-41717 | Medium | 5.3 | 2022-12-08 | An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by t… |
CVE-2022-23492 | High | 7.5 | 2022-12-08 | go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to targeted resource exha… |
CVE-2022-23487 | High | 7.5 | 2022-12-07 | js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource… |
CVE-2022-23486 | High | 7.5 | 2022-12-07 | libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node t… |
CVE-2022-46159 | Medium | 4.3 | 2022-12-02 | Discourse is an open-source discussion platform. In version 2.8.13 and prior on the `stable` branch and version 2.9.0.beta14 and prior on the `beta` and `tests… |
CVE-2022-41921 | Low | 3.5 | 2022-11-28 | Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial o… |
CVE-2022-41932 | High | 7.5 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create many new schemas an… |
CVE-2022-4045 | Low | 3.1 | 2022-11-23 | A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which co… |
CVE-2022-4044 | Medium | 4.3 | 2022-11-23 | A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages. |
CVE-2022-4019 | Medium | 4.3 | 2022-11-23 | A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the… |
CVE-2022-45471 | Low | 3.5 | 2022-11-18 | In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address |
CVE-2022-20950 | Medium | 5.8 | 2022-11-15 | A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to caus… |
CVE-2022-3480 | High | 7.5 | 2022-11-15 | A remote, unauthenticated attacker could cause a denial-of-service of PHOENIX CONTACT FL MGUARD and TC MGUARD devices below version 8.9.0 by sending a larger n… |
CVE-2022-43686 | Medium | 6.5 | 2022-11-14 | In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service… |
CVE-2021-34568 | High | 7.5 | 2022-11-09 | In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denia… |
CVE-2022-43945 | High | 7.5 | 2022-11-04 | The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD t… |
CVE-2022-42318 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42317 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42316 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42315 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42314 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42313 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42312 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42311 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-34439 | Medium | 5.3 | 2022-10-21 | Dell PowerScale OneFS, versions 8.2.0.x-9.4.0.x contain allocation of Resources Without Limits or Throttling vulnerability. A remote unauthenticated attacker c… |
CVE-2022-40885 | Medium | 5.5 | 2022-10-19 | Bento4 v1.6.0-639 has a memory allocation issue that can cause denial of service. |
CVE-2022-22240 | Medium | 5.5 | 2022-10-18 | An Allocation of Resources Without Limits or Throttling and a Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (… |
CVE-2022-22226 | Medium | 6.5 | 2022-10-18 | In VxLAN scenarios on EX4300-MP, EX4600, QFX5000 Series devices an Uncontrolled Memory Allocation vulnerability in the Packet Forwarding Engine (PFE) of Junipe… |
CVE-2022-22211 | High | 7.5 | 2022-10-18 | A limitless resource allocation vulnerability in FPC resources of Juniper Networks Junos OS Evolved on PTX Series allows an unprivileged attacker to cause Deni… |
CVE-2022-2879 | High | 7.5 | 2022-10-14 | Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, p… |
CVE-2022-3439 | Critical | 9.8 | 2022-10-14 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0. |
CVE-2022-3456 | Critical | 9.8 | 2022-10-13 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0. |
CVE-2022-33749 | Medium | 5.3 | 2022-10-11 | XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be una… |
CVE-2022-34308 | Medium | 5.5 | 2022-10-07 | IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 229437. |
CVE-2022-3423 | High | 7.3 | 2022-10-07 | Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0. |
CVE-2022-2929 | Medium | 6.5 | 2022-10-07 | In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels long… |
CVE-2022-3273 | Critical | 9.8 | 2022-10-06 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. |