CWE-770 · Allocation of Resources Without Limits or Throttling (page 24)
Page 24 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7219 | High | 7.5 | 2020-01-31 | HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of servic… |
CVE-2020-7218 | High | 7.5 | 2020-01-31 | HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service… |
CVE-2020-8416 | High | 7.5 | 2020-01-29 | IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port. |
CVE-2020-7052 | Medium | 6.5 | 2020-01-24 | CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition. |
CVE-2020-7226 | High | 7.5 | 2020-01-24 | CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode o… |
CVE-2020-6610 | Medium | 6.5 | 2020-01-08 | GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read_sections_map in decode_r2007.c. |
CVE-2019-14834 | Low | 3.7 | 2020-01-07 | A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory consumption) via v… |
CVE-2019-20019 | Medium | 6.5 | 2019-12-27 | An attempted excessive memory allocation was discovered in Mat_VarRead5 in mat5.c in matio 1.5.17. |
CVE-2019-20015 | Medium | 6.5 | 2019-12-27 | An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_LWPOLYLINE_private in dwg.spec. |
CVE-2019-20013 | Medium | 6.5 | 2019-12-27 | An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in decode_3dsolid in dwg.spec. |
CVE-2019-20012 | Medium | 6.5 | 2019-12-27 | An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_HATCH_private in dwg.spec. |
CVE-2019-20009 | Medium | 6.5 | 2019-12-27 | An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_SPLINE_private in dwg.sp… |
CVE-2019-19958 | Medium | 6.5 | 2019-12-24 | In libIEC61850 1.4.0, StringUtils_createStringFromBuffer in common/string_utilities.c has an integer signedness issue that could lead to an attempted excessive… |
CVE-2019-16770 | Medium | 5.3 | 2019-12-05 | In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service atta… |
CVE-2019-11923 | High | 7.5 | 2019-12-04 | In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced, allowing for reso… |
CVE-2019-15593 | Medium | 6.5 | 2019-11-22 | GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Commen… |
CVE-2019-12406 | Medium | 6.5 | 2019-11-06 | Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial… |
CVE-2019-6120 | High | 7.5 | 2019-11-06 | An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a larg… |
CVE-2019-5043 | High | 7.5 | 2019-10-31 | An exploitable denial-of-service vulnerability exists in the Weave daemon of the Nest Cam IQ Indoor, version 4620002. A set of TCP connections can cause unrest… |
CVE-2019-10079 | High | 7.5 | 2019-10-22 | Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent f… |
CVE-2019-12611 | Medium | 4.4 | 2019-10-17 | An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reliability of the product. Specially crafted packets… |
CVE-2019-17583 | High | 7.5 | 2019-10-14 | idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonstrated by the adminc… |
CVE-2018-5743 | High | 7.5 | 2019-10-09 | By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable paramete… |
CVE-2019-17359 | High | 7.5 | 2019-10-08 | The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted… |
CVE-2019-17351 | Medium | 6.5 | 2019-10-08 | An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of… |
CVE-2019-16865 | High | 7.5 | 2019-10-04 | An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memor… |
CVE-2019-15165 | Medium | 5.3 | 2019-10-03 | sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. |
CVE-2019-14958 | High | 7.5 | 2019-10-02 | JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. In a very specific situation, it could lead to a r… |
CVE-2019-12714 | Medium | 6.5 | 2019-10-02 | A vulnerability in the web-based management interface of Cisco IC3000 Industrial Compute Gateway could allow an authenticated, remote attacker to cause a denia… |
CVE-2019-5031 | High | 8.8 | 2019-10-02 | An exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.4.1.16828. A specially crafted P… |
CVE-2019-17067 | Critical | 9.8 | 2019-10-01 | PuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows attackers to listen on the same port to steal an incoming connect… |
CVE-2019-9291 | High | 8.8 | 2019-09-27 | In Bluetooth, there is a possible remote code execution due to an improper memory allocation. This could lead to remote code execution in Bluetooth with no add… |
CVE-2019-16889 | High | 7.5 | 2019-09-25 | Ubiquiti EdgeMAX devices before 2.0.3 allow remote attackers to cause a denial of service (disk consumption) because *.cache files in /var/run/beaker/container… |
CVE-2019-15736 | High | 7.5 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a den… |
CVE-2019-15722 | High | 7.5 | 2019-09-16 | An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust clie… |
CVE-2019-11060 | High | 7.5 | 2019-08-29 | The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial o… |
CVE-2019-15753 | Critical | 9.1 | 2019-08-28 | In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet floodi… |
CVE-2019-15544 | High | 7.5 | 2019-08-26 | An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls. |
CVE-2019-4338 | High | 7.5 | 2019-08-20 | IBM Security Guardium Big Data Intelligence 4.0 (SonarG) does not properly restrict the size or amount of resources that are requested or influenced by an acto… |
CVE-2019-11924 | High | 7.5 | 2019-08-20 | A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exha… |
CVE-2019-15225 | High | 7.5 | 2019-08-19 | In Envoy through 1.11.1, users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may… |
CVE-2019-9012 | High | 7.5 | 2019-08-15 | An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS prod… |
CVE-2019-9518 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with a… |
CVE-2019-9517 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 w… |
CVE-2019-9516 | Medium | 6.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length… |
CVE-2019-9515 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to t… |
CVE-2019-9514 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an in… |
CVE-2019-9511 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The… |
CVE-2019-10094 | High | 7.8 | 2019-08-02 | A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's Recur… |
CVE-2019-10093 | Medium | 6.5 | 2019-08-02 | In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache T… |
CVE-2019-10088 | High | 8.8 | 2019-08-02 | A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later. |
CVE-2019-10171 | High | 7.5 | 2019-08-02 | It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be… |
CVE-2019-10163 | Medium | 4.3 | 2019-07-30 | A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to cause a high CPU lo… |
CVE-2019-13954 | Medium | 6.5 | 2019-07-26 | Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to memory exhaustion. By sending a crafted HTTP request, an authenticated remote attacke… |
CVE-2019-10972 | Medium | 5.5 | 2019-07-26 | Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability can be triggered when an attacker provides the target with a rogue project fi… |
CVE-2019-13960 | Medium | 5.5 | 2019-07-18 | In libjpeg-turbo 2.0.2, a large amount of memory can be used during processing of an invalid progressive JPEG image containing incorrect width and height value… |
CVE-2019-1010266 | Medium | 6.5 | 2019-07-17 | lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attac… |
CVE-2019-13074 | High | 7.5 | 2019-07-03 | A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing the device to reboot… |
CVE-2019-5599 | High | 7.5 | 2019-07-02 | In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several l… |
CVE-2019-13112 | Medium | 6.5 | 2019-06-30 | A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to an std::bad_… |
CVE-2019-12940 | Medium | 5.9 | 2019-06-24 | LiveZilla Server before 8.0.1.1 is vulnerable to Denial Of Service (memory consumption) in knowledgebase.php via a large integer value of the depth parameter. |
CVE-2019-11479 | High | 7.5 | 2019-06-19 | Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly m… |
CVE-2019-11478 | Medium | 5.3 | 2019-06-19 | Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP S… |
CVE-2018-7821 | High | 7.5 | 2019-05-22 | An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which… |
CVE-2019-1814 | High | 8.6 | 2019-05-16 | A vulnerability in the interactions between the DHCP and TFTP features for Cisco Small Business 300 Series (Sx300) Managed Switches could allow an unauthentica… |
CVE-2019-1806 | High | 7.7 | 2019-05-15 | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Small Business Sx200, Sx300, Sx500, ESW2 Series Managed Switch… |
CVE-2019-1703 | High | 8.6 | 2019-05-03 | A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for the Cisco Firepower 2100 Series could allo… |
CVE-2018-15462 | High | 8.6 | 2019-05-03 | A vulnerability in the TCP ingress handler for the data interfaces that are configured with management access to Cisco Firepower Threat Defense (FTD) Software… |
CVE-2019-3721 | High | 7.5 | 2019-04-25 | Dell EMC Open Manage System Administrator (OMSA) versions prior to 9.3.0 contain an Improper Range Header Processing Vulnerability. A remote unauthenticated at… |
CVE-2019-3882 | Medium | 5.5 | 2019-04-24 | A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio d… |
CVE-2019-10953 | High | 7.5 | 2019-04-17 | ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are suscep… |
CVE-2019-0038 | Medium | 6.5 | 2019-04-10 | Crafted packets destined to the management interface (fxp0) of an SRX340 or SRX345 services gateway may create a denial of service (DoS) condition due to buffe… |
CVE-2019-0031 | High | 7.5 | 2019-04-10 | Specific IPv6 DHCP packets received by the jdhcpd daemon will cause a memory resource consumption issue to occur on a Junos OS device using the jdhcpd daemon c… |
CVE-2019-10723 | Medium | 5.5 | 2019-04-03 | An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocation because nInitial… |
CVE-2019-1002100 | Medium | 6.5 | 2019-04-01 | In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a spe… |
CVE-2019-5739 | High | 7.5 | 2019-03-28 | Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated serv… |
CVE-2019-5737 | High | 7.5 | 2019-03-28 | In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by est… |
CVE-2019-1737 | High | 8.6 | 2019-03-27 | A vulnerability in the processing of IP Service Level Agreement (SLA) packets by Cisco IOS Software and Cisco IOS XE software could allow an unauthenticated, r… |
CVE-2018-12545 | High | 7.5 | 2019-03-27 | In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames contai… |
CVE-2019-5419 | High | 7.5 | 2019-03-27 | There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can c… |
CVE-2019-9705 | Medium | 5.5 | 2019-03-12 | Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) via a large crontab file because an unlimi… |
CVE-2019-1599 | High | 8.6 | 2019-03-07 | A vulnerability in the network stack of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on th… |
CVE-2018-20033 | Critical | 9.8 | 2019-02-25 | A Remote Code Execution vulnerability in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier could allow a remote attacker to… |
CVE-2019-9076 | Medium | 5.5 | 2019-02-24 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an attempted excessive memory allo… |
CVE-2019-9073 | Medium | 5.5 | 2019-02-24 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an attempted excessive memory allo… |
CVE-2019-9072 | Medium | 5.5 | 2019-02-24 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an attempted excessive memory allo… |
CVE-2019-8955 | High | 7.5 | 2019-02-21 | In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relay… |
CVE-2019-6975 | High | 7.5 | 2019-02-11 | Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the… |
CVE-2019-7704 | Medium | 6.5 | 2019-02-10 | wasm::WasmBinaryBuilder::readUserSection in wasm-binary.cpp in Binaryen 1.38.22 triggers an attempt at excessive memory allocation, as demonstrated by wasm-mer… |
CVE-2019-7698 | Medium | 6.5 | 2019-02-10 | An issue was discovered in AP4_Array<AP4_CttsTableEntry>::EnsureCapacity in Core/Ap4Array.h in Bento4 1.5.1-627. Crafted MP4 input triggers an attempt at exces… |
CVE-2019-7582 | High | 8.8 | 2019-02-07 | The readBytes function in util/read.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafted swf file that triggers a memory… |
CVE-2019-7581 | High | 8.8 | 2019-02-07 | The parseSWF_ACTIONRECORD function in util/parser.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafted swf file that tri… |
CVE-2019-7148 | Medium | 6.5 | 2019-01-29 | An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174. Remote attackers could leve… |
CVE-2019-6988 | Medium | 6.5 | 2019-01-28 | An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in ope… |
CVE-2019-6966 | Medium | 6.5 | 2019-01-25 | An issue was discovered in Bento4 1.5.1-628. The AP4_ElstAtom class in Core/Ap4ElstAtom.cpp has an attempted excessive memory allocation related to AP4_Array<A… |
CVE-2019-6486 | High | 8.2 | 2019-01-24 | Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or… |
CVE-2019-1644 | High | 7.5 | 2019-01-23 | A vulnerability in the UDP protocol implementation for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to exhaust sy… |
CVE-2019-0010 | High | 7.5 | 2019-01-15 | An SRX Series Service Gateway configured for Unified Threat Management (UTM) may experience a system crash with the error message "mbuf exceed" -- an indicatio… |
CVE-2019-0005 | Medium | 5.3 | 2019-01-15 | On EX2300, EX3400, EX4600, QFX3K and QFX5K series, firewall filter configuration cannot perform packet matching on any IPv6 extension headers. This issue may a… |
CVE-2018-16846 | Medium | 6.5 | 2019-01-15 | It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices. |