CWE-770 · Allocation of Resources Without Limits or Throttling (page 22)
Page 22 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22404 | Medium | 6.5 | 2022-04-01 | IBM App Connect Enterprise Certified Container Dashboard UI (IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1) may be vulnerable to d… |
CVE-2021-43662 | Medium | 6.5 | 2022-03-31 | totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumption. |
CVE-2017-20016 | Medium | 4.3 | 2022-03-28 | A vulnerability has been found in WEKA INTEREST Security Scanner up to 1.8 and classified as problematic. This vulnerability affects unknown code of the compon… |
CVE-2022-21822 | High | 7.5 | 2022-03-17 | NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, w… |
CVE-2021-32476 | High | 7.5 | 2022-03-11 | A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6… |
CVE-2022-24741 | Low | 3.5 | 2022-03-09 | Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading spec… |
CVE-2022-26336 | Medium | 5.5 | 2022-03-04 | A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF file… |
CVE-2022-21716 | High | 7.5 | 2022-03-03 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to acce… |
CVE-2022-24685 | High | 7.5 | 2022-02-28 | HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0… |
CVE-2022-24614 | Medium | 5.5 | 2022-02-24 | When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-mem… |
CVE-2016-20013 | High | 7.5 | 2022-02-19 | sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the s… |
CVE-2022-23228 | High | 7.5 | 2022-02-18 | Pexip Infinity before 27.0 has improper WebRTC input validation. An unauthenticated remote attacker can use excessive resources, temporarily causing denial of… |
CVE-2021-22050 | High | 7.5 | 2022-02-16 | ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a… |
CVE-2022-21698 | High | 7.5 | 2022-02-15 | client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers… |
CVE-2022-23913 | High | 7.5 | 2022-02-04 | In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memor… |
CVE-2021-32036 | Medium | 5.4 | 2022-02-04 | An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource dep… |
CVE-2022-21732 | Medium | 4.3 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `ThreadPoolHandle` can be used to trigger a denial of service attack by allocati… |
CVE-2021-41840 | High | 8.2 | 2022-02-03 | An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the Syste… |
CVE-2022-24196 | Medium | 6.5 | 2022-02-01 | iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attacker… |
CVE-2021-28096 | Medium | 5.3 | 2022-01-27 | An issue was discovered in Stormshield SNS before 4.2.3 (when the proxy is used). An attacker can saturate the proxy connection table. This would result in the… |
CVE-2021-44988 | High | 7.8 | 2022-01-25 | Jerryscript v3.0.0 and below was discovered to contain a stack overflow via ecma_find_named_property in ecma-helpers.c. |
CVE-2021-39293 | High | 7.5 | 2022-01-24 | In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader o… |
CVE-2021-39480 | High | 7.5 | 2022-01-21 | Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS). |
CVE-2022-23837 | High | 7.5 | 2022-01-21 | In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting… |
CVE-2022-21294 | Medium | 5.3 | 2022-01-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a… |
CVE-2022-22153 | High | 7.5 | 2022-01-19 | An Insufficient Algorithmic Complexity combined with an Allocation of Resources Without Limits or Throttling vulnerability in the flow processing daemon (flowd… |
CVE-2021-46050 | Medium | 5.5 | 2022-01-10 | A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function. |
CVE-2020-9059 | Medium | 6.5 | 2022-01-10 | Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resource consumption leading to battery exhaus… |
CVE-2021-43045 | High | 7.5 | 2022-01-06 | A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue a… |
CVE-2021-28715 | Medium | 6.5 | 2022-01-06 | Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspec… |
CVE-2021-28714 | Medium | 6.5 | 2022-01-06 | Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspec… |
CVE-2021-44591 | Medium | 6.5 | 2022-01-06 | In libming 0.4.8, the parseSWF_DEFINELOSSLESS2 function in util/parser.c lacks a boundary check that would lead to denial-of-service attacks via a crafted SWF… |
CVE-2021-44590 | Medium | 6.5 | 2022-01-06 | In libming 0.4.8, a memory exhaustion vulnerability exist in the function cws2fws in util/main.c. Remote attackers could launch denial of service attacks by su… |
CVE-2021-37111 | High | 7.5 | 2022-01-03 | There is a Memory leakage vulnerability in Smartphone.Successful exploitation of this vulnerability may cause memory exhaustion. |
CVE-2021-45699 | High | 7.5 | 2021-12-27 | An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by trig… |
CVE-2020-35210 | Medium | 6.5 | 2021-12-16 | A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages. |
CVE-2021-38244 | High | 7.5 | 2021-12-16 | A regular expression denial of service (ReDoS) vulnerability exits in cbioportal 3.6.21 and older via a POST request to /ProteinArraySignificanceTest.json. |
CVE-2021-31787 | Medium | 6.5 | 2021-11-30 | The Bluetooth Classic implementation on Actions ATS2815 chipsets does not properly handle the reception of continuous unsolicited LMP responses, allowing attac… |
CVE-2021-28706 | High | 8.6 | 2021-11-24 | guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its… |
CVE-2021-29329 | High | 7.8 | 2021-11-19 | OpenSource Moddable v10.5.0 was discovered to contain a stack overflow in the fxBinaryExpressionNodeDistribute function at /moddable/xs/sources/xsTree.c. |
CVE-2021-29324 | High | 7.8 | 2021-11-19 | OpenSource Moddable v10.5.0 was discovered to contain a stack overflow via the component /moddable/xs/sources/xsScript.c. |
CVE-2021-3912 | Medium | 4.2 | 2021-11-11 | OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a reposi… |
CVE-2021-39912 | Medium | 5.3 | 2021-11-05 | A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7. Using a malformed TIFF images was possible to trigger memory exhaustio… |
CVE-2021-39907 | Medium | 5.3 | 2021-11-05 | A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from certain images resulted in high CPU us… |
CVE-2021-34741 | High | 7.5 | 2021-11-04 | A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attac… |
CVE-2021-36174 | Medium | 4.3 | 2021-11-02 | A memory allocation with excessive size value vulnerability in the license verification function of FortiPortal before 6.0.6 may allow an attacker to perform a… |
CVE-2021-1121 | Medium | 5.5 | 2021-10-29 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager kernel driver, where a vGPU can cause resource starvation among other vGPUs hosted on… |
CVE-2021-22461 | Medium | 5.5 | 2021-10-28 | A component of the HarmonyOS has a Allocation of Resources Without Limits or Throttling vulnerability. Local attackers may exploit this vulnerability to cause… |
CVE-2021-40114 | Medium | 6.8 | 2021-10-27 | Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remot… |
CVE-2021-34854 | High | 7.8 | 2021-10-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain t… |
CVE-2021-38465 | High | 8.0 | 2021-10-22 | The webinstaller is a Golang web server executable that enables the generation of an Auvesy image agent. Resource consumption can be achieved by generating lar… |
CVE-2021-38463 | High | 7.3 | 2021-10-22 | The affected product does not properly control the allocation of resources. A user may be able to allocate unlimited memory buffers using API functions. |
CVE-2021-41167 | High | 7.5 | 2021-10-20 | modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two… |
CVE-2021-31369 | Medium | 5.3 | 2021-10-19 | On MX Series platforms with MS-MPC/MS-MIC, an Allocation of Resources Without Limits or Throttling vulnerability in Juniper Networks Junos OS allows an unauthe… |
CVE-2021-41546 | High | 7.5 | 2021-10-12 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All… |
CVE-2021-41800 | Medium | 5.3 | 2021-10-11 | MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometime… |
CVE-2021-41799 | High | 7.5 | 2021-10-11 | MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). ApiQueryBacklinks (action=query&list=backli… |
CVE-2021-34735 | High | 8.8 | 2021-10-06 | Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injection attack resulting… |
CVE-2021-34710 | High | 8.8 | 2021-10-06 | Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injection attack resulting… |
CVE-2021-35492 | Medium | 6.5 | 2021-10-05 | Wowza Streaming Engine through 4.8.11+5 could allow an authenticated, remote attacker to exhaust filesystem resources via the /enginemanager/server/vhost/histo… |
CVE-2021-32675 | High | 7.5 | 2021-10-04 | Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory acco… |
CVE-2021-41593 | High | 8.6 | 2021-10-04 | Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure. |
CVE-2021-41592 | Critical | 9.4 | 2021-10-04 | Blockstream c-lightning through 0.10.1 allows loss of funds because of dust HTLC exposure. |
CVE-2021-41591 | Critical | 9.4 | 2021-10-04 | ACINQ Eclair before 0.6.3 allows loss of funds because of dust HTLC exposure. |
CVE-2021-34415 | High | 7.5 | 2021-09-27 | The Zone Controller service in the Zoom On-Premise Meeting Connector Controller before version 4.6.358.20210205 does not verify the cnt field sent in incoming… |
CVE-2021-0424 | Medium | 5.5 | 2021-09-27 | In memory management driver, there is a possible system crash due to a missing bounds check. This could lead to local denial of service with no additional exec… |
CVE-2021-0422 | Medium | 5.5 | 2021-09-27 | In memory management driver, there is a possible system crash due to a missing bounds check. This could lead to local denial of service with no additional exec… |
CVE-2021-29763 | Medium | 5.1 | 2021-09-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 under very specific conditions, could allow a local user to keep running a proc… |
CVE-2021-23053 | Medium | 5.3 | 2021-09-14 | On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP Advanced WAF or BIG-IP A… |
CVE-2021-33011 | Medium | 4.3 | 2021-09-10 | All versions of the afffected TOYOPUC-PC10 Series,TOYOPUC-Plus Series,TOYOPUC-PC3J/PC2J Series, TOYOPUC-Nano Series products may not be able to properly proces… |
CVE-2021-37629 | Medium | 5.3 | 2021-09-07 | Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint… |
CVE-2021-33831 | Medium | 6.5 | 2021-09-07 | api/account/register in the TH Wildau COVID-19 Contact Tracing application through 2021-09-01 has Incorrect Access Control. An attacker can interfere with trac… |
CVE-2021-22029 | High | 7.5 | 2021-08-31 | VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/system/admins/session could cause an API de… |
CVE-2021-28700 | Medium | 4.9 | 2021-08-27 | xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunate… |
CVE-2021-1592 | Medium | 4.3 | 2021-08-25 | A vulnerability in the way Cisco UCS Manager software handles SSH sessions could allow an authenticated, remote attacker to cause a denial of service (DoS) con… |
CVE-2018-10790 | High | 7.5 | 2021-08-25 | The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), related to a memory… |
CVE-2021-22246 | High | 7.7 | 2021-08-20 | A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. GitLab Webhook feature could be abused to perform denial of service attacks. |
CVE-2020-18899 | Medium | 6.5 | 2021-08-19 | An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a cr… |
CVE-2021-0420 | Medium | 5.5 | 2021-08-18 | In memory management driver, there is a possible system crash due to a missing bounds check. This could lead to local denial of service with no additional exec… |
CVE-2021-32068 | Low | 3.7 | 2021-08-13 | The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple s… |
CVE-2021-36798 | High | 7.5 | 2021-08-09 | A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. It allows remote attackers to crash the C2 serv… |
CVE-2021-22919 | High | 7.5 | 2021-08-05 | A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN… |
CVE-2021-33320 | Medium | 4.3 | 2021-08-03 | The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit… |
CVE-2020-19464 | Medium | 5.5 | 2021-07-21 | An issue has been found in function XRef::fetch in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a stack overflow . |
CVE-2020-19463 | Medium | 5.5 | 2021-07-21 | An issue has been found in function vfprintf in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a stack overflow. |
CVE-2021-33910 | Medium | 5.5 | 2021-07-20 | basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a… |
CVE-2021-0285 | High | 7.5 | 2021-07-15 | An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker sending large a… |
CVE-2021-29725 | High | 7.5 | 2021-07-15 | IBM Secure External Authentication Server 2.4.3.2, 6.0.1, 6.0.2 and IBM Secure Proxy 3.4.3.2, 6.0.1, 6.0.2 could allow a remote user to consume resources causi… |
CVE-2021-25671 | Medium | 4.3 | 2021-07-13 | A vulnerability has been identified in RWG1.M12 (All versions < V1.16.16), RWG1.M12D (All versions < V1.16.16), RWG1.M8 (All versions < V1.16.16). Sending spec… |
CVE-2020-28400 | High | 7.5 | 2021-07-13 | Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerability can be triggered i… |
CVE-2021-35517 | High | 7.5 | 2021-07-13 | When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for ve… |
CVE-2021-35516 | High | 7.5 | 2021-07-13 | When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for ver… |
CVE-2021-36155 | High | 7.5 | 2021-07-09 | LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier allocates buffers of arbitrary length, which allows remote attackers to cause uncontrolled resource… |
CVE-2021-3637 | High | 7.5 | 2021-07-09 | A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boun… |
CVE-2020-28200 | Medium | 4.3 | 2021-06-28 | The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the re… |
CVE-2021-33541 | High | 7.5 | 2021-06-25 | Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protoc… |
CVE-2021-32699 | Medium | 6.5 | 2021-06-22 | Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vulnerable t… |
CVE-2021-22363 | High | 7.5 | 2021-06-22 | There is a resource management error vulnerability in eCNS280_TD V100R005C10SPC650. An attacker needs to perform specific operations to exploit the vulnerabili… |
CVE-2021-29063 | High | 7.5 | 2021-06-21 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called. |
CVE-2021-29061 | High | 7.5 | 2021-06-21 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Vfsjfilechooser2 version 0.2.9 and below which occurs when the application attem… |