AZL-49976 CVE-2024-8508 affecting package unbound for versions less than 1.19.1-3

NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression ...

My Cloud OS Dynamic DNS Code Execution

The vulnerability of the Dynamic DNS component of the My Cloud OS operating system is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

USN-7047-1 knot-resolver vulnerabilities

Vladimír Čunát discovered that Knot Resolver incorrectly handled input during DNSSEC validation. A remote attacker could possibly use this issue to bypass certain validations. CVE-2019-10190 Vladimír Čunát discovered that Knot Resolver incorrectly handled input during DNSSEC validation. A remote...

CLSA-2024-1726841419 bind: Fix of 2 CVEs

CVE-2024-1737-1: introduced new configurable limits that prevent the loading into zones or into cache of DNS resource records RRs that exceed them - CVE-2024-1737-2: add environment variable DNSRDATASETMAXRECORDS, DNSRBTDBMAXRTYPES to override hardcoded limits DDNSRDATASETMAXRECORDS and...

SUSE CVE-2023-30464

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack...

CVE-2023-30464

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack...

golang: net: malformed DNS message can cause infinite loop

A flaw was found in the net package of the Go stdlib. When a malformed DNS message is received as a response to a query, the Lookup functions within the net package can get stuck in an infinite loop. This issue can lead to resource exhaustion and denial of service DoS conditions...

CVE-2023-28457

An issue was discovered in Technitium through 11.0.3. It enables attackers to conduct a DNS cache poisoning attack and inject fake responses within 1 second, which is impactful...

CVE-2023-30464

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack...

Technitium DNS Server 安全漏洞

Technitium DNS Server is an open source authoritative and recursive DNS server from the Technitium team. It can be used to self-host DNS servers for privacy and security. A security vulnerability exists in Technitium DNS Server version 11.5.3, which stems from a DNSBomb operation that can lead to...

PT-2024-12165 · Unknown · Technitium

Name of the Vulnerable Software and Affected Versions: Technitium versions through 11.0.3 Description: The issue enables attackers to conduct a DNS cache poisoning attack, allowing them to inject fake responses within 1 second. Recommendations: For versions through 11.0.3, update to a version tha...

PT-2024-12161 · Unknown · Technitium

Name of the Vulnerable Software and Affected Versions: Technitium version 11.0.2 Description: An issue was discovered in the DNS resolving software, which triggers a resolver to ignore valid responses, thus causing a denial of service for normal resolution. The effects of an exploit would be...

Brave 安全漏洞

Brave is a fast, private and secure web browser from Brave USA. A security vulnerability exists in versions prior to Brave 1.67.116 that stems from the omission of domain names from the right side instead of the left side of the Brave Shields pop-up window, which can lead to domain name confusion...

CoreDNS 安全漏洞

CoreDNS is a DNS server for the CoreDNS community. A security vulnerability exists in CoreDNS version 1.10.1 and earlier, which stems from an attack that enables an attacker to achieve DNS cache poisoning and inject false responses...

External DNS requests from 'internal' networks could lead to data exfiltration

...

Avahi DNS Packet Append Record Reachable DoS

The vulnerability of the avahidnspacketAppendRecord function in the Avahi service discovery system is related to a reachable assertion. Exploiting this vulnerability allows an attacker to cause a service failure...

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers and thus a return value may contain an unsafe injection (e.g. XSS) that does not conform to the RFC1035 format.

...

MindsDB 安全漏洞

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. A security vulnerability exists in versions prior to MindsDB v23.12.4.2, which stems from the fact that an attacker can bypass server-side request forgery protections throughout a website via DNS rebinding, and may also...

CVE-2024-8418

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing...

DEBIAN-CVE-2024-8418

A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing...