cve.bz

CWE-400: Uncontrolled Resource Consumption, page 51

Filter

The product does not properly control the allocation and maintenance of a limited resource.

What the weakness is: CWE-400 at MITRE

Ask an AI about CWE-400

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-400: Uncontrolled Resource Consumption and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/400.html and https://cve.bz/cve/cwe/400?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2023-42521EPSS 0.6%

    Certain WithSecure products allow a remote crash of a scanning engine via processing of a compressed file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Eleme…

  2. 7.5CVE-2023-42526EPSS 0.6%

    Certain WithSecure products allow a remote crash of a scanning engine via decompression of crafted data files. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure E…

  3. 7.5CVE-2023-42520EPSS 0.6%

    Certain WithSecure products allow a remote crash of a scanning engine via unpacking of crafted data files. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Eleme…

  4. 2.7CVE-2023-37263EPSS 0.6%

    Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't…

  5. 5.5CVE-2023-32665EPSS 0.4%

    A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

  6. 7.5CVE-2023-32636EPSS 0.8%

    A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does n…

  7. 5.5CVE-2023-32611EPSS 0.4%

    A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.

  8. 7.5CVE-2023-29499EPSS 0.8%

    A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.

  9. 5.5CVE-2023-42503EPSS 0.6%

    Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, …

  10. 4.9CVE-2023-26141EPSS 0.9%

    Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will…

  11. 7.5CVE-2023-38162EPSS 11%

    DHCP Server Service Denial of Service Vulnerability

  12. 7.5CVE-2023-38149EPSS 4.5%

    Windows TCP/IP Denial of Service Vulnerability

  13. 6.5CVE-2023-36799EPSS 4.6%

    .NET Core and Visual Studio Denial of Service Vulnerability

  14. 7.5CVE-2022-4896EPSS 1.3%

    Cyber Control, in its 1.650 version, is affected by a vulnerability in the generation on the server of pop-up windows with the messages "PNTMEDIDAS", "PEDIR", "HAYDISCOA" or "SPOOLER". A complete denial of service can be achieved by sendin…

  15. 8.8CVE-2022-48475EPSS 0.6%

    Buffer Overflow vulnerability in Control de Ciber version 1.650, in the printing function. Sending a modified request by the attacker could cause a Buffer Overflow when the adminitrator tries to accept or delete the print query created by …

  16. 7.5CVE-2022-48474EPSS 1.2%

    Control de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the version function. Sending a malicious request could cause the server to check if an unrecognized component is up to date, causing a memory fai…

  17. 8.1CVE-2022-23382EPSS 0.5%

    Shenzhen Hichip Vision Technology IP Camera Firmware V11.4.8.1.1-20170926 has a denial of service vulnerability through sending a crafted multicast message in a local network.

  18. 7.5CVE-2023-36161EPSS 0.7%

    An issue was discovered in Qubo Smart Plug 10A version HSP02_01_01_14_SYSTEM-10A, allows attackers to cause a denial of service (DoS) via Wi-Fi deauthentication.

  19. 7.5CVE-2023-39321EPSS 1.3%

    Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

  20. 6.5CVE-2023-40584EPSS 1.4%

    Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component…

  21. 7.5CVE-2023-40591EPSS 1.1%

    go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix …

  22. 6.5CVE-2023-28188EPSS 0.8%

    A denial-of-service issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. A remote user may be able to cause a denial-of-service.

  23. 4.4CVE-2023-4162EPSS 0.2%

    A segmentation fault can occur in Brocade Fabric OS after Brocade Fabric OS v9.0 and before Brocade Fabric OS v9.2.0a through the passwdcfg command. This could allow an authenticated privileged user local user to crash a Brocade Fabri…

  24. 7.5CVE-2023-40594EPSS 0.4%

    In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance.

  25. 7.5CVE-2023-40593EPSS 0.6%

    In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or han…

  26. 7.5CVE-2023-41121EPSS 0.8%

    Array AG OS before 9.4.0.499 allows denial of service: remote attackers can cause system service processes to crash through abnormal HTTP operations.

  27. 7.5CVE-2023-40586EPSS 0.7%

    OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately…

  28. 7.5CVE-2023-40583EPSS 1.0%

    libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote nod…

  29. 7.5CVE-2023-41173EPSS 0.8%

    AdGuard DNS before 2.2 allows remote attackers to cause a denial of service via malformed UDP packets.

  30. 7.5CVE-2023-4418EPSS 0.8%

    A remote unprivileged attacker can sent multiple packages to the LMS5xx to disrupt its availability through a TCP SYN-based denial-of-service (DDoS) attack. By exploiting this vulnerability, an attacker can flood the targeted LMS5xx with …

  31. 7.5CVE-2023-40710EPSS 0.6%

    An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and …

  32. 7.5CVE-2023-40709EPSS 0.6%

    An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Fi…

  33. 8.1CVE-2023-37379EPSS 2.0%

    Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exp…

  34. 7.5CVE-2022-48571EPSS 1.1%

    memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP.

  35. 6.5CVE-2022-48564EPSS 1.7%

    read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.

  36. 5.5CVE-2022-48063EPSS 0.4%

    GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.

  37. 7.8CVE-2022-47696EPSS 0.4%

    An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols.

  38. 7.8CVE-2022-47695EPSS 0.4%

    An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_synthetic_symtab in match-o.c.

  39. 6.5CVE-2022-37050EPSS 1.1%

    In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that …

  40. 7.5CVE-2020-26652EPSS 0.7%

    An issue was discovered in function nl80211_send_chandef in rtl8812au v5.6.4.2 allows attackers to cause a denial of service.

  41. 7.5CVE-2020-20813EPSS 0.9%

    Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet.

  42. 8.8CVE-2020-19726EPSS 0.8%

    An issue was discovered in binutils libbfd.c 2.36 relating to the auxiliary symbol data allows attackers to read or write to system memory or cause a denial of service.

  43. 5.5CVE-2020-18770EPSS 0.3%

    An issue was discovered in function zzip_disk_entry_to_file_header in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service.

  44. 7.5CVE-2023-39748EPSS 0.8%

    An issue in the component /userRpm/NetworkCfgRpm of TP-Link TL-WR1041N V2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.

  45. 6.0CVE-2023-4394EPSS 0.2%

    A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volumes.c in btrfs file-system in the Linux Kernel. This flaw allows a local attacker with special privileges to cause a system crash or leak internal kernel infor…

  46. 7.5CVE-2023-38737EPSS 1.0%

    IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memo…

  47. 5.5CVE-2023-21280EPSS 0.09%

    In setMediaButtonBroadcastReceiver of MediaSessionRecord.java, there is a possible permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not…

  48. 7.5CVE-2023-38741EPSS 1.0%

    IBM TXSeries for Multiplatforms 8.1, 8.2, and 9.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting a slowloris-type attacks, a remote attacker could exploit th…

  49. 6.5CVE-2021-29057EPSS 0.6%

    An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service.

  50. 4.4CVE-2023-28938EPSS 0.2%

    Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.