CWE-770 · Allocation of Resources Without Limits or Throttling (page 22)
Page 22 of 22 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2613 | Medium | 5.4 | 2018-05-15 | jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most… |
CVE-2018-10971 | Medium | 5.5 | 2018-05-10 | An issue was discovered in Free Lossless Image Format (FLIF) 0.3. The Plane function in image/image.hpp allows remote attackers to cause a denial of service (a… |
CVE-2018-10237 | Medium | 5.9 | 2018-04-26 | Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that d… |
CVE-2018-0239 | High | 7.5 | 2018-04-19 | A vulnerability in the egress packet processing functionality of the Cisco StarOS operating system for Cisco Aggregation Services Router (ASR) 5700 Series devi… |
CVE-2018-1274 | High | 7.5 | 2018-04-18 | Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited r… |
CVE-2017-18258 | Medium | 6.5 | 2018-04-08 | The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, beca… |
CVE-2017-18229 | Medium | 6.5 | 2018-03-14 | An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allows at… |
CVE-2018-7582 | High | 7.5 | 2018-03-09 | WebLog Expert Web Server Enterprise 9.4 allows Remote Denial Of Service (daemon crash) via a long HTTP Accept Header to TCP port 9991. |
CVE-2017-18219 | Medium | 6.5 | 2018-03-05 | An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows a… |
CVE-2018-7443 | Medium | 6.5 | 2018-02-23 | The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-23 Q16 does not properly validate the amount of image data in a file, which allows remote atta… |
CVE-2018-6869 | Medium | 6.5 | 2018-02-09 | In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function of zzip/zip.c. Remote attackers could le… |
CVE-2018-0137 | High | 8.6 | 2018-02-08 | A vulnerability in the TCP throttling process of Cisco Prime Network could allow an unauthenticated, remote attacker to cause a denial of service (DoS) conditi… |
CVE-2018-5783 | Medium | 5.5 | 2018-01-19 | In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVecObjects.h). Remote attackers could lever… |
CVE-2017-13190 | High | 7.5 | 2018-01-12 | A vulnerability in the Android media framework (libhevc) related to handling ps_codec_obj memory allocation failures. Product: Android. Versions: 7.0, 7.1.1, 7… |
CVE-2017-13189 | High | 7.5 | 2018-01-12 | A vulnerability in the Android media framework (libavc) related to handling dec_hdl memory allocation failures. Product: Android. Versions: 7.0, 7.1.1, 7.1.2… |
CVE-2017-18028 | Medium | 6.5 | 2018-01-12 | In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allow remote attackers to cause a… |
CVE-2018-0006 | Medium | 6.5 | 2018-01-10 | A high rate of VLAN authentication attempts sent from an adjacent host on the local broadcast domain can trigger high memory utilization by the BBE subscriber… |
CVE-2017-15124 | High | 7.5 | 2018-01-09 | VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle… |
CVE-2018-5296 | Medium | 5.5 | 2018-01-08 | In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PdfParser::ReadXRefSubsection function (base/PdfParser.cpp). Remote attackers could leverage… |
CVE-2018-4868 | Medium | 5.5 | 2018-01-03 | The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of service (excessive memory allocation) via… |
CVE-2017-3883 | High | 8.6 | 2017-10-19 | A vulnerability in the authentication, authorization, and accounting (AAA) implementation of Cisco Firepower Extensible Operating System (FXOS) and NX-OS Syste… |
CVE-2017-14938 | Medium | 5.5 | 2017-09-30 | _bfd_elf_slurp_version_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers t… |
CVE-2017-14531 | Medium | 6.5 | 2017-09-18 | ImageMagick 7.0.7-0 has a memory exhaustion issue in ReadSUNImage in coders/sun.c. |
CVE-2017-0771 | Medium | 5.5 | 2017-09-08 | A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-37624243. |
CVE-2017-6780 | High | 7.5 | 2017-09-07 | A vulnerability in the TCP throttling process for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to cause the syste… |
CVE-2017-12693 | Medium | 6.5 | 2017-09-01 | The ReadBMPImage function in coders/bmp.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted BMP fi… |
CVE-2017-12692 | Medium | 6.5 | 2017-09-01 | The ReadVIFFImage function in coders/viff.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted VIFF… |
CVE-2017-12691 | Medium | 6.5 | 2017-09-01 | The ReadOneLayer function in coders/xcf.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted file. |
CVE-2017-14107 | Medium | 6.5 | 2017-09-01 | The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory… |
CVE-2017-13763 | High | 7.5 | 2017-08-30 | ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited. |
CVE-2017-12875 | Medium | 6.5 | 2017-08-29 | The WritePixelCachePixels function in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (CPU consumption) via a crafted file. |
CVE-2017-13716 | Medium | 5.5 | 2017-08-28 | The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excess… |
CVE-2017-13133 | Medium | 6.5 | 2017-08-23 | In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory… |
CVE-2017-8253 | High | 7.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, kernel memory can potentially be overwritten if an invalid master is sent from… |
CVE-2017-12944 | High | 7.5 | 2017-08-18 | The TIFFReadDirEntryArray function in tif_read.c in LibTIFF 4.0.8 mishandles memory allocation for short files, which allows remote attackers to cause a denial… |
CVE-2017-0725 | Medium | 5.5 | 2017-08-09 | A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-37627194. |
CVE-2017-12643 | Medium | 6.5 | 2017-08-07 | ImageMagick 7.0.6-1 has a memory exhaustion vulnerability in ReadOneJNGImage in coders\png.c. |
CVE-2017-12563 | Medium | 6.5 | 2017-08-05 | In ImageMagick 7.0.6-2, a memory exhaustion vulnerability was found in the function ReadPSDImage in coders/psd.c, which allows attackers to cause a denial of s… |
CVE-2017-12435 | High | 7.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of s… |
CVE-2017-12432 | Medium | 6.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadPCXImage in coders/pcx.c, which allows attackers to cause a denial of s… |
CVE-2017-12430 | High | 7.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of s… |
CVE-2017-12429 | High | 7.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of… |
CVE-2017-12144 | Medium | 5.5 | 2017-08-02 | In ytnef 1.9.2, an allocation failure was found in the function TNEFFillMapi in ytnef.c, which allows attackers to cause a denial of service via a crafted file. |
CVE-2017-12132 | Medium | 5.9 | 2017-08-01 | The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name s… |
CVE-2017-1227 | High | 7.5 | 2017-07-31 | IBM Tivoli Endpoint Manager could allow a unauthorized user to consume all resources and crash the system. IBM X-Force ID: 123906. |
CVE-2017-11525 | Medium | 6.5 | 2017-07-23 | The ReadCINImage function in coders/cin.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory con… |
CVE-2017-11468 | High | 7.5 | 2017-07-20 | Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cau… |
CVE-2017-6713 | Critical | 9.8 | 2017-07-06 | A vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to gain full access to the aff… |
CVE-2017-9778 | Medium | 5.5 | 2017-06-21 | GNU Debugger (GDB) 8.0 and earlier fails to detect a negative length field in a DWARF section. A malformed section in an ELF binary or a core file can cause GD… |
CVE-2017-6640 | Critical | 9.8 | 2017-06-08 | A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attacker to log in to the administrative cons… |
CVE-2017-9350 | High | 7.5 | 2017-06-02 | In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-op… |
CVE-2017-6653 | High | 7.5 | 2017-05-22 | A vulnerability in the TCP throttling process for the GUI of the Cisco Identity Services Engine (ISE) 2.1(0.474) could allow an unauthenticated, remote attacke… |
CVE-2017-6641 | High | 7.5 | 2017-05-22 | A vulnerability in the TCP connection handling functionality of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to… |
CVE-2017-9039 | Medium | 5.5 | 2017-05-18 | GNU Binutils 2.28 allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file with many program headers, related to the ge… |
CVE-2017-0612 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute… |
CVE-2017-8779 | High | 7.5 | 2017-05-04 | rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory… |
CVE-2017-3555 | High | 7.5 | 2017-04-24 | Vulnerability in the Oracle iReceivables component of Oracle E-Business Suite (subcomponent: Self Registration). Supported versions that are affected are 12.1… |
CVE-2017-7963 | High | 7.5 | 2017-04-19 | The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and appli… |
CVE-2017-7696 | High | 7.5 | 2017-04-14 | SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service (memory consumption) via large values in the width a… |
CVE-2017-5850 | High | 7.5 | 2017-03-27 | httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using an HTTP Range header. |
CVE-2017-5835 | High | 7.5 | 2017-03-03 | libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero. |
CVE-2016-8576 | Medium | 6.0 | 2016-11-04 | The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop… |
CVE-2016-4074 | High | 7.5 | 2016-05-06 | The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. Thi… |
CVE-2011-0419 | | 2011-05-16 | Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Se… | |
CVE-2009-4017 | | 2009-11-24 | PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows… | |
CVE-2009-2054 | | 2009-08-27 | Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x, 5.x before 5.1(3g), 6.x before 6.1(4), 7.0 before 7.0(2a)su1, and 7.1 before 7.1(2a)… | |
CVE-2009-2726 | | 2009-08-12 | The SIP channel driver in Asterisk Open Source 1.2.x before 1.2.34, 1.4.x before 1.4.26.1, 1.6.0.x before 1.6.0.12, and 1.6.1.x before 1.6.1.4; Asterisk Busine… | |
CVE-2009-2540 | | 2009-07-20 | Opera, possibly 9.64 and earlier, allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property o… | |
CVE-2008-5180 | Medium | 5.3 | 2008-11-20 | Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large n… |
CVE-2008-2364 | | 2008-06-13 | The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of… | |
CVE-2008-1700 | | 2008-04-08 | The Web TransferCtrl Class 8,2,1,4 (iManFile.cab), as used in WorkSite Web 8.2 before SP1 P2, allows remote attackers to cause a denial of service (memory cons… | |
CVE-2005-4650 | Medium | 5.3 | 2005-12-31 | Joomla! 1.03 does not restrict the number of "Search" Mambots, which allows remote attackers to cause a denial of service (resource consumption) via a large nu… |
CVE-2005-2970 | | 2005-10-25 | Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via… | |
CVE-2001-1388 | | 2001-11-05 | iptables before 1.2.4 does not accurately convert rate limits that are specified on the command line, which could allow attackers or users to generate more or… |