CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
baseThe product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (1371)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-20353US | high8.6OT kritisch | KEV | ||
A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthen… | ||||
| CVE-2020-13935US | high7.5 | Exploit | ||
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payl… | ||||
| CVE-2014-0050US | high7.5 | Exploit | ||
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infin… | ||||
| CVE-2021-21341US | high7.5 | Exploit | ||
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CP… | ||||
| CVE-2022-0778US | high7.5 | Exploit | ||
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsi… | ||||
| CVE-2017-16944US | high7.5 | Exploit | ||
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors… | ||||
| CVE-2021-4044US | high7.5 | Exploit | ||
Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate… | ||||
| CVE-2020-36227US | high7.5 | — | ||
A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service. | ||||
| CVE-2019-14241US | high7.5 | — | ||
HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c. | ||||
| CVE-2019-19307US | critical9.8 | — | ||
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by send… | ||||
| CVE-2023-34966US | high7.5 | — | ||
An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function… | ||||
| CVE-2019-0190US | high7.5 | — | ||
A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial… | ||||
| CVE-2023-1718US | high7.5 | Exploit | ||
Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-service via a crafted "… | ||||
| CVE-2022-46770US | high7.5 | Exploit | ||
qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of forwarding) via a crafte… | ||||
| CVE-2020-7046US | high7.5 | — | ||
lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a… | ||||
| CVE-2018-8002US | high8.8 | Exploit | ||
In PoDoFo 0.9.5, there exists an infinite loop vulnerability in PdfParserObject::ParseFileComplete() in PdfParserObject.cpp which may result in stack overflow. Remote attackers cou… | ||||
| CVE-2022-23833US | high7.5 | — | ||
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infini… | ||||
| CVE-2019-5097US | high7.5 | — | ||
A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A spe… | ||||
| CVE-2018-1041US | high7.5 | Exploit | ||
A vulnerability was found in the way RemoteMessageChannel, introduced in jboss-remoting versions 3.3.10, reads from an empty buffer. An attacker could use this flaw to cause denial… | ||||
| CVE-2016-7478US | high7.5 | — | ||
Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object… | ||||
03
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan