CWE-770 · Allocation of Resources Without Limits or Throttling (page 23)
Page 23 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-29060 | Medium | 5.3 | 2021-06-21 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provid… |
CVE-2021-29059 | High | 7.5 | 2021-06-21 | A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is pro… |
CVE-2021-31811 | Medium | 5.5 | 2021-06-12 | In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and… |
CVE-2021-33176 | High | 7.5 | 2021-06-08 | VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of un… |
CVE-2021-33175 | High | 7.5 | 2021-06-08 | EMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted… |
CVE-2021-28848 | High | 7.5 | 2021-06-03 | Mintty before 3.4.5 allows remote servers to cause a denial of service (Windows GUI hang) by telling the Mintty window to change its title repeatedly at high s… |
CVE-2020-14336 | Medium | 6.5 | 2021-06-02 | A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allows an attacker to ca… |
CVE-2021-22360 | Medium | 4.9 | 2021-05-27 | There is a resource management error vulnerability in the verisions V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 of USG9500. An authentication attac… |
CVE-2021-3527 | Medium | 5.5 | 2021-05-26 | A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead… |
CVE-2021-21000 | Medium | 5.3 | 2021-05-24 | On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of servic… |
CVE-2021-29511 | Medium | 6.5 | 2021-05-12 | evm is a pure Rust implementation of Ethereum Virtual Machine. Prior to the patch, when executing specific EVM opcodes related to memory operations that use `e… |
CVE-2021-27383 | High | 7.5 | 2021-05-12 | A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI C… |
CVE-2021-22210 | Medium | 5.3 | 2021-05-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, GitLab was ignoring… |
CVE-2020-22785 | High | 7.5 | 2021-04-28 | Etherpad < 1.8.3 is affected by a missing lock check which could cause a denial of service. Aggressively targeting random pad import endpoints with empty data… |
CVE-2021-22207 | Medium | 5.5 | 2021-04-23 | Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injection or crafted captu… |
CVE-2021-0261 | High | 7.5 | 2021-04-22 | A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Ca… |
CVE-2021-0242 | Medium | 6.5 | 2021-04-22 | A vulnerability due to the improper handling of direct memory access (DMA) buffers on EX4300 switches on Juniper Networks Junos OS allows an attacker sending s… |
CVE-2021-0224 | Medium | 6.5 | 2021-04-22 | A vulnerability in the handling of internal resources necessary to bring up a large number of Layer 2 broadband remote access subscriber (BRAS) nodes in Junipe… |
CVE-2021-29453 | Medium | 5.7 | 2021-04-19 | matrix-media-repo is an open-source multi-domain media repository for Matrix. Versions 1.2.6 and earlier of matrix-media-repo do not properly handle malicious… |
CVE-2021-29430 | High | 7.5 | 2021-04-15 | Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP req… |
CVE-2021-29932 | High | 7.5 | 2021-04-01 | An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service (CPU and memory consumption)… |
CVE-2021-28994 | High | 7.5 | 2021-03-31 | kopano-ical (formerly zarafa-ical) in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x t… |
CVE-2021-3479 | Medium | 5.5 | 2021-03-31 | There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenE… |
CVE-2021-3478 | Medium | 5.5 | 2021-03-31 | There's a flaw in OpenEXR's scanline input file functionality in versions before 3.0.0-beta. An attacker able to submit a crafted file to be processed by OpenE… |
CVE-2020-24994 | High | 8.8 | 2021-03-23 | Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code exec… |
CVE-2021-28302 | High | 7.5 | 2021-03-12 | A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a chi… |
CVE-2021-28038 | Medium | 6.5 | 2021-03-05 | An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such… |
CVE-2021-21274 | Medium | 4.3 | 2021-02-26 | Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP… |
CVE-2020-28491 | High | 7.5 | 2021-02-18 | This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked alloca… |
CVE-2021-22174 | Low | 3.7 | 2021-02-17 | Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file |
CVE-2021-26931 | Medium | 5.5 | 2021-02-17 | An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, delibera… |
CVE-2021-0338 | Medium | 5.5 | 2021-02-10 | In SystemSettingsValidators, there is a possible permanent denial of service due to missing bounds checks on UI settings. This could lead to local denial of se… |
CVE-2021-25666 | Medium | 4.3 | 2021-02-09 | A vulnerability has been identified in SCALANCE W780 and W740 (IEEE 802.11n) family (All versions < V6.3). Sending specially crafted packets through the ARP pr… |
CVE-2020-24685 | High | 8.6 | 2021-02-09 | An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service (DoS) vulnerability. Vulnerability allows attac… |
CVE-2021-21294 | High | 7.5 | 2021-02-02 | Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnera… |
CVE-2021-21293 | High | 7.5 | 2021-02-02 | blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by… |
CVE-2021-20185 | Medium | 5.3 | 2021-01-28 | It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result… |
CVE-2021-1350 | Medium | 5.3 | 2021-01-20 | A vulnerability in the web UI of Cisco Umbrella could allow an unauthenticated, remote attacker to negatively affect the performance of this service. The vulne… |
CVE-2021-25173 | High | 7.8 | 2021-01-18 | An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vulnerability exists when reading malforme… |
CVE-2021-0217 | High | 7.4 | 2021-01-15 | A vulnerability in processing of certain DHCP packets from adjacent clients on EX Series and QFX Series switches running Juniper Networks Junos OS with DHCP lo… |
CVE-2021-21607 | Medium | 6.5 | 2021-01-13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request cra… |
CVE-2021-1057 | High | 7.8 | 2021-01-08 | NVIDIA Virtual GPU Manager NVIDIA vGPU manager contains a vulnerability in the vGPU plugin in which it allows guests to allocate some resources for which the g… |
CVE-2020-36049 | High | 7.5 | 2021-01-08 | socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used. |
CVE-2020-35896 | High | 7.5 | 2020-12-31 | An issue was discovered in the ws crate through 2020-09-25 for Rust. The outgoing buffer is not properly limited, leading to a remote memory-consumption attack. |
CVE-2020-5806 | Medium | 5.5 | 2020-12-29 | An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequest in messaging.dll… |
CVE-2020-5802 | High | 7.5 | 2020-12-29 | An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specially crafted ConfigureItems message to TC… |
CVE-2020-35359 | High | 7.5 | 2020-12-26 | Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit. |
CVE-2020-24658 | High | 7.8 | 2020-12-24 | Arm Compiler 5 through 5.06u6 has an error in a stack protection feature designed to help spot stack-based buffer overflows in local arrays. When this feature… |
CVE-2020-29487 | High | 7.5 | 2020-12-15 | An issue was discovered in Xen XAPI before 2020-12-15. Certain xenstore keys provide feedback from the guest, and are therefore watched by toolstack. Specifica… |
CVE-2020-29486 | Medium | 6.0 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Nodes in xenstore have an ownership. In oxenstored, a owner could give a node away. However, node ownership has… |
CVE-2020-29570 | Medium | 6.2 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into the control block is… |
CVE-2020-29568 | Medium | 6.5 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events… |
CVE-2020-29567 | Medium | 6.2 | 2020-12-15 | An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of IRQ handling, IRQ vectors are dynamically allocated and de-alloc… |
CVE-2020-27029 | Medium | 6.5 | 2020-12-15 | In TextView of TextView.java, there is a possible app hang due to improper input validation. This could lead to remote denial of service with no additional exe… |
CVE-2020-25652 | Medium | 5.5 | 2020-11-26 | A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in `/run/… |
CVE-2020-25650 | Medium | 5.5 | 2020-11-25 | A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user wit… |
CVE-2020-8037 | High | 7.5 | 2020-11-04 | The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. |
CVE-2020-28030 | High | 7.5 | 2020-11-02 | In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset a… |
CVE-2020-27978 | High | 7.5 | 2020-10-28 | Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhau… |
CVE-2020-25648 | High | 7.5 | 2020-10-20 | A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a… |
CVE-2020-27173 | High | 7.5 | 2020-10-16 | In vm-superio before 0.1.1, the serial console FIFO can grow to unlimited memory usage when data is sent to the input source (i.e., standard input). This behav… |
CVE-2020-13342 | Low | 2.7 | 2020-10-07 | An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email |
CVE-2020-5982 | Medium | 4.4 | 2020-10-02 | NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) scheduler, in which the software does not pro… |
CVE-2020-15213 | Medium | 4.0 | 2020-09-25 | In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a denial of service by causing an out of memory allocation in the impl… |
CVE-2020-3569 | High | 8.6 | 2020-09-23 | Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote atta… |
CVE-2020-0353 | Medium | 6.5 | 2020-09-17 | In libmp4extractor, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execu… |
CVE-2020-10758 | High | 7.5 | 2020-09-16 | A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, al… |
CVE-2020-13306 | Low | 3.7 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attack… |
CVE-2020-15168 | Low | 2.6 | 2020-09-10 | node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the l… |
CVE-2020-3566 | High | 8.6 | 2020-08-29 | A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to e… |
CVE-2020-8203 | High | 7.4 | 2020-07-15 | Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. |
CVE-2020-15100 | Low | 2.8 | 2020-07-14 | In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been patched in 0.1.1. |
CVE-2020-15570 | Medium | 5.5 | 2020-07-06 | The parse_report() function in whoopsie.c in Whoopsie through 0.2.69 mishandles memory allocation failures, which allows an attacker to cause a denial of servi… |
CVE-2020-12605 | High | 7.5 | 2020-07-01 | Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with… |
CVE-2020-9494 | High | 7.5 | 2020-06-24 | Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to… |
CVE-2017-18899 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting. |
CVE-2019-20880 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a denial of service (memory consumption) via… |
CVE-2019-20845 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a large Slack import. |
CVE-2020-14405 | Medium | 6.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size. |
CVE-2020-13250 | High | 7.5 | 2020-06-11 | HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of… |
CVE-2020-0160 | High | 8.8 | 2020-06-11 | In setSyncSampleParams of SampleTable.cpp, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service wit… |
CVE-2020-10705 | High | 7.5 | 2020-06-10 | A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memor… |
CVE-2019-20818 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows memory consumption because data is created for each page of an application level. |
CVE-2019-20814 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.12. It allows memory consumption because data is created for each page of an application level. |
CVE-2020-13114 | High | 7.5 | 2020-05-21 | An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of comp… |
CVE-2020-12697 | Medium | 5.3 | 2020-05-13 | The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries. |
CVE-2020-10717 | Low | 3.3 | 2020-05-04 | A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs is meant to share a… |
CVE-2019-15234 | High | 7.5 | 2020-04-27 | SHAREit through 4.0.6.177 does not check the full message length from the received packet header (which is used to allocate memory for the next set of data). T… |
CVE-2019-14941 | High | 7.5 | 2020-04-27 | SHAREit through 4.0.6.177 does not check the body length from the received packet header (which is used to allocate memory for the next set of data). This coul… |
CVE-2020-11612 | High | 7.5 | 2020-04-07 | The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large Zl… |
CVE-2020-8552 | Medium | 5.3 | 2020-03-27 | The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack… |
CVE-2020-8551 | Medium | 4.3 | 2020-03-27 | The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet… |
CVE-2020-10364 | High | 7.5 | 2020-03-23 | The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and ca… |
CVE-2020-9345 | Medium | 6.5 | 2020-03-20 | An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. It is possible to perform a Denial of Service att… |
CVE-2019-11939 | High | 7.5 | 2020-03-18 | Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients co… |
CVE-2019-3553 | High | 7.5 | 2020-03-10 | C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could… |
CVE-2019-11938 | High | 7.5 | 2020-03-10 | Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients coul… |
CVE-2020-8659 | High | 7.5 | 2020-03-04 | CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks. |
CVE-2018-21035 | High | 7.5 | 2020-02-28 | In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier… |
CVE-2019-4720 | High | 7.5 | 2020-01-31 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker… |