Opera 11.11 allows remote attackers to cause a denial of service (application crash) by setting the FACE attribute of a FONT element within an IFRAME element after changing the SRC attribute of this IFRAME element to an about:blank value.


ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted request to the (1) editnetwork (2) editchan (3) addchan or (4) delchan page in modules/webadmin.cpp.


Xerver 4.32 allows remote authenticated users to cause a denial of service (daemon crash) via a non-numeric web port assignment in the management interface. NOTE: this can be leveraged by non-authenticated attackers using CVE-2009-4657.


acFTP 1.5 allows remote authenticated users to cause a denial of service via a crafted argument to the (1) REST or (2) PBSZ command.


FireBird 2.5.5 allows remote authenticated users to cause a denial of service (daemon crash) by using service manager to invoke the gbak utility with an invalid parameter.


freeFTPd 1.0.10 allows remote authenticated users to cause a denial of service (null dereference and crash) via a PORT command with missing arguments.


TotalPlayer 3.0 allows user-assisted remote attackers to cause a denial of service (application crash) via a large .m3u file. NOTE: this might be a duplicate of CVE-2006-6288.


Emacs 21 allows user-assisted attackers to cause a denial of service (crash) via certain crafted images as demonstrated via a GIF image in vm mode related to image size calculation.


GPSMapEdit 1.1.73.2 allows user-assisted remote attackers to cause a denial of service (crash) via a long string in a lst file.


AyeView 2.20 allows user-assisted attackers to cause a denial of service (memory consumption or application crash) via a bitmap (aka .bmp) file with large height and width values.


AyeView 2.20 allows user-assisted attackers to cause a denial of service (application crash) via a GIF file with a malformed header.


Palo Alto Networks PAN-OS before 6.1.19 7.0.x before 7.0.19 7.1.x before 7.1.13 and 8.0.x before 8.0.6 allows remote attackers to cause a denial of service via vectors related to the management interface.


Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to cause a denial of service (management-server crash) by using the command-line interface for a crafted command aka Ref ID 35254.


Fetchmail 6.2.4 and earlier does not properly allocate memory for long lines which allows remote attackers to cause a denial of service (crash) via a certain email.


6tunnel 0.08 and earlier does not properly close sockets that were initiated by a client which allows remote attackers to cause a denial of service (resource exhaustion) by repeatedly connecting to and disconnecting from the server.


YukiWiki 2.1.3 and earlier does not process a particular request properly that may allow consumption of large amounts of CPU and memory resources and may result in causing a denial of service condition.


HylaFax 4.2.1 and earlier does not create or verify ownership of the UNIX domain socket which might allow local users to read faxes and cause a denial of service by creating the socket using the hyla.unix temporary file.


Canna 3.6 and earlier does not properly validate requests which allows remote attackers to cause a denial of service or information leak.


libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.


CVS 1.12 and earlier on Debian GNU/Linux does not properly handle when a mapping for the current repository does not exist in the cvs-repouids file which allows remote attackers to cause a denial of service (server crash).


LINE 4.3.0.724 and earlier on Windows and 4.3.1 and earlier on OS X allows remote authenticated users to cause a denial of service (application crash) via a crafted post that is mishandled when displaying a Timeline.


Ethereal 0.9.15 and earlier and Tethereal allows remote attackers to cause a denial of service (crash) via certain malformed (1) ISAKMP or (2) MEGACO packets.


Battlefield 1942 1.6.19 and earlier and Battlefield Vietnam 1.2 and earlier allows a remote master server to cause a denial of service (client crash) via a server reply that contains a large numplayers value which triggers a null dereference.


Syslserve 1.058 and earlier and probably 1.059 allows remote attackers to cause a denial of service (hang) via a crafted UDP Syslog packet.


Jenkins 2.218 and earlier LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848.


UltraBoard 1.6 and other versions allow remote attackers to cause a denial of service by referencing UltraBoard in the Session parameter which causes UltraBoard to fork copies of itself.


fetchmail 6.3.0 and other versions before 6.3.2 allows remote attackers to cause a denial of service (crash) via crafted e-mail messages that cause a free of an invalid pointer when fetchmail bounces the message to the originator or local postmaster.


Icecast 1.3.7 and other versions before 1.3.11 with HTTP server file streaming support enabled allows remote attackers to cause a denial of service (crash) via a URL that ends in . (dot) / (forward slash) or \\ (backward slash).


MiniShare 1.5.4 and possibly earlier allows remote attackers to cause a denial of service (application crash) via a flood of requests for new connections.


OpenBSD 3.8 3.9 and possibly earlier versions allows context-dependent attackers to cause a denial of service (kernel panic) by allocating more semaphores than the default.


PlatinumFTP 1.0.18 and possibly earlier versions allows remote attackers to cause a denial of service (server crash) via multiple connection attempts with a \\ (backslash) in the username.


Akfingerd 0.5 and possibly earlier versions only allows one connection at a time and does not time out connections which allows remote attackers to cause a denial of service (refused connections) by opening a connection and not closing it.


WebConnect 6.5 6.4.4 and possibly earlier versions allows remote attackers to cause a denial of service (hang) via a URL containing an MS-DOS device name such as (1) AUX (2) CON (3) PRN (4) COM1 or (5) LPT1.


MySQL 4.1.9 and possibly earlier versions allows remote attackers with certain privileges to cause a denial of service (application crash) via a use command followed by an MS-DOS device name such as (1) LPT1 or (2) PRN.


ZoIPer 2.22 and possibly other versions before 2.24 Library 5324 allows remote attackers to cause a denial of service (crash) via a SIP INVITE request with an empty Call-Info header.


FreeBSD 3.2 and possibly other versions allows a local user to cause a denial of service (panic) with a large number accesses of an NFS v3 mounted directory from a large number of processes.


Winamp 5.07 and possibly other versions allows remote attackers to cause a denial of service (application crash or CPU consumption) via (1) an mp4 or m4a playlist file that contains invalid tag data or (2) an invalid .nsv or .nsa file.


Mozilla 1.6 and possibly other versions allows remote attackers to cause a denial of service (application crash) via a XBM (X BitMap) file with a large (1) height or (2) width value.


netris 0.5 and possibly other versions before 0.52 when running with the -w (wait) option allows remote attackers to cause a denial of service (crash) via a long string to port 9284.


.NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-23267 CVE-2022-29117.


.NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-23267 CVE-2022-29145.


.NET and Visual Studio Denial of Service Vulnerability.


.NET and Visual Studio Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-29117 CVE-2022-29145.


WFTPD and WFTPD Pro 2.41 allows remote attackers to cause a denial of service by executing an MLST command before logging into the server.


WFTPD and WFTPD Pro 2.41 RC12 allows remote attackers to cause a denial of service by sending a long string of unprintable characters.


WFTPD and WFTPD Pro 2.41 allows local users to cause a denial of service by executing the RENAME TO (RNTO) command before a RENAME FROM (RNFR) command.


WFTPD and WFTPD Pro 2.41 allows remote attackers to cause a denial of service by executing a STAT command while the LIST command is still executing.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel a length variable which is used to copy data has a size of only 8 bits and can be exceeded resulting in a denial of service.


The Antivirus component in Comodo Internet Security before 4.1.150349.920 allows remote attackers to cause a denial of service (application crash) via a crafted file.


The Antivirus component in Comodo Internet Security before 3.11.108364.552 allows remote attackers to cause a denial of service (application crash) via a crafted packed file.


The Antivirus component in Comodo Internet Security before 3.11.108364.552 allows remote attackers to cause a denial of service (memory consumption) via a crafted compressed file.


The Antivirus component in Comodo Internet Security before 3.8.64739.471 allows remote attackers to cause a denial of service (application crash) via a crafted file.


The Antivirus component in Comodo Internet Security before 3.8.65951.477 allows remote attackers to cause a denial of service (application crash) via a crafted file.


The Antivirus component in Comodo Internet Security before 5.4.189822.1355 allows remote attackers to cause a denial of service (application crash) via a crafted .PST file.


The Antivirus component in Comodo Internet Security before 5.3.175888.1227 allows remote attackers to cause a denial of service (application crash) via a crafted compressed file.


Cisco AnyConnect Secure Mobility Client 3.0 before 3.0.08057 allows remote authenticated users to cause a denial of service (vpnagentd process crash) via a crafted packet aka Bug ID CSCty01670.


The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests as demonstrated by Slowloris related to the lack of the mod_reqtimeout module in versions before 2.2.15.


asecure as included with HP-UX 10.01 through 11.00 can allow a local attacker to create a denial of service and gain additional privileges via unsafe permissions on the asecure program a different vulnerability than CVE-2000-0083.


Cumin as used in Red Hat Enterprise MRG 2.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted Ajax update request.


Skia as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.


PHPDocX as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to read arbitrary files cause a denial of service or possibly have other impact via an XML External Entity (XXE) attack.


Heimdal as used in Apple OS X through 10.9.2 allows remote attackers to cause a denial of service (abort and daemon exit) via ASN.1 data encountered in the Kerberos 5 protocol.


GeSHi as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10 1.24.x before 1.24.3 and 1.25.x before 1.25.2 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors.


Skia as used in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.


PDFium as used in Google Chrome before 43.0.2357.65 does not properly initialize memory which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Skia as used in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation a different vulnerability than CVE-2012-2883.


Skia as used in Google Chrome before 22.0.1229.92 does not properly render text which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.


FFmpeg as used in Google Chrome before 22.0.1229.79 does not properly handle OGG containers which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors related to a \wild pointer\ issue.


Skia as used in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation a different vulnerability than CVE-2012-2874.


Xpdf as used in products such as gpdf kpdf pdftohtml poppler teTeX CUPS libextractor and others allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference.


securetar as used in AMaViS shell script 0.2.1 and earlier allows users to cause a denial of service (CPU consumption) via a malformed TAR file possibly via an incorrect file size parameter.


Skia as used in Google Chrome before 16.0.912.77 does not perform all required initialization of values which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


WebKit as used in Safari 5.0.6 allows remote attackers to cause a denial of service (process crash) or arbitrary code execution.


Netwide Assembler (NASM) 2.14rc15 has an invalid memory write (segmentation fault) in expand_smacro in preproc.c which allows attackers to cause a denial of service via a crafted input file.


Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.


Opera before 12.00 Beta allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web page that is not properly handled during a reload as demonstrated by a \multiple origin camera test\ page.


Opera before 12.00 Beta allows user-assisted remote attackers to cause a denial of service (application hang) via JavaScript code that changes a form before submission.


Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via a web page that contains invalid character encodings.


Opera before 12.00 Beta allows remote attackers to cause a denial of service (memory consumption or application hang) via an IFRAME element that uses the src=\#\ syntax to embed a parent document.


Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via crafted characters in domain names as demonstrated by \IDNA2008 tests.\


Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via crafted WebGL content as demonstrated by a codeflow.org WebGL demo.


Opera before 12.00 Beta allows remote attackers to cause a denial of service (application hang) via an absolutely positioned wrap=off TEXTAREA element located next to an \overflow: auto\ block element.


Bugzilla 2.14 before 2.14.2 and 2.16 before 2.16rc2 may allow remote attackers to cause a denial of service or execute certain queries via a SQL injection attack on the sort order parameter to buglist.cgi.


On BIG-IP 15.0.0-15.0.1 14.1.0-14.1.2.2 13.1.0-13.1.3.1 12.1.0-12.1.5 and 11.5.2-11.6.5.1 undisclosed HTTP behavior may lead to a denial of service.


On BIG-IP versions 14.0.0-14.0.0.4 13.0.0-13.1.1.1 12.1.0-12.1.4 11.6.0-11.6.3.4 and 11.5.1-11.5.8 the system is vulnerable to a denial of service attack when performing URL classification.


The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gf_list_del function in list.c which allows attackers to cause a denial of service.


The binary MP4Box in Gpac 1.0.1 has a double-free bug in the av1dmx_finalize function in reframe_av1.c which allows attackers to cause a denial of service.


The binary MP4Box in Gpac through 1.0.1 has a double-free vulnerability in the iloc_entry_del funciton in box_code_meta.c which allows attackers to cause a denial of service.


IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to \Possible Stack Corruption starting at CADIMAGE+0x00000000003d2378.\


IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to a \Read Access Violation starting at CADIMAGE+0x00000000003d246f.\


IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to a \Read Access Violation starting at CADIMAGE+0x00000000003d22d8.\


IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to a \Read Access Violation starting at CADIMAGE+0x00000000003d2328.\


Improper boundary check in Quram Agif library prior to SMR Apr-2022 Release 1 allows attackers to cause denial of service via crafted image file.


Improper boundary check in media.extractor library prior to SMR Apr-2022 Release 1 allows attackers to cause denial of service via a crafted media file.


Improper buffer restrictions in the firmware of Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow a privileged user to potentially enable denial of service via local access.


Improper buffer restrictions in the Intel(R) Wireless for Open Source before version 1.5 may allow an unauthenticated user to potentially enable denial of service via adjacent access.


Improper buffer restrictions in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially enable denial of service via local access.


Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access. This affects all Linux kernel versions that support BlueZ.


Improper buffer restrictions in firmware for Intel(R) 7360 Cell Modem before UDE version 9.4.370 may allow unauthenticated user to potentially enable denial of service via network access.


Improper buffer restrictions in kernel mode driver for Intel(R) PROSet/Wireless WiFi products before version 21.70 on Windows 10 may allow an unprivileged user to potentially enable denial of service via adjacent access.


Off-by-one

error

in

the

function

in

in

the

Radiotap

dissector

in

Wireshark

before

allows

remote

attackers

to

cause

a

denial

of

service

(application

crash)

via

a

crafted

packet.


Off-by-one error in the PDF functionality in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X allows remote attackers to cause a denial of service via a crafted document.


Off-by-one error in ICC profile chunk handling in the png_set_iCCP function in pngset.c in libpng before 1.2.22 beta1 allows remote attackers to cause a denial of service (crash) via a crafted PNG image due to an incorrect fix for CVE-2007-5266.


Off-by-one error in the fsp_readdir_r function in fsplib.c in fsplib before 0.9 allows remote attackers to cause a denial of service via a directory entry whose length is exactly MAXNAMELEN which prevents a terminating null byte from being added.


Off-by-one error in the DHCP/BOOTP dissector in Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via crafted DHCP-over-DOCSIS packets.


Off-by-one error in the str_ireplace function in PHP 5.2.1 might allow context-dependent attackers to cause a denial of service (crash).


Off-by-one error in ImageMagick before 6.6.0-4 allows remote attackers to cause a denial of service (application crash) via a crafted 8BIM profile.


Off-by-one error in libavcodec/smc.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Quicktime Graphics (aka SMC) video data.


Off-by-one error in Novell iManager 2.7 2.7.3 and 2.7.3 FTF2 allows remote attackers to cause a denial of service (daemon crash) via a long tree parameter in a login request to nps/servlet/webacc.


Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.


Off-by-one error in NcFTPd FTP server before 2.4.1 allows a remote attacker to cause a denial of service (crash) via a long PORT command.


Off-by-one error in Halo Combat Evolved 1.04 and earlier allows remote attackers to cause a denial of service (server crash) via a long client response.


Off-by-one error in the READ_ENCINT macro in chmd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CHM file.


Off-by-one error in the lzxd_decompress function in lzxd.c in libmspack before 0.5 allows remote attackers to cause a denial of service (buffer under-read and application crash) via a crafted CAB archive.


Off-by-one error in the readBuf function in listener.cpp in libcapsinetwork and monopd before 0.9.8 allows remote attackers to cause a denial of service (crash) via a long line.


Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system crash) via a pioctl with an input buffer size of 4096 bytes.


Off-by-one error in the MIME Multipart dissector in Wireshark (formerly Ethereal) 0.10.1 through 0.99.3 allows remote attackers to cause a denial of service (crash) via certain vectors that trigger an assertion error related to unexpected length values.


Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors.


Off-by-one error in alterMIME 0.1.10 and 0.1.11 allows remote attackers to cause a denial of service (crash) via an x-header that causes snprintf overwrite the FFGET_FILE variable with a (null) byte.


Off-by-one error in the __addr_ok macro in Xen 3.3 and earlier allows local 64 bit PV guest administrators to cause a denial of service (host crash) via unspecified hypercalls that ignore virtual-address bits.


Off-by-one error in Google V8 as used in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Off-by-one error in the cli_hm_scan function in matcher-hash.c in libclamav in ClamAV before 0.97.2 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message that is not properly handled during certain hash calculations.


Off-by-one error in libxml2 as used in Google Chrome before 19.0.1084.46 and other products allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.


Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted OpenType file.


Off-by-one error in the dissect_6lowpan_iphc function in packet-6lowpan.c in Wireshark 1.4.0 through 1.4.3 on 32-bit platforms allows remote attackers to cause a denial of service (application crash) via a malformed 6LoWPAN IPv6 packet.


encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.


regex.c in GNU ed before 1.14.1 allows attackers to cause a denial of service (crash) via a malformed command which triggers an invalid free.


readelf.c in GNU Binutils 2017-04-12 has a \cannot be represented in type long\ issue which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.


readelf.c in GNU Binutils 2017-04-12 has a \shift exponent too large for type unsigned long\ issue which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.


sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs which allows remote servers to cause a denial of service (application crash) via a crafted packet.


nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a crafted server message that triggers a large memory allocation.


markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large length value in an emoticon response.


unlzh.c in the LHZ component in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted GZIP archive.


msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters which allows remote servers to cause a denial of service (application crash) by placing these characters in a text/plain message.


traps.c in the Linux kernel 2.6.x and 2.4.x executes stack segment faults on an exception stack which allows local users to cause a denial of service (oops and stack fault exception).


inflate.c in the zlib routines in the Linux kernel before 2.6.12.5 allows remote attackers to cause a denial of service (kernel crash) via a compressed file with \improper tables\.


field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service (CPU consumption) via an ID3_FIELD_TYPE_STRINGLIST field that ends in '\\0' which triggers an infinite loop.


A certain ActiveX control in EBCRYPT.DLL 2.0 in EB Design ebCrypt allows remote attackers to cause a denial of service (crash) via a string argument to the AddString method.


A certain ActiveX control in RealNetworks RealPlayer 11 allows remote attackers to cause a denial of service (application crash) via a malformed .au file that triggers a divide-by-zero error. NOTE: this might be related to CVE-2007-4904.


A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long CCRP_BDc.SelectedFolder property value.


A certain ActiveX control in Symantec Norton AntiVirus 2004 allows remote attackers to cause a denial of service (resource consumption) and possibly execute arbitrary programs.


A certain ActiveX control in rpau3260.dll in RealNetworks RealPlayer 10.5 allows remote attackers to cause a denial of service (Internet Explorer crash) by invoking the RealPlayer.Initialize method with certain arguments.


A certain ActiveX control in Adobe Acrobat 9 when used with Microsoft Windows Vista and Internet Explorer 7 allows remote attackers to cause a denial of service (browser crash) via an src property value with an invalid acroie:// URL.


A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long argument to the SetPassword method.


A certain Red Hat patch to the vlan_hwaccel_do_receive function in net/8021q/vlan_core.c in the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 allows remote attackers to cause a denial of service (system crash) via priority-tagged VLAN frames.


Google Chrome before 10.0.648.127 does not properly handle SVG cursors which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale pointer.\


Google Chrome before 10.0.648.127 does not properly perform table painting which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale pointer.\


Google Chrome before 10.0.648.127 does not properly handle attributes which allows remote attackers to cause a denial of service (DOM tree corruption) or possibly have unspecified other impact via a crafted document.


Google Chrome before 10.0.648.127 does not properly handle DataView objects which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.


Google Chrome before 10.0.648.127 does not properly perform a cast of an unspecified variable during text rendering which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.


Google Chrome before 10.0.648.127 does not properly perform box layout which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale node.\


Google Chrome before 11.0.696.57 does not properly handle DOM id maps which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to \dangling pointers.\


Google Chrome before 11.0.696.57 does not properly present file dialogs which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to \dangling pointers.\


Google Chrome before 11.0.696.57 does not properly perform height calculations which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale pointer.\


Google Chrome before 11.0.696.57 does not properly handle PDF forms which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to \stale pointers.\


Google Chrome before 11.0.696.57 does not ensure thread safety during handling of MIME data which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Google Chrome before 11.0.696.57 does not properly handle mutation events which allows remote attackers to cause a denial of service (node tree corruption) or possibly have unspecified other impact via unknown vectors.


Google Chrome before 11.0.696.57 does not properly handle drop-down lists which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale pointer.\


Google Chrome before 11.0.696.57 does not properly implement layering which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to \stale pointers.\


Google Chrome before 11.0.696.57 does not properly handle floating objects which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale pointer.\


Google Chrome before 13.0.782.107 does not properly track line boxes during rendering which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale pointer.\


Google Chrome before 13.0.782.107 does not properly address re-entrancy issues associated with the GPU lock which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.


Google Chrome before 13.0.782.107 does not properly handle nested functions in PDF documents which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted document.


Google Chrome before 14.0.835.163 does not properly perform garbage collection during the processing of PDF documents which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.


Google Chrome before 14.0.835.163 does not properly handle Cascading Style Sheets (CSS) token sequences which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale node.\


Google Chrome before 15.0.874.102 does not properly restrict access to internal Google V8 functions which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Google Chrome before 15.0.874.102 does not properly address timing issues during DOM traversal which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.


Google Chrome before 17.0.963.46 does not properly perform casts of variables during handling of a column span which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.


Google Chrome before 17.0.963.46 does not properly check signatures which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.


Google Chrome before 6.0.472.53 does not properly implement SVG filters which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors related to a \stale pointer\ issue.


Google Chrome before 7.0.517.41 does not properly perform autofill operations for forms which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.


Google Chrome before 7.0.517.41 does not properly handle element maps which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to \stale elements.\


Google Chrome before 7.0.517.41 does not properly handle forms which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.


Google Chrome before 9.0.597.107 does not properly determine device orientation which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale pointer.\


Google Chrome before 9.0.597.107 does not properly implement forms controls which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.


Google Chrome before 9.0.597.107 does not properly render tables which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale pointer.\


Google Chrome before 9.0.597.107 does not properly implement JavaScript dialogs which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.


Google Chrome before 9.0.597.107 does not properly implement key frame rules which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale pointer.\


Google Chrome before 9.0.597.107 does not properly perform layout which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale pointer.\


Google Chrome before 9.0.597.107 does not properly handle tables which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale node.\


Google Chrome before 9.0.597.107 does not properly handle TEXTAREA elements which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.


Google Chrome before 9.0.597.107 does not properly perform SVG rendering which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.


Google Chrome before 9.0.597.107 does not properly handle SVG animations which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a \stale pointer.\


Google Chrome before 9.0.597.107 does not properly handle XHTML documents which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to \stale nodes.\


XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file related to a \Read Access Violation starting at jbig2dec+0x0000000000005643.\


XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file related to a \Read Access Violation starting at jbig2dec+0x0000000000005940.\


XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file related to a \Read Access Violation starting at jbig2dec+0x0000000000008fe4.\


XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file related to \Possible Stack Corruption starting at jbig2dec+0x0000000000002fbe.\


XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file related to a \Read Access Violation starting at jbig2dec+0x0000000000005862.\


XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file related to a \Read Access Violation starting at jbig2dec+0x0000000000005956.\


XnView Classic for Windows Version 2.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to a \Read Access Violation starting at CADImage+0x0000000000285de7.\


XnView Classic for Windows Version 2.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to a \Read Access Violation starting at CADImage+0x0000000000285dad.\


XnView Classic for Windows Version 2.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to a \Read Access Violation starting at CADImage+0x00000000001a78db.\


XnView Classic for Windows Version 2.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to a \Read Access Violation starting at CADImage+0x0000000000285d79.\


XnView

Classic

for

Windows

Version

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

\Possible

Stack

Corruption

starting

at

Xfpx!gffGetFormatInfo+0x0000000000022e1f.\


XnView Classic for Windows Version 2.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file related to a \Read Access Violation starting at Xfpx+0x000000000000d6da.\


Creative Cloud Desktop Application versions 4.6.1 and earlier have a security bypass vulnerability. Successful exploitation could lead to denial of service.


Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-24484 CVE-2022-26784.


Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-24538 CVE-2022-26784.


Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-24484 CVE-2022-24538.


NetApp Clustered Data ONTAP 8.1 through 9.1P1 when NFS or SMB is enabled allows remote attackers to cause a denial of service via unspecified vectors.


IBM Cognos Analytics 11.0 and 11.1 could be vulnerable to a denial of service attack by failing to catch exceptions in a servlet also exposing debug information could also be used in future attacks. IBM X-Force ID: 179270.


IBM Cognos Business Intelligence (BI) 8.4 and 8.4.1 allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted request containing a zero-valued byte.


Windows Common Log File System Driver Denial of Service Vulnerability.


A component of the HarmonyOS has a Kernel Memory Leakage Vulnerability. Local attackers may exploit this vulnerability to cause Kernel Denial of Service.


Improper conditions check in the voltage modulation interface for some Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable denial of service via local access.


Improper conditions check in the Linux kernel driver for the Intel(R) FPGA SDK for OpenCL(TM) Pro Edition before version 19.4 may allow an authenticated user to potentially enable denial of service via local access.


Improper conditions check in firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.4.0 may allow a privileged user to potentially enable denial of service via local access.


Improper conditions check in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticated user to potentially enable denial of service via adjacent access.


Improper conditions check in the Intel(R) SGX DCAP software before version 1.6 may allow an unauthenticated user to potentially enable denial of service via adjacent access.


Improper conditions check in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.


HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage and were susceptible to unauthenticated denial of service. Fixed in 1.6.3.


HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.


Stack consumption vulnerability in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (PHP crash) via a crafted first argument to the fnmatch function as demonstrated using a long string.


Stack consumption vulnerability in D-Bus (aka DBus) before 1.4.1 allows local users to cause a denial of service (daemon crash) via a message containing many nested variants.


Stack consumption vulnerability in Apple Safari 4.0.3 on Windows allows remote attackers to cause a denial of service (application crash) via a long URI value (aka url) in the Cascading Style Sheets (CSS) background property.


Stack consumption vulnerability in the message splitting functionality in Quassel before 0.12-rc1 allows remote attackers to cause a denial of service (uncontrolled recursion) via a crafted massage.


Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of service via a crafted imagefilltoborder call.


Stack consumption vulnerability in Zend/zend_exceptions.c in PHP before 5.4.44 5.5.x before 5.5.28 and 5.6.x before 5.6.12 allows remote attackers to cause a denial of service (segmentation fault) via recursive method calls.


Stack consumption vulnerability in dartwebserver.dll 1.9 and earlier as used in Dart PowerTCP WebServer for ActiveX and other products allows remote attackers to cause a denial of service (daemon crash) via a long request.


Bootloader contains a vulnerability in access permission settings where unauthorized software may be able to overwrite NVIDIA MB2 code which would result in limited denial of service.


Bootloader contains a vulnerability in NVIDIA MB2 which may cause free-the-wrong-heap which may lead to limited denial of service.


Bootloader contains a vulnerability in NVIDIA TegraBoot where a potential heap overflow might allow an attacker to control all the RAM after the heap block leading to denial of service or code execution.


Loopback 8.0.0 contains a vulnerability that could allow an attacker to manipulate or pollute Javascript values and cause a denial of service or possibly execute code. IBM X-Force ID: 192706.


IBM Data Risk Manager (iDNA) 2.0.6 could allow a privileged user to cause a denial of service due to improper input validation. IBM X-Force ID: 184937.


IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a chunked transfer-encoding HTTP/2 request. IBM X-Force ID: 184441.


IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted HTTP/2 request with invalid characters. IBM X-Force ID: 184438.


IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted a JSON request with invalid characters. IBM X-Force ID: 184439.


IBM DB2 for Linux UNIX and Windows (includes DB2 Connect Server) 9.7 10.1 10.5 11.1 and 11.5 could allow an unauthenticated attacker to cause a denial of service due a hang in the SSL handshake response. IBM X-Force ID: 193660.


IBM DB2 for Linux UNIX and Windows (includes DB2 Connect Server) 9.7 10.1 10.5 11.1 and 11.5 could allow an unauthenticated user to send specially crafted packets to cause a denial of service from excessive memory usage.


IBM DB2 for Linux UNIX and Windows (includes DB2 Connect Server) 11.5 could allow an authenticated attacker to cause a denial of service due to incorrect handling of certain commands. IBM X-Force ID: 174341.


IBM DB2 for Linux UNIX and Windows (includes DB2 Connect Server) 10.5 11.1 and 11.5 could allow an authenticated attacker to send specially crafted commands to cause a denial of service. IBM X-Force ID: 174914.


IBM DB2 for Linux UNIX and Windows (includes DB2 Connect Server) 9.7 10.1 10.5 11.1 and 11.5 could allow local attacker to cause a denial of service inside the \DB2 Management Service\.


IBM DB2 for Linux UNIX and Windows (includes DB2 Connect Server) 9.7 10.1 10.5 11.1 and 11.5 could allow an unauthenticated attacker to cause a denial of service due a hang in the execution of a terminate command. IBM X-Force ID: 180076.


IBM DB2 Universal Database (UDB) before 8.2 FixPak 12 allows remote attackers to cause a denial of service (application crash) by sending \incorrect information ... regarding the package name/creator \ which leads to a \memory overwrite.\


IBM DB2 Universal Database version 6.1 allows users to cause a denial of service via a malformed query.


IBM DB2 Universal Database (UDB) 820 before 8.2 FP10 allows remote authenticated users to cause a denial of service (disk consumption) via a hash join (hsjn) that triggers an infinite loop in sqlri_hsjnFlushBlocks.


IBM DB2 Universal Database (UDB) 810 before version 8 FixPak 10 allows remote authenticated users to cause a denial of service (db2jd service crash) by \connecting from a downlevel client.\


IBM DB2 Universal Database (UDB) 820 before ESE AIX 5765F4100 allows remote authenticated users to cause a denial of service (CPU consumption) by \abnormally\ terminating a connection which prevents db2agents from being properly cleared.


The default configuration in systemd-shim 8 enables the Abandon debugging clause which allows local users to cause a denial of service via unspecified vectors.


The default configuration of NetWin dMailWeb and cwMail trusts all POP servers which allows attackers to bypass normal authentication and cause a denial of service.


The default configuration of HP Client Automation (HPCA) Enterprise Infrastructure (aka Radia) allows remote attackers to read log files and consequently cause a denial of service or have unspecified other impact via web requests.


A default configuration of in.identd in SuSE Linux waits 120 seconds between requests allowing a remote attacker to conduct a denial of service.


The default configuration of syslogd in the Linux sysklogd package does not enable the -x (disable name lookups) option which allows remote attackers to cause a denial of service (traffic amplification) via messages with spoofed source IP addresses.


The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.


The default configuration of Arescom NetDSL 800 does not require authentication which allows remote attackers to cause a denial of service or reconfigure the router.


Incorrect default permissions in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access.


Incorrect default permissions in the Intel(R) DSA before version 20.8.30.6 may allow an authenticated user to potentially enable denial of service via local access.


Improper default permissions in the firmware for the Intel(R) Ethernet I210 Controller series of network adapters before version 3.30 may allow an authenticated user to potentially enable denial of service via local access.


A denial of service vulnerability exists when Windows improperly handles objects in memory aka 'Windows Denial of Service Vulnerability'.


A denial of service vulnerability exists when Windows improperly handles objects in memory aka 'Windows Denial of Service Vulnerability'. This CVE ID is unique from CVE-2018-12207.


A vulnerability in the 802.1X implementation for Cisco NX-OS Software could allow an unauthenticated adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incomplete input validation of Extensible Authentication Protocol over LAN (EAPOL) frames. An attacker could exploit this vulnerability by sending a crafted EAPOL frame to an interface on the targeted device. A successful exploit could allow the attacker to cause the Layer 2 (L2) forwarding process to restart multiple times leading to a system-level restart of the device and a DoS condition. Note: This vulnerability affects only NX-OS devices configured with 802.1X functionality. Cisco Nexus 1000V Switch for VMware vSphere devices are affected in versions prior to 5.2(1)SV3(1.4b). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(4). Nexus 2000 5500 5600 and 6000 Series Switches are affected in versions prior to 7.3(5)N1(1) and 7.1(5)N1(1b). Nexus 7000 and 7700 Series Switches are affected in versions prior to 8.2(3). Nexus 9000 Series Fabric Switches in ACI Mode are affected in versions prior to 13.2(1l). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(4).


A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests aka '.NET Denial of Service Vulnerability'.


A vulnerability in the DHCPv6 input packet processor of Cisco Prime Network Registrar could allow an unauthenticated remote attacker to restart the server and cause a denial of service (DoS) condition on the affected system. The vulnerability is due to incomplete user-supplied input validation when a custom extension attempts to change a DHCPv6 packet received by the application. An attacker could exploit this vulnerability by sending malformed DHCPv6 packets to the application. An exploit could allow the attacker to trigger a restart of the service which if exploited repeatedly might lead to a DoS condition. This vulnerability can only be exploited if the administrator of the server has previously installed custom extensions that attempt to modify the packet details before the packet has been processed. Note: Although the CVSS score matches a High SIR this has been lowered to Medium because this condition will only affect an application that has customer-developed extensions that will attempt to modify packet parameters before the packet has been completely sanitized. If packet modification in a custom extension happens after the packet has been sanitized the application will not be affected by this vulnerability. Software versions prior to 8.3(7) and 9.1(2) are affected.


A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0712 CVE-2019-1309 CVE-2019-1310.


A vulnerability in the Import Cisco IMC configuration utility of Cisco Integrated Management Controller (IMC) could allow an authenticated remote attacker to cause a denial of service (DoS) condition and implement arbitrary commands with root privileges on an affected device. The vulnerability is due to improper bounds checking by the import-config process. An attacker could exploit this vulnerability by sending malicious packets to an affected device. When the packets are processed an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to implement arbitrary code on the affected device with elevated privileges.


Multiple vulnerabilities in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated remote attacker to cause an affected device to reload resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of LDAP packets by an affected device. An attacker could exploit these vulnerabilities by sending an LDAP packet crafted using Basic Encoding Rules (BER) to an affected device. The LDAP packet must have a source IP address of an LDAP server configured on the targeted device. A successful exploit could cause the affected device to reload resulting in a DoS condition. Firepower 4100 Series Next-Generation Firewalls are affected in versions prior to 2.0.1.201 2.2.2.54 and 2.3.1.75. Firepower 9300 Security Appliances are affected in versions prior to 2.0.1.201 2.2.2.54 and 2.3.1.75. MDS 9000 Series Multilayer Switches are affected in versions prior to 8.2(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(1). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(2). Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(20) 7.3(2)D1(1) and 8.2(1). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(1). UCS 6200 and 6300 Fabric Interconnect are affected in versions prior to 3.2(2b).


A vulnerability in the firmware signature checking program of Cisco Integrated Management Controller (IMC) could allow an authenticated local attacker to cause a buffer overflow resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient checking of an input buffer. An attacker could exploit this vulnerability by passing a crafted file to the affected system. A successful exploit could inhibit an administrator's ability to access the system.


A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation mechanisms for certain fields in HTTP/HTTPS requests sent through an affected device. A successful attacker could exploit this vulnerability by sending a malicious HTTP/HTTPS request through an affected device. An exploit could allow the attacker to force the device to stop processing traffic resulting in a DoS condition.


A vulnerability in the quality of service (QoS) feature of Cisco Aironet Series Access Points (APs) could allow an authenticated adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation on QoS fields within Wi-Fi frames by the affected device. An attacker could exploit this vulnerability by sending malformed Wi-Fi frames to an affected device. A successful exploit could allow the attacker to cause the affected device to crash resulting in a DoS condition.


A vulnerability in the implementation of Border Gateway Protocol (BGP) functionality in Cisco IOS XR Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to incorrect processing of certain BGP update messages. An attacker could exploit this vulnerability by sending BGP update messages that include a specific set of attributes to be processed by an affected system. A successful exploit could allow the attacker to cause the BGP process to restart unexpectedly resulting in a DoS condition. The Cisco implementation of BGP accepts incoming BGP traffic from explicitly defined peers only. To exploit this vulnerability the malicious BGP update message would need to come from a configured valid BGP peer or would need to be injected by the attacker into the victim's BGP network on an existing valid TCP connection to a BGP peer.


A denial of service vulnerability exists in Skype for Business aka 'Skype for Business and Lync Server Denial of Service Vulnerability'.


A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of HTTP and HTTPS requests. An attacker could exploit this vulnerability by sending a malformed HTTP or HTTPS request to an affected device. An exploit could allow the attacker to cause a restart of the web proxy process resulting in a temporary DoS condition.


A vulnerability in the ingress traffic validation of Cisco IOS XE Software for Cisco Aggregation Services Router (ASR) 900 Route Switch Processor 3 (RSP3) could allow an unauthenticated adjacent attacker to trigger a reload of an affected device resulting in a denial of service (DoS) condition. The vulnerability exists because the software insufficiently validates ingress traffic on the ASIC used on the RSP3 platform. An attacker could exploit this vulnerability by sending a malformed OSPF version 2 (OSPFv2) message to an affected device. A successful exploit could allow the attacker to cause a reload of the iosd process triggering a reload of the affected device and resulting in a DoS condition.


ClamAV versions prior to 0.101.2 are susceptible to a denial of service (DoS) vulnerability. An out-of-bounds heap read condition may occur when scanning PE files. An example is Windows EXE and DLL files that have been packed using Aspack as a result of inadequate bound-checking.


A vulnerability in the call-handling functionality of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and 8800 Series could allow an unauthenticated remote attacker to cause an affected phone to reload unexpectedly resulting in a temporary denial of service (DoS) condition. The vulnerability is due to incomplete error handling when XML data within a SIP packet is parsed. An attacker could exploit this vulnerability by sending a SIP packet that contains a malicious XML payload to an affected phone. A successful exploit could allow the attacker to cause the affected phone to reload unexpectedly resulting in a temporary DoS condition.


A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to cause the CPU utilization to increase to 100 percent causing a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of email messages that contain large attachments. An attacker could exploit this vulnerability by sending a malicious email message through the targeted device. A successful exploit could allow the attacker to cause a permanent DoS condition due to high CPU utilization. This vulnerability may require manual intervention to recover the ESA.


A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated remote attacker to cause repeated crashes in some internal processes that are running on the affected devices resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient input validation of email attachments. An attacker could exploit this vulnerability by sending an email message with a crafted attachment through an affected device. A successful exploit could allow the attacker to cause specific processes to crash repeatedly resulting in the complete unavailability of both the Cisco Advanced Malware Protection (AMP) and message tracking features and in severe performance degradation while processing email. After the affected processes restart the software resumes filtering for the same attachment causing the affected processes to crash and restart again. A successful exploit could also allow the attacker to cause a repeated DoS condition. Manual intervention may be required to recover from this situation.


A vulnerability in the processing of IP Service Level Agreement (SLA) packets by Cisco IOS Software and Cisco IOS XE software could allow an unauthenticated remote attacker to cause an interface wedge and an eventual denial of service (DoS) condition on the affected device. The vulnerability is due to improper socket resources handling in the IP SLA responder application code. An attacker could exploit this vulnerability by sending crafted IP SLA packets to an affected device. An exploit could allow the attacker to cause an interface to become wedged resulting in an eventual denial of service (DoS) condition on the affected device.


A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests aka 'Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability'.


A vulnerability in the WebVPN service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper management of authenticated sessions in the WebVPN portal. An attacker could exploit this vulnerability by authenticating with valid credentials and accessing a specific URL in the WebVPN portal. A successful exploit could allow the attacker to cause the device to reload resulting in a temporary DoS condition.


A denial of service vulnerability exists when Windows improperly handles hard links aka 'Microsoft Windows Denial of Service Vulnerability'.


A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XR Software could allow an unauthenticated remote attacker to cause the PIM process to restart resulting in a denial of service condition on an affected device. The vulnerability is due to the incorrect processing of crafted AutoRP packets. An attacker could exploit this vulnerability by sending crafted packets to port UDP 496 on a reachable IP address on the device. A successful exploit could allow the attacker to cause the PIM process to restart. Software versions prior to 6.2.3 6.3.2 6.4.0 and 6.5.1 are affected.


A vulnerability in the handling of Inter-Access Point Protocol (IAPP) messages by Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated adjacent attacker to cause a denial of service (DoS) condition. The vulnerability exist because the software improperly validates input on fields within IAPP messages. An attacker could exploit the vulnerability by sending malicious IAPP messages to an affected device. A successful exploit could allow the attacker to cause the Cisco WLC Software to reload resulting in a DoS condition. Software versions prior to 8.2.170.0 8.5.150.0 and 8.8.100.0 are affected.


A vulnerability in the Border Gateway Patrol (BGP) Multiprotocol Label Switching (MPLS)-based Ethernet VPN (EVPN) implementation of Cisco IOS XR Software could allow an unauthenticated adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to a logic error that occurs when the affected software processes specific EVPN routing information. An attacker could exploit this vulnerability by injecting malicious traffic patterns into the targeted EVPN network. A successful exploit could result in a crash of the l2vpn_mgr process on Provider Edge (PE) device members of the same EVPN instance (EVI). On each of the affected devices a crash could lead to system instability and the inability to process or forward traffic through the device resulting in a DoS condition that would require manual intervention to restore normal operating conditions.


A vulnerability in the TCP proxy functionality for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause the device to restart unexpectedly resulting in a denial of service (DoS) condition. The vulnerability is due to an error in TCP-based packet inspection which could cause the TCP packet to have an invalid Layer 2 (L2)-formatted header. An attacker could exploit this vulnerability by sending a crafted TCP packet sequence to the targeted device. A successful exploit could allow the attacker to cause a DoS condition.


A vulnerability in the web interface of Cisco IoT Field Network Director could allow an unauthenticated remote attacker to trigger high CPU usage resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of Transport Layer Security (TLS) renegotiation requests. An attacker could exploit this vulnerability by sending renegotiation requests at a high rate. A successful exploit could increase the resource usage on the system eventually leading to a DoS condition.


A vulnerability in the web interface of Cisco Small Business 200 300 and 500 Series Managed Switches could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this vulnerability by sending a malicious request to the web interface of an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device resulting in a DoS condition.


A vulnerability in the Cisco Encrypted Traffic Analytics (ETA) feature of Cisco IOS XE Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to a logic error that exists when handling a malformed incoming packet leading to access to an internal data structure after it has been freed. An attacker could exploit this vulnerability by sending crafted malformed IP packets to an affected device. A successful exploit could allow the attacker to cause an affected device to reload resulting in a DoS condition.


A vulnerability in the Fibre Channel over Ethernet (FCoE) protocol implementation in Cisco NX-OS Software could allow an unauthenticated adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an incorrect allocation of an internal interface index. An adjacent attacker with the ability to submit a crafted FCoE packet that crosses affected interfaces could trigger this vulnerability. A successful exploit could allow the attacker to cause a packet loop and high throughput on the affected interfaces resulting in a DoS condition. This vulnerability has been fixed in version 7.3(5)N1(1).


A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition or execute arbitrary code. The vulnerability exists because the software improperly validates user-supplied input during user authentication. An attacker could exploit this vulnerability by connecting to an affected device using HTTP and supplying malicious user credentials. A successful exploit could allow the attacker to trigger a reload of an affected device resulting in a DoS condition or to execute arbitrary code with the privileges of the app user. Cisco fixed this vulnerability in the following SIP Software releases: 10.3(1)SR5 and later for Cisco Unified IP Conference Phone 8831; 11.0(4)SR3 and later for Cisco Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 and later for the rest of the Cisco IP Phone 7800 Series and 8800 Series.


A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an unauthenticated remote attacker to cause the web server process to crash causing a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient validation of user-supplied input on the web interface. An attacker could exploit this vulnerability by submitting a crafted HTTP request to certain endpoints of the affected software. A successful exploit could allow an attacker to cause the web server to crash. Physical access to the device may be required for a restart.


A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper error-handling mechanisms when processing nested RAR files sent to an affected device. An attacker could exploit this vulnerability by sending a crafted RAR file to an affected device. An exploit could allow the attacker to view or create arbitrary files on the targeted system.


A denial of service vulnerability exists when Windows improperly handles objects in memory aka 'Windows Denial of Service Vulnerability'.


A vulnerability in the User Data Services (UDS) API of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on the management GUI. The vulnerability is due to improper validation of input parameters in the UDS API requests. An attacker could exploit this vulnerability by sending a crafted request to the UDS API of an affected device. A successful exploit could allow the attacker to make the A Cisco DB service quit unexpectedly preventing admin access to the Unified CM management GUI. Manual intervention may be required to restore normal operation. Software versions 10.5 11.5 12.0 12.5 are affected.


A vulnerability in the implementation of Intermediate System–to–Intermediate System (IS–IS) routing protocol functionality in Cisco IOS XR Software could allow an unauthenticated attacker who is in the same IS-IS area to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of IS–IS link-state protocol data units (PDUs). An attacker could exploit this vulnerability by sending specific link-state PDUs to an affected system to be processed. A successful exploit could allow the attacker to cause incorrect calculations used in the weighted remote shared risk link groups (SRLG) or in the IGP Flexible Algorithm. It could also cause tracebacks to the logs or potentially cause the receiving device to crash the IS–IS process resulting in a DoS condition.


A vulnerability in the Cisco Fabric Services component of Cisco NX-OS Software could allow an unauthenticated remote attacker to cause process crashes which can result in a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient validation of TCP packets when processed by the Cisco Fabric Services over IP (CFSoIP) feature. An attacker could exploit this vulnerability by sending a malicious Cisco Fabric Services TCP packet to an affected device. A successful exploit could allow the attacker to cause process crashes resulting in a device reload and a DoS condition. Note: There are three distribution methods that can be configured for Cisco Fabric Services. This vulnerability affects only distribution method CFSoIP which is disabled by default. See the Details section for more information.


A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Small Business Sx200 Sx300 Sx500 ESW2 Series Managed Switches and Small Business Sx250 Sx350 Sx550 Series Switches could allow an authenticated remote attacker to cause the SNMP application of an affected device to cease processing traffic resulting in the CPU utilization reaching one hundred percent. Manual intervention may be required before a device resumes normal operations. The vulnerability is due to improper validation of SNMP protocol data units (PDUs) in SNMP packets. An attacker could exploit this vulnerability by sending a malicious SNMP packet to an affected device. A successful exploit could allow the attacker to cause the device to cease forwarding traffic which could result in a denial of service (DoS) condition. Cisco has released firmware updates that address this vulnerability.


A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall Cisco RV130W Wireless-N Multifunction VPN Router and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated remote attacker to cause a reload of an affected device resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied data in the web-based management interface. An attacker could exploit this vulnerability by sending malicious HTTP requests to a targeted device. A successful exploit could allow the attacker to reload the device and causing a DoS condition.


A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0712 CVE-2019-1310 CVE-2019-1399.


A vulnerability in field-programmable gate array (FPGA) ingress buffer management for the Cisco Firepower 9000 Series with the Cisco Firepower 2-port 100G double-width network module (PID: FPR9K-DNM-2X100G) could allow an unauthenticated adjacent attacker to cause a denial of service (DoS) condition. Manual intervention may be required before a device will resume normal operations. The vulnerability is due to a logic error in the FPGA related to the processing of different types of input packets. An attacker could exploit this vulnerability by being on the adjacent subnet and sending a crafted sequence of input packets to a specific interface on an affected device. A successful exploit could allow the attacker to cause a queue wedge condition on the interface. When a wedge occurs the affected device will stop processing any additional packets that are received on the wedged interface. Version 2.2 is affected.


A vulnerability in the CLI implementation of a specific command used for image maintenance for Cisco NX-OS Software could allow an authenticated local attacker to overwrite any file on the file system including system files. These file overwrites by the attacker are accomplished at the root privilege level. The vulnerability occurs because there is no verification of user-input parameters and or digital-signature verification for image files when using a specific CLI command. An attacker could exploit this vulnerability by authenticating to the device and issuing a command at the CLI. Because an exploit could allow the attacker to overwrite any file on the disk including system files a denial of service (DoS) condition could occur. The attacker must have valid administrator credentials for the affected device to exploit this vulnerability.


A vulnerability in the web interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated remote attacker to trigger high CPU usage resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of Secure Sockets Layer (SSL) renegotiation requests. An attacker could exploit this vulnerability by sending renegotiation requests at a high rate. An successful exploit could increase the resource usage on the system eventually leading to a DoS condition. This vulnerability affects version 2.1.


Multiple vulnerabilities in the Server Message Block (SMB) Protocol preprocessor detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated adjacent or remote attacker to cause a denial of service (DoS) condition. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated remote attacker to cause an NX-API system process to unexpectedly restart. The vulnerability is due to incorrect validation of the HTTP header of a request that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API on an affected device. A successful exploit could allow the attacker to cause a denial of service (DoS) condition in the NX-API service; however the NX-OS device itself would still be available and passing network traffic. Note: The NX-API feature is disabled by default.


A denial of service vulnerability exists when Windows improperly handles objects in memory aka 'Windows Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-1343 CVE-2019-1347.


A vulnerability in the detection engine of Cisco Firepower Threat Defense Software could allow an unauthenticated remote attacker to cause the unexpected restart of the SNORT detection engine resulting in a denial of service (DoS) condition. The vulnerability is due to the incomplete error handling of the SSL or TLS packet header during the connection establishment. An attacker could exploit this vulnerability by sending a crafted SSL or TLS packet during the connection handshake. An exploit could allow the attacker to cause the SNORT detection engine to unexpectedly restart resulting in a partial DoS condition while the detection engine restarts. Versions prior to 6.2.3.4 are affected.


A vulnerability in Cisco Meeting Server could allow an authenticated remote attacker to cause a partial denial of service (DoS) to Cisco Meetings application users who are paired with a Session Initiation Protocol (SIP) endpoint. The vulnerability is due to improper validation of coSpaces configuration parameters. An attacker could exploit this vulnerability by inserting crafted strings in specific coSpace parameters. An exploit could allow the attacker to prevent clients from joining a conference call in the affected coSpace. Versions prior to 2.4.3 are affected.


A vulnerability in the Session Initiation Protocol (SIP) protocol implementation of Cisco Unified Communications Manager could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient validation of input SIP traffic. An attacker could exploit this vulnerability by sending a malformed SIP packet to an affected Cisco Unified Communications Manager. A successful exploit could allow the attacker to trigger a new registration process on all connected phones temporarily disrupting service.


A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated remote attacker to cause high disk utilization resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software does not restrict the maximum size of certain files that can be written to disk. An attacker who has valid administrator credentials for an affected system could exploit this vulnerability by sending a crafted remote connection request to an affected system. A successful exploit could allow the attacker to write a file that consumes most of the available disk space on the system causing application functions to operate abnormally and leading to a DoS condition. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 12.5(1)SR1.


A vulnerability in the interactions between the DHCP and TFTP features for Cisco Small Business 300 Series (Sx300) Managed Switches could allow an unauthenticated remote attacker to cause the device to become low on system memory which in turn could lead to an unexpected reload of the device and result in a denial of service (DoS) condition on an affected device. The vulnerability is due to a failure to free system memory when an unexpected DHCP request is received. An attacker could exploit this vulnerability by sending a crafted DHCP packet to the targeted device. A successful exploit could allow the attacker to cause an unexpected reload of the device.


A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated remote attacker to cause the CPU to increase to 100% utilization causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a Session Initiation Protocol (SIP) message with a crafted XML payload to an affected device. A successful exploit could allow the attacker to exhaust CPU resources resulting in a DoS condition. Manual intervention may be required to recover the device. This vulnerability is fixed in Cisco Expressway Series and Cisco TelePresence Video Communication Server Releases X12.5.1 and later.


A vulnerability in the IPv6 traffic processing of Cisco NX-OS Software could allow an unauthenticated remote attacker to cause an unexpected restart of the netstack process on an affected device. The vulnerability is due to improper validation of IPv6 traffic sent through an affected device. An attacker could exploit this vulnerability by sending a malformed IPv6 packet through an affected device. A successful exploit could allow the attacker to cause a denial of service (DoS) condition while the netstack process restarts. A sustained attack could lead to a reboot of the device.


A denial of service vulnerability exists when .NET Core improperly handles web requests aka '.NET Core Denial of Service Vulnerability'.


A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated remote attacker to cause an affected device to reload. This vulnerability is due to a parsing issue on DNS packets. An attacker could exploit this vulnerability by sending crafted DNS packets through routers that are running an affected version and have NBAR enabled. A successful exploit could allow the attacker to cause the affected device to reload resulting in a denial of service (DoS) condition.


A vulnerability in the Internet Key Exchange Version 2 Mobility and Multihoming Protocol (MOBIKE) feature for the Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to the incorrect processing of certain MOBIKE packets. An attacker could exploit this vulnerability by sending crafted MOBIKE packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload resulting in a DoS condition. The MOBIKE feature is supported only for IPv4 addresses.


Multiple vulnerabilities in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated remote attacker to cause an affected device to reload resulting in a denial of service (DoS) condition. The vulnerabilities are due to the improper parsing of LDAP packets by an affected device. An attacker could exploit these vulnerabilities by sending an LDAP packet crafted using Basic Encoding Rules (BER) to an affected device. The LDAP packet must have a source IP address of an LDAP server configured on the targeted device. A successful exploit could cause the affected device to reload resulting in a DoS condition. Firepower 4100 Series Next-Generation Firewalls are affected in versions prior to 2.0.1.201 2.2.2.54 and 2.3.1.75. Firepower 9300 Security Appliances are affected in versions prior to 2.0.1.201 2.2.2.54 and 2.3.1.75. MDS 9000 Series Multilayer Switches are affected in versions prior to 8.2(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(1). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(2). Nexus 7000 and 7700 Series Switches are affected in versions prior to 8.2(1). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(1). Cisco UCS 6200 and 6300 Fabric Interconnect devices are affected in versions prior to 3.2(2b).


A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A successful exploit could allow the attacker to cause a heap buffer out-of-bounds read condition resulting in a crash that could result in a denial of service condition on an affected device.


A vulnerability in the implementation of the Short Message Service (SMS) handling functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated remote attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to improper processing of SMS protocol data units (PDUs) that are encoded with a special character set. An attacker could exploit this vulnerability by sending a malicious SMS message to an affected device. A successful exploit could allow the attacker to cause the wireless WAN (WWAN) cellular interface module on an affected device to crash resulting in a DoS condition that would require manual intervention to restore normal operating conditions.


A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated remote attacker to cause the CPU to increase to 100% utilization causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a specifically crafted XML payload. A successful exploit could allow the attacker to exhaust CPU resources resulting in a DoS condition until the system is manually rebooted. Software versions prior to X12.5.1 are affected.


A vulnerability in the UDP protocol implementation for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated remote attacker to exhaust system resources resulting in a denial of service (DoS) condition. The vulnerability is due to improper resource management for UDP ingress packets. An attacker could exploit this vulnerability by sending a high rate of UDP packets to an affected system within a short period of time. A successful exploit could allow the attacker to exhaust available system resources resulting in a DoS condition.


A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP failover server aka 'Windows DHCP Server Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-1212.


A vulnerability in the default configuration of the Cisco Aironet Active Sensor could allow an unauthenticated remote attacker to restart the sensor. The vulnerability is due to a default local account with a static password. The account has privileges only to reboot the device. An attacker could exploit this vulnerability by guessing the account name and password to access the CLI. A successful exploit could allow the attacker to reboot the device repeatedly creating a denial of service (DoS) condition. It is not possible to change the configuration or view sensitive data with this account. Versions prior to DNAC1.2.8 are affected.


A vulnerability in the Event Management Service daemon (emsd) of Cisco IOS XR Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this vulnerability by repeatedly sending unauthenticated gRPC requests to the affected device. A successful exploit could cause the emsd process to crash resulting in a DoS condition. Resolved in Cisco IOS XR 6.5.1 and later.


A vulnerability in the Virtual Shell (VSH) session management for Cisco NX-OS Software could allow an authenticated remote attacker to cause a VSH process to fail to delete upon termination. This can lead to a build-up of VSH processes that overtime can deplete system memory. When there is no system memory available this can cause unexpected system behaviors and crashes. The vulnerability is due to the VSH process not being properly deleted when a remote management connection to the device is disconnected. An attacker could exploit this vulnerability by repeatedly performing a remote management connection to the device and terminating the connection in an unexpected manner. A successful exploit could allow the attacker to cause the VSH processes to fail to delete which can lead to a system-wide denial of service (DoS) condition. The attacker must have valid user credentials to log in to the device using the remote management connection.


A denial of service vulnerability exists when Microsoft Defender improperly handles files aka 'Microsoft Defender Denial of Service Vulnerability'.


A vulnerability in Cisco Security Manager could allow an unauthenticated remote attacker to access sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to a targeted system that contain references within XML entities. An exploit could allow the attacker to retrieve files from the local system resulting in the disclosure of sensitive information or cause the application to consume available resources resulting in a DoS condition.


A denial of service vulnerability exists in Microsoft Exchange Server software when the software fails to properly handle objects in memory aka 'Microsoft Exchange Denial of Service Vulnerability'.


A denial of service vulnerability exists in Microsoft Word software when the software fails to properly handle objects in memory aka 'Microsoft Word Denial of Service Vulnerability'.


A vulnerability in the data acquisition (DAQ) component of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to bypass configured access control policies or cause a denial of service (DoS) condition. The vulnerability exists because the affected software improperly manages system memory resources when inspecting traffic. An attacker could exploit this vulnerability by generating specific traffic patterns for the software to inspect. A successful exploit could allow the attacker to exhaust system memory resources used for traffic inspection. Depending on the configuration the FTD Software could fail open and cease to inspect traffic or fail closed and result in a DoS condition. This vulnerability may require manual intervention to restore the software.


A denial of service vulnerability exists when the XmlLite runtime (XmlLite.dll) improperly parses XML input aka 'XmlLite Runtime Denial of Service Vulnerability'.


A denial of service vulnerability exists when Windows improperly handles objects in memory aka 'Windows Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-1346 CVE-2019-1347.


A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests aka 'Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability'.


In event_handler of keymaster_app.c there is possible resource exhaustion due to a table being lost on reboot. This could lead to local denial of service that is not fixed by a factory reset with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116055338.


Unhandled exception in Kernel-mode drivers for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access.


The SRX flowd process responsible for packet forwarding may crash and restart when processing specific multicast packets. By continuously sending the specific multicast packets an attacker can repeatedly crash the flowd process causing a sustained Denial of Service. This issue affects Juniper Networks Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D90; 15.1X49 versions prior to 15.1X49-D180; 17.3 versions; 17.4 versions prior to 17.4R2-S5 17.4R3; 18.1 versions prior to 18.1R3-S6; 18.2 versions prior to 18.2R2-S4 18.2R3; 18.3 versions prior to 18.3R2-S1 18.3R3; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R1-S1 19.1R2.


A Denial of Service (DoS) vulnerability in BGP in Juniper Networks Junos OS configured as a VPLS PE allows an attacker to craft a specific BGP message to cause the routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash repeated crashes can result in an extended DoS condition. This issue only affects PE routers configured with BGP Auto discovery for LDP VPLS. Other BGP configurations are unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D81; 12.3 versions prior to 12.3R12-S12; 12.3X48 versions prior to 12.3X48-D76; 14.1X53 versions prior to 14.1X53-D48; 15.1 versions prior to 15.1F6-S12 15.1R7-S2; 15.1X49 versions prior to 15.1X49-D150; 15.1X53 versions prior to 15.1X53-D235 15.1X53-D495 15.1X53-D590 15.1X53-D68; 16.1 versions prior to 16.1R3-S10 16.1R4-S12 16.1R6-S6 16.1R7-S1; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S9 17.1R3; 17.2 versions prior to 17.2R1-S7 17.2R2-S6 17.2R3; 17.3 versions prior to 17.3R2-S4 17.3R3; 17.4 versions prior to 17.4R1-S5 17.4R2; 18.1 versions prior to 18.1R2-S3 18.1R3.


An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.


A denial of service vulnerability exists in Windows DNS Server when it fails to properly handle DNS queries aka 'Windows DNS Server Denial of Service Vulnerability'.


A vulnerability in the SIP ALG packet processing service of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending specific types of valid SIP traffic to the device. In this case the flowd process crashes and generates a core dump while processing SIP ALG traffic. Continued receipt of these valid SIP packets will result in a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D61 12.3X48-D65 on SRX Series; 15.1X49 versions prior to 15.1X49-D130 on SRX Series; 17.3 versions prior to 17.3R3 on SRX Series; 17.4 versions prior to 17.4R2 on SRX Series.


SAP Mobile Platform SDK allows an attacker to prevent legitimate users from accessing a service either by crashing or flooding the service (i.e. denial of service). Fixed in versions 3.1 SP03 PL02 SDK 3.1 SP04 or later.


A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980 CVE-2019-0981.


On SRX5000 Series devices if 'set security zones security-zone <zone> tcp-rst' is configured the flowd process may crash when a specific TCP packet is received by the device and triggers a new session. The process restarts automatically. However receipt of a constant stream of these TCP packets may result in an extended Denial of Service (DoS) condition on the device. This issue affects Juniper Networks Junos OS: 18.2R3 on SRX 5000 Series; 18.4R2 on SRX 5000 Series; 19.2R1 on SRX 5000 Series.


A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820 CVE-2019-0981.


A denial of service vulnerability exists when ASP.NET Core improperly handles web requests aka 'ASP.NET Core Denial of Service Vulnerability'.


SSL-Proxy feature on SRX devices fails to handle a hardware resource limitation which can be exploited by remote SSL/TLS servers to crash the flowd daemon. Repeated crashes of the flowd daemon can result in an extended denial of service condition. For this issue to occur clients protected by the SRX device must initiate a connection to the malicious server. This issue affects: Juniper Networks Junos OS on SRX5000 Series: 12.3X48 versions prior to 12.3X48-D85; 15.1X49 versions prior to 15.1X49-D180; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R2-S6 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R2.