CWE-835 · Loop with Unreachable Exit Condition (Infinite Loop) (page 6)
Page 6 of 10 — CVEs classified under CWE-835, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-37623 | Medium | 5.5 | 2021-08-09 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2… |
CVE-2021-34334 | Medium | 5.5 | 2021-08-09 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when E… |
CVE-2021-3679 | Medium | 5.5 | 2021-08-05 | A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace ring buffer in a spe… |
CVE-2021-22235 | High | 7.5 | 2021-07-20 | Crash in DNP dissector in Wireshark 3.4.0 to 3.4.6 and 3.2.0 to 3.2.14 allows denial of service via packet injection or crafted capture file |
CVE-2021-34332 | Medium | 5.5 | 2021-07-13 | A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected ap… |
CVE-2021-35515 | High | 7.5 | 2021-07-13 | When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used… |
CVE-2021-36125 | High | 7.5 | 2021-07-02 | An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalRenameRequest page is vulnerable to infinite loops and denial… |
CVE-2021-21279 | High | 7.5 | 2021-06-18 | Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In verions prior to 4.6, an attacker can perform a denial-of-serv… |
CVE-2020-18442 | Low | 3.3 | 2021-06-18 | Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file". |
CVE-2021-30468 | High | 7.5 | 2021-06-16 | A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread gettin… |
CVE-2021-31812 | Medium | 5.5 | 2021-06-12 | In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2… |
CVE-2021-22222 | High | 7.5 | 2021-06-07 | Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet injection or crafted capture file |
CVE-2021-3468 | Medium | 5.5 | 2021-06-02 | A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctl… |
CVE-2021-28676 | High | 7.5 | 2021-06-02 | An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an i… |
CVE-2021-33194 | High | 7.5 | 2021-05-26 | golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input. |
CVE-2020-13602 | Medium | 4.0 | 2021-05-25 | Remote Denial of Service in LwM2M do_write_op_tlv. Zephyr versions >= 1.14.2, >= 2.2.0 contain Improper Input Validation (CWE-20), Loop with Unreachable Exit C… |
CVE-2021-29591 | High | 7.3 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. TFlite graphs must not have loops between nodes. However, this condition was not checked… |
CVE-2021-29510 | Low | 3.3 | 2021-05-13 | Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (o… |
CVE-2021-27385 | High | 7.5 | 2021-05-12 | A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI C… |
CVE-2021-23009 | High | 7.5 | 2021-05-10 | On BIG-IP version 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3, malformed HTTP/2 requests may cause an infinite loop which causes a Denial of Service for Da… |
CVE-2021-29486 | High | 7.5 | 2021-04-30 | cumulative-distribution-function is an open source npm library used which calculates statistical cumulative distribution function from data array of x values… |
CVE-2021-29482 | High | 7.5 | 2021-04-28 | xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format… |
CVE-2021-3508 | Medium | 5.5 | 2021-04-28 | A flaw was found in PDFResurrect in version 0.22b. There is an infinite loop in get_xref_linear_skipped() in pdf.c via a crafted PDF file. |
CVE-2019-25040 | High | 7.5 | 2021-04-27 | Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code… |
CVE-2021-25664 | High | 7.5 | 2021-04-22 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus N… |
CVE-2021-25663 | High | 7.5 | 2021-04-22 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus N… |
CVE-2021-0273 | Medium | 5.3 | 2021-04-22 | An always-incorrect control flow implementation in the implicit filter terms of Juniper Networks Junos OS and Junos OS Evolved on ACX5800, EX9200 Series, MX100… |
CVE-2021-28484 | High | 7.5 | 2021-04-14 | An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not va… |
CVE-2021-1252 | High | 7.5 | 2021-04-08 | A vulnerability in the Excel XLM macro parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote a… |
CVE-2020-36310 | Medium | 5.5 | 2021-04-07 | An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a set_memory_region_test infinite loop for certain nested page faults, ak… |
CVE-2021-22197 | Low | 3.5 | 2021-04-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific ri… |
CVE-2021-28657 | Medium | 5.5 | 2021-03-31 | A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or… |
CVE-2021-20270 | High | 7.5 | 2021-03-23 | An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source… |
CVE-2021-3416 | Medium | 6.0 | 2021-03-18 | A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopba… |
CVE-2021-28667 | High | 7.5 | 2021-03-18 | StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. This can occur if Python 3.x is used, the… |
CVE-2020-11186 | Medium | 5.5 | 2021-03-17 | Modem will enter into busy mode in an infinite loop while parsing histogram dimension due to improper validation of input received in Snapdragon Auto, Snapdrag… |
CVE-2021-25673 | Medium | 5.5 | 2021-03-15 | A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions). An attacker with local access to the system could cause a Denial-of-Service condi… |
CVE-2021-27918 | High | 7.5 | 2021-03-11 | encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of a… |
CVE-2021-20255 | Medium | 5.5 | 2021-03-09 | A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controlle… |
CVE-2020-27618 | Medium | 5.5 | 2021-02-26 | The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388… |
CVE-2020-9307 | Medium | 6.5 | 2021-02-11 | Hirschmann OS2, RSP, and RSPE devices before HiOS 08.3.00 allow a denial of service. An unauthenticated, adjacent attacker can cause an infinite loop on one of… |
CVE-2020-24944 | High | 7.5 | 2021-02-08 | picoquic (before 3rd of July 2020) allows attackers to cause a denial of service (infinite loop) via a crafted QUIC frame, related to the picoquic_decode_frame… |
CVE-2021-22161 | Medium | 6.5 | 2021-02-07 | In OpenWrt 19.07.x before 19.07.7, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upst… |
CVE-2020-36227 | High | 7.5 | 2021-01-26 | A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service. |
CVE-2021-0221 | Medium | 6.5 | 2021-01-15 | In an EVPN/VXLAN scenario, if an IRB interface with a virtual gateway address (VGA) is configured on a PE, a traffic loop may occur upon receipt of specific IP… |
CVE-2021-21235 | Medium | 5.7 | 2021-01-06 | kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifical… |
CVE-2020-28095 | High | 7.5 | 2020-12-30 | On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, a large HTTP POST request sent to the change password API will trigger the router to crash and enter an… |
CVE-2020-29385 | Medium | 5.5 | 2020-12-26 | GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, se… |
CVE-2020-35609 | Medium | 5.5 | 2020-12-22 | A denial-of-service vulnerability exists in the asynchronous ioctl functionality of Microsoft Azure Sphere 20.05. A sequence of specially crafted ioctl calls c… |
CVE-2020-24337 | High | 7.5 | 2020-12-11 | An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. When an unsupported TCP option with zero length is provided in an incoming TCP packet, it is p… |
CVE-2020-17444 | High | 7.5 | 2020-12-11 | An issue was discovered in picoTCP 1.7.0. The routine for processing the next header field (and deducing whether the IPv6 extension headers are valid) doesn't… |
CVE-2020-13986 | High | 7.5 | 2020-12-11 | An issue was discovered in Contiki through 3.0. An infinite loop exists in the uIP TCP/IP stack component when handling RPL extension headers of IPv6 network p… |
CVE-2020-13984 | High | 7.5 | 2020-12-11 | An issue was discovered in Contiki through 3.0. An infinite loop exists in the uIP TCP/IP stack component when processing IPv6 extension headers in ext_hdr_opt… |
CVE-2020-28916 | Medium | 5.5 | 2020-12-04 | hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address. |
CVE-2018-20803 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics proces… |
CVE-2020-16127 | Low | 2.8 | 2020-11-11 | An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations… |
CVE-2020-27152 | Medium | 5.5 | 2020-11-06 | An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper intera… |
CVE-2020-28030 | High | 7.5 | 2020-11-02 | In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset a… |
CVE-2019-18796 | Medium | 6.5 | 2020-10-16 | The BASS Audio Library 2.4.14 under Windows is prone to a BASS_StreamCreateFile Denial of Service vulnerability (infinite loop) via a crafted .mp3 file. This w… |
CVE-2020-26575 | High | 7.5 | 2020-10-06 | In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop. This was addressed in epan/dissectors/packet-fbzero… |
CVE-2020-25641 | Medium | 5.5 | 2020-10-06 | A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could c… |
CVE-2020-15598 | High | 7.5 | 2020-10-06 | Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing… |
CVE-2020-25625 | Medium | 5.3 | 2020-09-25 | hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop. |
CVE-2020-25574 | High | 7.5 | 2020-09-14 | An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of service (e.g., an infin… |
CVE-2020-12457 | High | 7.5 | 2020-08-21 | An issue was discovered in wolfSSL before 4.5.0. It mishandles the change_cipher_spec (CCS) message processing logic for TLS 1.3. If an attacker sends ChangeCi… |
CVE-2019-19643 | High | 7.5 | 2020-08-14 | ise smart connect KNX Vaillant 1.2.839 contain a Denial of Service. |
CVE-2020-0247 | Medium | 5.5 | 2020-08-11 | In Threshold::getHistogram of ImageProcessHelper.java, there is a possible crash loop due to an uncaught exception. This could lead to local denial of service… |
CVE-2020-15654 | Medium | 6.5 | 2020-08-10 | When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are… |
CVE-2020-16845 | High | 7.5 | 2020-08-06 | Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs. |
CVE-2020-5761 | High | 7.5 | 2020-07-29 | Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service. Unauthenticated rem… |
CVE-2019-20911 | Medium | 6.5 | 2020-07-16 | An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to denial of service in bit_calc_CRC in bits.c, related to a for loop. |
CVE-2020-13935 | High | 7.5 | 2020-07-14 | The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to… |
CVE-2019-20907 | High | 7.5 | 2020-07-13 | In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pa… |
CVE-2020-15466 | High | 7.5 | 2020-07-05 | In Wireshark 3.2.0 to 3.2.4, the GVCP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gvcp.c by ensuring that an offset… |
CVE-2019-19506 | High | 7.5 | 2020-06-25 | Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 is vulnerable to a denial of service, caused by an error in the "homeplugd" process. By sending a specially crafted… |
CVE-2020-14448 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service (infinite loop), aka… |
CVE-2020-14447 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-… |
CVE-2020-12885 | High | 7.5 | 2020-06-18 | An infinite loop was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_co… |
CVE-2020-14040 | High | 7.5 | 2020-06-17 | The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the pro… |
CVE-2020-14398 | High | 7.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c. |
CVE-2020-0189 | Medium | 6.5 | 2020-06-11 | In ihevcd_decode() of ihevcd_decode.c, there is possible resource exhaustion due to an infinite loop. This could lead to remote denial of service with no addit… |
CVE-2020-0184 | Medium | 6.5 | 2020-06-11 | In ihevcd_ref_list() of ihevcd_ref_list.c, there is a possible infinite loop due to a missing bounds check. This could lead to remote denial of service with no… |
CVE-2020-0174 | Medium | 6.5 | 2020-06-11 | In Parse_ptbl of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additiona… |
CVE-2020-0172 | Medium | 6.5 | 2020-06-11 | In Parse_art of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional… |
CVE-2020-0171 | Medium | 6.5 | 2020-06-11 | In Parse_lart of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additiona… |
CVE-2020-0170 | Medium | 6.5 | 2020-06-11 | In IMY_Event of eas_imelody.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additio… |
CVE-2020-0169 | Medium | 6.5 | 2020-06-11 | In RTTTL_Event of eas_rtttl.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additio… |
CVE-2020-13808 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows resource consumption via crafted cross-reference stream data. |
CVE-2020-13807 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has circular reference mishandling that causes a loop. |
CVE-2020-12663 | High | 7.5 | 2020-05-19 | Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. |
CVE-2020-12655 | Medium | 5.5 | 2020-05-05 | An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10. Attackers may trigger a sync of excessive duration v… |
CVE-2020-9489 | Medium | 5.5 | 2020-04-27 | A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or i… |
CVE-2013-7488 | High | 7.5 | 2020-04-07 | perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an infinite loop via unexpected input. |
CVE-2020-1951 | Medium | 5.5 | 2020-03-23 | A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23. |
CVE-2020-10675 | High | 7.5 | 2020-03-19 | The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call. |
CVE-2019-8741 | High | 7.5 | 2020-02-28 | A denial of service issue was addressed with improved input validation. |
CVE-2013-3722 | High | 7.5 | 2020-02-17 | A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c. |
CVE-2020-7046 | High | 7.5 | 2020-02-12 | lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthentic… |
CVE-2020-7920 | High | 7.5 | 2020-02-06 | pmm-server in Percona Monitoring and Management (PMM) 2.2.x before 2.2.1 allows unauthenticated denial of service. |
CVE-2020-6855 | Medium | 6.5 | 2020-02-06 | A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to parameterize housekeeping jobs in a… |