Ubuntu 16.04 LTS : pyOpenSSL vulnerabilities (USN-3813-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3813-1 advisory. It was discovered that pyOpenSSL incorrectly handled memory when handling X509 objects. A remote attacker could use this issue to cause pyOpenSSL to cras...

Oracle Linux 7 : binutils (ELSA-2018-3032)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3032 advisory. 2.27-34.base.0.1 - Backport of upstream commit a5def14f1ca70e14d9433cb229c9369fa3051598 Add a test for R386GOT32/R386GOT32X IFUNC reloc error Orabug...

Important: spamassassin

Issue Overview: A flaw was found in the way SpamAssassin processes HTML email containing unclosed HTML tags. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a large number of these messages are sent, a denial of service could occur potentially delayi...

Denial Of Service (DoS)

spray-json is vulnerable to denial of service. An attacker is able to create an object with colliding keys to cause high resource consumption when HashMap creates a map, resulting in a denial of service condition when parsing multiple JSON object fields with the same hash code...

CVE-2018-18853

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service resource consumption because of Algorithmic Complexity during the parsing of a field composed of many decimal digits...

CVE-2018-18853

Lightbend Spray spray-json up to 1.3.4 is affected. The vulnerability is a DoS caused by Algorithmic Complexity during parsing of a field with many decimal digits, allowing remote exploitation over the network with no authentication. Impact is resource consumption/availability degradation; CVSS d...

Keycloak vulnerable to uncontrolled resource consumption

JBoss KeyCloak versions prior to 1.0.3.Final allow remote attackers to create a denial of service resource consumption by supplying a large value in the size parameter to auth/qrcode, related to QR code generation...

GHSA-R32R-3977-CGC3 Keycloak vulnerable to uncontrolled resource consumption

JBoss KeyCloak versions prior to 1.0.3.Final allow remote attackers to create a denial of service resource consumption by supplying a large value in the size parameter to auth/qrcode, related to QR code generation...

Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv

Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where a specially crafted request can cause excess resource consumption in Kestrel...

spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service

A flaw was found in the way SpamAssassin processes HTML email containing unclosed HTML tags. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a large number of these messages are sent, a denial of service could occur potentially delaying or preventing...

EulerOS 2.0 SP3 : php (EulerOS-SA-2018-1310)

According to the version of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An infinite loop vulnerability was found in ext/iconv/iconv.c in PHP due to the iconv stream not rejecting invalid multibyte sequences. A remote...

Code injection

Philips e-Alert Unit non-medical device, Version R2.1 and prior. The software does not properly restrict the size or amount of resources requested or influenced by an actor, which can be used to consume more resources than intended...

Ubiquiti Inc.: Resource Consumption DOS on Edgemax v1.10.6

Resource consumption Denial of service. 1: The request below shows that when you feed the beaker.session.id cookie variable a payload of 250 characters or more, the web management portal will produce an error page showing full path disclosure and more as shown in screenshots error1.png and...

CVE-2018-6923

In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p2, 11.1-RELEASE-p13, ip fragment reassembly code is vulnerable to a denial of service due to excessive system resource consumption. This issue can allow a remote attacker who is able to send an arbitrary ip fragments to cause the machine to consume...

CVE-2018-6923

Removed by vendor...

Denial Of Service (DoS)

mem is vulnerable to denial of service DoS attacks. The library does not clear old results from the cache, consuming resources that can lead to the application crashing...

CVE-2018-16303

PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service resource consumption via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564...

Design/Logic Flaw

RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 in 4.1.x, and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 in 4.0.x contain an Uncontrolled Resource Consumption 'Resource Exhaustion' vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 dat...

CVE-2018-11056

RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 in 4.1.x, and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 in 4.0.x contain an Uncontrolled Resource Consumption 'Resource Exhaustion' vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 dat...

CVE-2018-15607

In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote...