3995 matches found
CVE-2025-13836 Excessive read buffering DoS in http.client
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS...
CVE-2025-13836
CVE-2025-13836 affects Python CPython: when reading an HTTP response with no explicit read amount, the client may default to Content-Length, enabling a malicious server to cause excessive data buffering and potential OOM/DoS. Public advisories confirm fixes in multiple distributions and versions ...
Lack of Sufficient Guardrails Lead to Excessive Agency (LLM08) in Some LLM Applications
Overview Retell AI's API creates AI voice agents that have excessive permissions and functionality, as a result of insufficient amounts of guardrails. As a result, attackers can exploit this and conduct large scale social engineering, phishing, and misinformation campaigns. Description Retell AI...
EPSON WebConfig / Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts
Overview EPSON WebConfig / Epson Web Control for SEIKO EPSON Projector Products provided by SEIKO EPSON CORPORATION contain the following vulnerability. Improper restriction of excessive authentication attempts CWE-307 - CVE-2025-64310 Vladislav Khegay and Aigerim Alibek of Astana IT University...
EUVD-2025-198375
EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrative user's password may be identified through a brute force attack...
EUVD-2025-198137
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM before v1.6 allows Excessive Allocation via network...
CVE-2025-11243
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM before v1.6 allows Excessive Allocation via network...
CVE-2025-11243 Allocation of Resources Without Limits or Throttling in Shelly Pro 4PM
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM before v1.6 allows Excessive Allocation via network...
PT-2025-47440
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM before v1.6 allows Excessive Allocation via network...
GO-2025-4104 KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes in github.com/kubevirt/kubevirt
KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes in github.com/kubevirt/kubevirt. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...
MAL-2025-184857 Malicious code in poliaz-alai-yulabaivuku (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a1f5a742ccc98a25f09da015a518151cf6cf0b56427ca06497714b8ab4c0b49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-131907
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint...
CVE-2025-11566
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint...
CVE-2025-11566
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint...
PT-2025-46658
Name of the Vulnerable Software and Affected Versions versions prior to 2025 affected versions not specified Description An issue exists that allows an attacker on the local network to gain access to a user account by performing an arbitrary number of authentication attempts with different...
EUVD-2025-105442
Malicious code in excessivetarantulaz3n npm...
EUVD-2025-84351
Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication Bypass, Functionality Bypass.This iss...
MAL-2025-113761 Malicious code in excessive_reptile_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aabda860a15b3a1e49b22a3a6260ab8cb8df74332f5b0a6e36717e45cd518fef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...