CWE-1284.

Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS

• OpenSSL
• CWE-1284

mpp vulnerable to Gas Draining with low gas limit

• CWE-20
• CWE-1284

>=0.2.0, <0.6.0 · fixed in 0.6.0

mpp vulnerable to Gas Draining with access list

• CWE-20
• CWE-1284

>=0.2.0, <0.6.0 · fixed in 0.6.0

mpp vulnerable to Gas Draining with no limit

• CWE-20
• CWE-1284

>=0.2.0, <0.6.0 · fixed in 0.6.0

Withdrawn Advisory: sprintf-js vulnerable to denial of service through unbounded precision specifiers

• CWE-1284

<=1.1.3 · no fixed version yet

redis-parser through 3.0.0 Denial of Service via Invalid Array Length

• NodeRedis redis-parser
• CWE-1284

Security Policy Bypass in Forcepoint Security Engine (NGFW)

• Forcepoint Security Engine (NGFW)
• CWE-183
• CWE-1284

Potential denial of service when configured to send Retry packets in s2n-quic

• AWS s2n-quic
• Denial of service
• CWE-1284

MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI

• MikroTik RouterOS
• CWE-1284

Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free

• CWE-1284

>=0.14.0, <0.16.2 · fixed in 0.16.2

CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`

• 1Panel-dev CordysCRM
• SQL injection
• CWE-1284

source-map-js allows event-loop denial of service through indexed source-map section offsets

• CWE-1284

>=1.0.0, <1.2.2 · fixed in 1.2.2

Multiple vulnerabilities in IBM Controller

• IBM Controller
• CWE-1284

OpenSlide: Arbitrary memory write with crafted Ventana BIF file

• openslide
• CWE-123
• CWE-823

BlueKitchen BTstack through 1.8.2 A2DP SEP Discovery Out-of-Bounds Write

• BlueKitchen GmbH BTstack
• Memory corruption
• CWE-1284

Security Advisory 0171

• Arista Networks EOS
• Memory corruption
• CWE-1284

Missing authentication in Oracle Corporation Oracle Applications Manager

• Oracle Corporation Oracle Applications Manager
• Authentication bypass
• CWE-1284

Http4s: WebSocket decoder accepts negative length, causing infinite decode loop

• http4s
• Denial of service
• CWE-1284

Cisco Secure Email Gateway Security Hardening Release

• Cisco Secure Email
• Cisco Secure Email and Web Manager
• CWE-1284

An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920.

• Samsung Exynos 8890 firmware
• CWE-1284

t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes

• tdunning t-digest
• CWE-1284

An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml.

• OCaml mirage-crypto-pk
• CWE-1284

Google Chrome: Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36…

• Google Chrome
• CWE-1284

Improper Payment Validation in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

• PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module
• CWE-1284

An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service (DoS) via sending a crafted L2C…

• CWE-20
• CWE-1284

Eclipse Foundation Eclipse Ankaios: In Eclipse Ankaios versions 0.1.0 through 1.0.1…

• Eclipse Foundation Eclipse Ankaios
• Denial of service
• CWE-1284

Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation

• CWE-1284

>=0.2.0, <0.16.1 · fixed in 0.16.1

Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning

• CWE-1284

>=0.2.0, <0.16.1 · fixed in 0.16.1

Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length

• CWE-1284

>=0.10.0, <3.33.0 · fixed in 3.33.0

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

• Denial of service
• CWE-1284

<6.5.8 · fixed in 6.5.8

eldap does not bound the port component of a referral URL before integer conversion

• Erlang OTP
• CWE-1284

snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

• Erlang OTP
• CWE-1284

uri_string does not bound the port component of a URI before integer conversion

• Erlang OTP
• CWE-1284

httpc does not bound server-supplied numeric header values before integer conversion

• Erlang OTP
• CWE-1284

Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal

• CWE-1284

>=1.28.0, <3.32.2 · fixed in 3.32.2

WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability

• Silk Themes Newspapers X
• CWE-1284

Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals

• Red Hat build of Quarkus 3.27.5.SP1
• Red Hat build of Quarkus 3.33.3.SP1
• CWE-1284

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements

• Denial of service
• CWE-1284

Fireware OS Stack-Based Buffer Overflow in iked Allows Unauthenticated Denial of Service

• WatchGuard Fireware OS
• Memory corruption
• CWE-1284

Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service

• WatchGuard Fireware OS
• Memory corruption
• CWE-1284

Sandbox Escape in ServiceNow AI Platform

• ServiceNow AI Platform
• Code injection
• CWE-693

In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop

• Spring for Apache Kafka
• CWE-1284

GPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memory

• Imagination Technologies Graphics DDK
• CWE-1284

Tor: tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip…

• Tor
• CWE-1284

libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data

• libgit2
• Memory corruption
• CWE-20

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST).

• Oracle Corporation Siebel CRM Integration
• CWE-1284

Uncontrolled Resource Consumption in Capabilities Route in OpenSearch Dashboards

• OpenSearch Dashboards
• AWS Amazon OpenSearch Service
• CWE-1284

WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability

• codepeople Appointment Hour Booking
• CWE-1284

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse

• Memory corruption
• CWE-1284

Improper Access Control

• Tenable, Inc. Security Center
• CWE-1284

rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error

• rsync
• CWE-1284

Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths

• RRWO Net::CIDR::Set
• Denial of service
• CWE-1284

Samsung Open Source rlottie: Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source…

• Samsung Open Source rlottie
• CWE-1284

Resource allocation without limits in Samsung Open Source rlottie

• Samsung Open Source rlottie
• Denial of service
• CWE-1284

Heap Use of Uninitialized Memory in GNU Emacs for Android

• GNU Emacs
• CWE-1284

HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read

• The HDF Group HDF5
• Memory corruption
• CWE-1284

Nbit filter NULL/short parameter-array dereference

• The HDF Group HDF5
• Memory corruption
• CWE-1284

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

• Denial of service
• CWE-1284

>=3.1.0, <3.21.10 || >=4.0.0, <4.5.1 · fixed in 3.21.10, 4.5.1

Cisco Catalyst SD-WAN Security Hardening Release - Memory Corruption Vulnerabilities

• Cisco Catalyst SD-WAN Controller
• Cisco Catalyst SD-WAN Manager
• CWE-1284

imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic

• theotherphil imagecli
• CWE-1284