CWE-770 · Allocation of Resources Without Limits or Throttling (page 21)
Page 21 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3371 | High | 7.5 | 2022-09-30 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3. |
CVE-2022-41846 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_DataBuffer::ReallocateBuffer in Core/Ap4DataBuffer.cpp. |
CVE-2022-41845 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_Array<AP4_ElstEntry>::EnsureCapacity in Core/Ap4Array.h. |
CVE-2022-3364 | High | 7.5 | 2022-09-29 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3. |
CVE-2022-39226 | Medium | 4.3 | 2022-09-29 | Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` b… |
CVE-2022-29503 | Critical | 9.8 | 2022-09-29 | A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40. Thread allocation can lead to me… |
CVE-2022-3298 | High | 7.5 | 2022-09-26 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8. |
CVE-2022-3295 | High | 7.5 | 2022-09-26 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8. |
CVE-2022-35089 | Medium | 5.5 | 2022-09-21 | SWFTools commit 772e55a2 was discovered to contain a heap-buffer-overflow via getTransparentColor at /home/bupt/Desktop/swftools/src/gif2swf. |
CVE-2022-34917 | High | 7.5 | 2022-09-20 | A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients t… |
CVE-2022-40762 | High | 7.5 | 2022-09-16 | A Memory Allocation with Excessive Size Value vulnerablity in the TEE_Realloc function in Samsung mTower through 0.3.0 allows a trusted application to trigger… |
CVE-2022-3212 | High | 7.5 | 2022-09-14 | <bytes::Bytes as axum_core::extract::FromRequest>::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious… |
CVE-2022-36104 | Medium | 5.9 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources v… |
CVE-2022-3147 | Low | 3.1 | 2022-09-09 | Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to… |
CVE-2022-25897 | Medium | 5.9 | 2022-09-08 | The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption… |
CVE-2022-36049 | High | 7.7 | 2022-09-07 | Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to d… |
CVE-2020-35534 | Medium | 5.5 | 2022-09-01 | In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files. |
CVE-2022-36055 | Medium | 6.5 | 2022-09-01 | Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Fuzz testing, provided by the CNCF, identified input to functio… |
CVE-2022-38153 | Medium | 5.9 | 2022-08-31 | An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is exploitable. Man-in-the-middle attackers… |
CVE-2022-1325 | Medium | 5.5 | 2022-08-31 | A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick… |
CVE-2022-0480 | Medium | 5.5 | 2022-08-29 | A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the n… |
CVE-2022-0084 | High | 7.5 | 2022-08-26 | A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw… |
CVE-2021-3669 | Medium | 5.5 | 2022-08-26 | A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource… |
CVE-2021-3759 | Medium | 5.5 | 2022-08-23 | A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple… |
CVE-2022-25888 | High | 7.5 | 2022-08-23 | The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in… |
CVE-2022-25761 | High | 7.5 | 2022-08-23 | The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number… |
CVE-2022-25304 | High | 7.5 | 2022-08-23 | All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received… |
CVE-2022-25231 | High | 7.5 | 2022-08-23 | The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, w… |
CVE-2022-24381 | High | 7.5 | 2022-08-23 | All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single se… |
CVE-2022-24298 | High | 7.5 | 2022-08-23 | All versions of package freeopcua/freeopcua are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sendin… |
CVE-2022-36155 | Medium | 5.5 | 2022-08-16 | tifig v0.2.2 was discovered to contain a resource allocation issue via operator new(unsigned long) at asan_new_delete.cpp. |
CVE-2022-36146 | Medium | 5.5 | 2022-08-16 | SWFMill commit 53d7690 was discovered to contain a memory allocation issue via operator new[](unsigned long) at asan_new_delete.cpp. |
CVE-2022-35111 | Medium | 5.5 | 2022-08-16 | SWFTools commit 772e55a2 was discovered to contain a stack overflow via __sanitizer::StackDepotNode::hash(__sanitizer::StackTrace const&) at /sanitizer_common/… |
CVE-2022-35107 | Medium | 5.5 | 2022-08-16 | SWFTools commit 772e55a2 was discovered to contain a stack overflow via vfprintf at /stdio-common/vfprintf.c. |
CVE-2022-35009 | Medium | 6.5 | 2022-08-16 | PNGDec commit 8abf6be was discovered to contain a memory allocation problem via asan_malloc_linux.cpp. |
CVE-2020-14322 | High | 7.5 | 2022-08-16 | In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, yui_combo needed to limit the amount of files it can load to help mitigate the risk of denial of service. |
CVE-2022-38155 | High | 7.5 | 2022-08-11 | TEE_Malloc in Samsung mTower through 0.3.0 allows a trusted application to achieve Excessive Memory Allocation via a large len value, as demonstrated by a Numa… |
CVE-2022-36324 | High | 7.5 | 2022-08-10 | Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TCP brute fo… |
CVE-2022-36124 | High | 7.5 | 2022-08-09 | It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications… |
CVE-2022-35724 | High | 7.5 | 2022-08-09 | It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache A… |
CVE-2022-31118 | Medium | 6.5 | 2022-08-04 | Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and p… |
CVE-2022-35505 | High | 7.5 | 2022-08-03 | A segmentation fault in TripleCross v0.1.0 occurs when sending a control command from the client to the server. This occurs because there is no limit to the le… |
CVE-2022-35221 | Medium | 5.4 | 2022-08-02 | Teamplus Pro community discussion has an ‘allocation of resource without limits or throttling’ vulnerability on thread subject field. A remote attacker with ge… |
CVE-2022-35220 | High | 7.7 | 2022-08-02 | Teamplus Pro community discussion function has an ‘allocation of resource without limits or throttling’ vulnerability. A remote attacker with general user priv… |
CVE-2022-35219 | Medium | 5.5 | 2022-08-02 | The NHI card’s web service component has a stack-based buffer overflow vulnerability due to insufficient validation for network packet key parameter. A LAN att… |
CVE-2022-35218 | Medium | 5.5 | 2022-08-02 | The NHI card’s web service component has a heap-based buffer overflow vulnerability due to insufficient validation for packet origin parameter length. A LAN at… |
CVE-2022-35922 | High | 7.5 | 2022-08-01 | Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory (OOM) p… |
CVE-2022-35915 | Medium | 5.3 | 2022-08-01 | OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas… |
CVE-2022-31184 | Medium | 6.5 | 2022-08-01 | Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been incl… |
CVE-2022-22212 | High | 7.5 | 2022-07-20 | An Allocation of Resources Without Limits or Throttling vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved allows unauthe… |
CVE-2022-32958 | High | 7.7 | 2022-07-20 | A remote attacker with general user privilege can send a message to Teamplus Pro’s chat group that exceeds message size limit, to terminate other recipients’ T… |
CVE-2022-29286 | High | 7.5 | 2022-07-17 | Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resource mishandling. |
CVE-2022-2406 | Medium | 4.3 | 2022-07-14 | The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated atta… |
CVE-2022-31080 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31079 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31078 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31075 | Medium | 4.9 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2021-31645 | High | 7.5 | 2022-07-07 | An issue was discovered in glFTPd 2.11a that allows remote attackers to cause a denial of service via exceeding the connection limit. |
CVE-2022-32206 | Medium | 6.5 | 2022-07-07 | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different alg… |
CVE-2022-32205 | Medium | 4.3 | 2022-07-07 | A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large a… |
CVE-2022-34750 | High | 7.5 | 2022-06-28 | An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this le… |
CVE-2021-40609 | Medium | 5.5 | 2022-06-28 | The GetHintFormat function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. |
CVE-2021-40607 | Medium | 5.5 | 2022-06-28 | The schm_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. |
CVE-2021-40941 | High | 7.5 | 2022-06-27 | In Bento4 1.6.0-638, there is an allocator is out of memory in the function AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity in Ap4Array.h:172, as demonstrated b… |
CVE-2022-31016 | Medium | 6.5 | 2022-06-25 | Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allo… |
CVE-2022-21952 | High | 7.5 | 2022-06-22 | A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to e… |
CVE-2022-27871 | High | 7.8 | 2022-06-21 | Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may be used to write beyond the allocated bu… |
CVE-2022-22979 | High | 7.5 | 2022-06-21 | In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a deni… |
CVE-2022-2134 | Medium | 6.5 | 2022-06-20 | Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0. |
CVE-2022-29863 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation. |
CVE-2022-20143 | Medium | 5.5 | 2022-06-15 | In addAutomaticZenRule of ZenModeHelper.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of se… |
CVE-2022-32559 | Critical | 9.1 | 2022-06-14 | An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics. |
CVE-2021-35096 | High | 7.5 | 2022-06-14 | Improper memory allocation during counter check DLM handling can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna… |
CVE-2022-31287 | Medium | 5.5 | 2022-06-10 | An issue was discovered in Bento4 v1.2. There is an allocation size request error in /Ap4RtpAtom.cpp. |
CVE-2022-31285 | Medium | 5.5 | 2022-06-10 | An issue was discovered in Bento4 1.2. The allocator is out of memory in /Source/C++/Core/Ap4Array.h. |
CVE-2022-30522 | High | 7.5 | 2022-06-09 | If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excess… |
CVE-2022-29404 | High | 7.5 | 2022-06-09 | In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit o… |
CVE-2022-1708 | High | 7.5 | 2022-06-07 | A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs co… |
CVE-2022-29767 | Medium | 6.5 | 2022-06-03 | adbyby v2.7 allows external users to make connections via port 8118. This can cause a program logic error and lead to a Denial of Service (DoS) via high CPU us… |
CVE-2022-25169 | Medium | 5.5 | 2022-05-16 | The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files. |
CVE-2022-30775 | Medium | 5.5 | 2022-05-16 | xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by (for example) sending a crafted PDF document to the pdftoppm b… |
CVE-2022-22971 | Medium | 6.5 | 2022-05-12 | In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denia… |
CVE-2022-22970 | Medium | 5.3 | 2022-05-12 | In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if the… |
CVE-2022-1428 | Medium | 4.3 | 2022-05-11 | An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 be… |
CVE-2021-39670 | Medium | 5.5 | 2022-05-10 | In setStream of WallpaperManager.java, there is a possible way to cause a permanent DoS due to improper input validation. This could lead to local denial of se… |
CVE-2022-20767 | High | 8.6 | 2022-05-03 | A vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause… |
CVE-2022-20757 | High | 8.6 | 2022-05-03 | A vulnerability in the connection handling function in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a… |
CVE-2022-20751 | High | 8.6 | 2022-05-03 | A vulnerability in the Snort detection engine integration for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to… |
CVE-2022-29973 | Medium | 4.7 | 2022-05-02 | relan exFAT 1.3.0 allows local users to obtain sensitive information (data from deleted files in the filesystem) in certain situations involving offsets beyond… |
CVE-2022-22278 | High | 7.5 | 2022-04-27 | A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access p… |
CVE-2022-29701 | High | 7.5 | 2022-04-27 | A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user… |
CVE-2022-28871 | Medium | 4.3 | 2022-04-25 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the fsicapd component used in certain F-Secure products while scanning larger… |
CVE-2021-44502 | High | 7.5 | 2022-04-15 | An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can control the size of a memset that… |
CVE-2022-20717 | Medium | 5.5 | 2022-04-15 | A vulnerability in the NETCONF process of Cisco SD-WAN vEdge Routers could allow an authenticated, local attacker to cause an affected device to run out of mem… |
CVE-2022-20622 | High | 8.6 | 2022-04-15 | A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points Software could allow an unauthenticated… |
CVE-2022-1337 | Medium | 4.3 | 2022-04-13 | The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attack… |
CVE-2022-1333 | Low | 3.5 | 2022-04-13 | Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to… |
CVE-2022-27819 | Medium | 5.3 | 2022-04-07 | SWHKD 1.1.5 allows unsafe parsing via the -c option. An information leak might occur but there is a simple denial of service (memory exhaustion) upon an attemp… |
CVE-2022-1121 | Medium | 5.3 | 2022-04-04 | A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an… |
CVE-2022-22950 | Medium | 6.5 | 2022-04-01 | n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may ca… |