CWE-770 · Allocation of Resources Without Limits or Throttling (page 25)
Page 25 of 26 — CVEs classified under CWE-770, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-16865 | High | 7.8 | 2019-01-11 | An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entrie… |
CVE-2018-16864 | High | 7.8 | 2019-01-11 | An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program w… |
CVE-2018-15460 | High | 8.6 | 2019-01-10 | A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remo… |
CVE-2018-15458 | Medium | 5.3 | 2019-01-10 | A vulnerability in the Shell Access Filter feature of Cisco Firepower Management Center (FMC), when used in conjunction with remote authentication, could allow… |
CVE-2018-20659 | Medium | 6.5 | 2019-01-02 | An issue was discovered in Bento4 1.5.1-627. The AP4_StcoAtom class in Core/Ap4StcoAtom.cpp has an attempted excessive memory allocation when called from AP4_A… |
CVE-2018-20652 | Medium | 6.5 | 2019-01-01 | An attempted excessive memory allocation was discovered in the function tinyexr::AllocateImage in tinyexr.h in tinyexr v0.9.5. Remote attackers could leverage… |
CVE-2018-20421 | High | 7.5 | 2018-12-24 | Go Ethereum (aka geth) 1.8.19 allows attackers to cause a denial of service (memory consumption) by rewriting the length of a dynamic array in memory, and then… |
CVE-2018-20095 | Medium | 6.5 | 2018-12-12 | An issue was discovered in EnsureCapacity in Core/Ap4Array.h in Bento4 1.5.1-627. Crafted MP4 input triggers an attempt at excessive memory allocation, as demo… |
CVE-2018-1779 | High | 7.5 | 2018-11-20 | IBM API Connect 2018.1 through 2018.3.7 could allow an unauthenticated attacker to cause a denial of service due to not setting limits on JSON payload size. IB… |
CVE-2018-14660 | Medium | 6.5 | 2018-11-01 | A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, authenticated attacker… |
CVE-2018-15404 | Medium | 6.5 | 2018-10-05 | A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote att… |
CVE-2018-15399 | Medium | 6.8 | 2018-10-05 | A vulnerability in the TCP syslog module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an u… |
CVE-2018-15383 | High | 7.5 | 2018-10-05 | A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) S… |
CVE-2018-15373 | High | 7.4 | 2018-10-05 | A vulnerability in the implementation of Cisco Discovery Protocol functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated… |
CVE-2018-1647 | High | 7.5 | 2018-10-05 | IBM QRadar Incident Forensics 7.2 and 7.3 does not properly restrict the size or amount of resources requested which could allow an unauthenticated user to cau… |
CVE-2018-16645 | Medium | 6.5 | 2018-09-06 | There is an excessive memory allocation issue in the functions ReadBMPImage of coders/bmp.c and ReadDIBImage of coders/dib.c in ImageMagick 7.0.8-11, which all… |
CVE-2018-10908 | Medium | 6.5 | 2018-08-09 | It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attac… |
CVE-2016-9578 | High | 7.5 | 2018-07-27 | A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted me… |
CVE-2017-2587 | Low | 3.3 | 2018-07-27 | A memory allocation vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the application to crash. |
CVE-2018-13033 | Medium | 5.5 | 2018-07-01 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive mem… |
CVE-2018-12934 | High | 7.5 | 2018-06-28 | remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This c… |
CVE-2018-0358 | High | 7.5 | 2018-06-21 | A vulnerability in the file descriptor handling of Cisco TelePresence Video Communication Server (VCS) Expressway could allow an unauthenticated, remote attack… |
CVE-2017-5388 | High | 7.5 | 2018-06-11 | A STUN server in conjunction with a large number of "webkitRTCPeerConnection" objects can be used to send large STUN packets in a short period of time due to a… |
CVE-2018-3738 | Medium | 5.5 | 2018-06-07 | protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files. |
CVE-2018-3737 | High | 7.5 | 2018-06-07 | sshpk is vulnerable to ReDoS when parsing crafted invalid public keys. |
CVE-2018-3711 | High | 7.5 | 2018-06-07 | Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large paylo… |
CVE-2018-11488 | High | 7.5 | 2018-05-29 | A stack exhaustion vulnerability in the search function of dtSearch 7.90.8538.1 and prior allows remote attackers to cause a denial of service condition by sen… |
CVE-2017-2613 | Medium | 5.4 | 2018-05-15 | jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most… |
CVE-2018-10971 | Medium | 5.5 | 2018-05-10 | An issue was discovered in Free Lossless Image Format (FLIF) 0.3. The Plane function in image/image.hpp allows remote attackers to cause a denial of service (a… |
CVE-2018-10237 | Medium | 5.9 | 2018-04-26 | Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that d… |
CVE-2018-0239 | High | 7.5 | 2018-04-19 | A vulnerability in the egress packet processing functionality of the Cisco StarOS operating system for Cisco Aggregation Services Router (ASR) 5700 Series devi… |
CVE-2018-1274 | High | 7.5 | 2018-04-18 | Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited r… |
CVE-2017-18258 | Medium | 6.5 | 2018-04-08 | The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, beca… |
CVE-2017-18229 | Medium | 6.5 | 2018-03-14 | An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allows at… |
CVE-2018-7582 | High | 7.5 | 2018-03-09 | WebLog Expert Web Server Enterprise 9.4 allows Remote Denial Of Service (daemon crash) via a long HTTP Accept Header to TCP port 9991. |
CVE-2017-18219 | Medium | 6.5 | 2018-03-05 | An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows a… |
CVE-2018-7443 | Medium | 6.5 | 2018-02-23 | The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-23 Q16 does not properly validate the amount of image data in a file, which allows remote atta… |
CVE-2018-6869 | Medium | 6.5 | 2018-02-09 | In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function of zzip/zip.c. Remote attackers could le… |
CVE-2018-0137 | High | 8.6 | 2018-02-08 | A vulnerability in the TCP throttling process of Cisco Prime Network could allow an unauthenticated, remote attacker to cause a denial of service (DoS) conditi… |
CVE-2018-5783 | Medium | 5.5 | 2018-01-19 | In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVecObjects.h). Remote attackers could lever… |
CVE-2017-13190 | High | 7.5 | 2018-01-12 | A vulnerability in the Android media framework (libhevc) related to handling ps_codec_obj memory allocation failures. Product: Android. Versions: 7.0, 7.1.1, 7… |
CVE-2017-13189 | High | 7.5 | 2018-01-12 | A vulnerability in the Android media framework (libavc) related to handling dec_hdl memory allocation failures. Product: Android. Versions: 7.0, 7.1.1, 7.1.2… |
CVE-2017-18028 | Medium | 6.5 | 2018-01-12 | In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allow remote attackers to cause a… |
CVE-2018-0006 | Medium | 6.5 | 2018-01-10 | A high rate of VLAN authentication attempts sent from an adjacent host on the local broadcast domain can trigger high memory utilization by the BBE subscriber… |
CVE-2017-15124 | High | 7.5 | 2018-01-09 | VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle… |
CVE-2018-5296 | Medium | 5.5 | 2018-01-08 | In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PdfParser::ReadXRefSubsection function (base/PdfParser.cpp). Remote attackers could leverage… |
CVE-2018-4868 | Medium | 5.5 | 2018-01-03 | The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of service (excessive memory allocation) via… |
CVE-2017-3883 | High | 8.6 | 2017-10-19 | A vulnerability in the authentication, authorization, and accounting (AAA) implementation of Cisco Firepower Extensible Operating System (FXOS) and NX-OS Syste… |
CVE-2017-14938 | Medium | 5.5 | 2017-09-30 | _bfd_elf_slurp_version_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers t… |
CVE-2017-14531 | Medium | 6.5 | 2017-09-18 | ImageMagick 7.0.7-0 has a memory exhaustion issue in ReadSUNImage in coders/sun.c. |
CVE-2017-0771 | Medium | 5.5 | 2017-09-08 | A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-37624243. |
CVE-2017-6780 | High | 7.5 | 2017-09-07 | A vulnerability in the TCP throttling process for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to cause the syste… |
CVE-2017-12693 | Medium | 6.5 | 2017-09-01 | The ReadBMPImage function in coders/bmp.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted BMP fi… |
CVE-2017-12692 | Medium | 6.5 | 2017-09-01 | The ReadVIFFImage function in coders/viff.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted VIFF… |
CVE-2017-12691 | Medium | 6.5 | 2017-09-01 | The ReadOneLayer function in coders/xcf.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted file. |
CVE-2017-14107 | Medium | 6.5 | 2017-09-01 | The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory… |
CVE-2017-13763 | High | 7.5 | 2017-08-30 | ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited. |
CVE-2017-12875 | Medium | 6.5 | 2017-08-29 | The WritePixelCachePixels function in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (CPU consumption) via a crafted file. |
CVE-2017-13716 | Medium | 5.5 | 2017-08-28 | The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excess… |
CVE-2017-13133 | Medium | 6.5 | 2017-08-23 | In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory… |
CVE-2017-8253 | High | 7.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, kernel memory can potentially be overwritten if an invalid master is sent from… |
CVE-2017-12944 | High | 7.5 | 2017-08-18 | The TIFFReadDirEntryArray function in tif_read.c in LibTIFF 4.0.8 mishandles memory allocation for short files, which allows remote attackers to cause a denial… |
CVE-2017-0725 | Medium | 5.5 | 2017-08-09 | A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-37627194. |
CVE-2017-12643 | Medium | 6.5 | 2017-08-07 | ImageMagick 7.0.6-1 has a memory exhaustion vulnerability in ReadOneJNGImage in coders\png.c. |
CVE-2017-12563 | Medium | 6.5 | 2017-08-05 | In ImageMagick 7.0.6-2, a memory exhaustion vulnerability was found in the function ReadPSDImage in coders/psd.c, which allows attackers to cause a denial of s… |
CVE-2017-12435 | High | 7.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of s… |
CVE-2017-12432 | Medium | 6.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadPCXImage in coders/pcx.c, which allows attackers to cause a denial of s… |
CVE-2017-12430 | High | 7.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of s… |
CVE-2017-12429 | High | 7.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of… |
CVE-2017-12144 | Medium | 5.5 | 2017-08-02 | In ytnef 1.9.2, an allocation failure was found in the function TNEFFillMapi in ytnef.c, which allows attackers to cause a denial of service via a crafted file. |
CVE-2017-12132 | Medium | 5.9 | 2017-08-01 | The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name s… |
CVE-2017-1227 | High | 7.5 | 2017-07-31 | IBM Tivoli Endpoint Manager could allow a unauthorized user to consume all resources and crash the system. IBM X-Force ID: 123906. |
CVE-2017-11525 | Medium | 6.5 | 2017-07-23 | The ReadCINImage function in coders/cin.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service (memory con… |
CVE-2017-11468 | High | 7.5 | 2017-07-20 | Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cau… |
CVE-2017-6713 | Critical | 9.8 | 2017-07-06 | A vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to gain full access to the aff… |
CVE-2017-9778 | Medium | 5.5 | 2017-06-21 | GNU Debugger (GDB) 8.0 and earlier fails to detect a negative length field in a DWARF section. A malformed section in an ELF binary or a core file can cause GD… |
CVE-2017-6640 | Critical | 9.8 | 2017-06-08 | A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attacker to log in to the administrative cons… |
CVE-2017-9350 | High | 7.5 | 2017-06-02 | In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-op… |
CVE-2017-6653 | High | 7.5 | 2017-05-22 | A vulnerability in the TCP throttling process for the GUI of the Cisco Identity Services Engine (ISE) 2.1(0.474) could allow an unauthenticated, remote attacke… |
CVE-2017-6641 | High | 7.5 | 2017-05-22 | A vulnerability in the TCP connection handling functionality of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to… |
CVE-2017-9039 | Medium | 5.5 | 2017-05-18 | GNU Binutils 2.28 allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file with many program headers, related to the ge… |
CVE-2017-0612 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute… |
CVE-2017-8779 | High | 7.5 | 2017-05-04 | rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory… |
CVE-2017-3555 | High | 7.5 | 2017-04-24 | Vulnerability in the Oracle iReceivables component of Oracle E-Business Suite (subcomponent: Self Registration). Supported versions that are affected are 12.1… |
CVE-2017-7963 | High | 7.5 | 2017-04-19 | The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and appli… |
CVE-2017-7696 | High | 7.5 | 2017-04-14 | SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service (memory consumption) via large values in the width a… |
CVE-2017-5850 | High | 7.5 | 2017-03-27 | httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using an HTTP Range header. |
CVE-2017-5835 | High | 7.5 | 2017-03-03 | libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero. |
CVE-2016-8576 | Medium | 6.0 | 2016-11-04 | The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop… |
CVE-2016-4074 | High | 7.5 | 2016-05-06 | The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. Thi… |
CVE-2011-0419 | | 2011-05-16 | Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Se… | |
CVE-2009-4017 | | 2009-11-24 | PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows… | |
CVE-2009-2054 | | 2009-08-27 | Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x, 5.x before 5.1(3g), 6.x before 6.1(4), 7.0 before 7.0(2a)su1, and 7.1 before 7.1(2a)… | |
CVE-2009-2726 | | 2009-08-12 | The SIP channel driver in Asterisk Open Source 1.2.x before 1.2.34, 1.4.x before 1.4.26.1, 1.6.0.x before 1.6.0.12, and 1.6.1.x before 1.6.1.4; Asterisk Busine… | |
CVE-2009-2540 | | 2009-07-20 | Opera, possibly 9.64 and earlier, allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property o… | |
CVE-2008-5180 | Medium | 5.3 | 2008-11-20 | Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large n… |
CVE-2008-2364 | | 2008-06-13 | The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of… | |
CVE-2008-1700 | | 2008-04-08 | The Web TransferCtrl Class 8,2,1,4 (iManFile.cab), as used in WorkSite Web 8.2 before SP1 P2, allows remote attackers to cause a denial of service (memory cons… | |
CVE-2005-4650 | Medium | 5.3 | 2005-12-31 | Joomla! 1.03 does not restrict the number of "Search" Mambots, which allows remote attackers to cause a denial of service (resource consumption) via a large nu… |
CVE-2005-2970 | | 2005-10-25 | Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via… |