DNS BIND HTTP Request Processing Data Compromise

The vulnerability of the DNS BIND server is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to compromise data integrity remotely...

CLSA-2022-1663184219 Fixed CVE-2022-2526 in systemd

CVE-2022-2526: use unref the DnsStream in callbacks correctly...

PT-2022-4937 · Isc +12 · Bind +12

Name of the Vulnerable Software and Affected Versions: BIND versions prior to the fixed version Description: The issue is related to a flaw in the DNSSEC implementation of the BIND DNS server, specifically with the incorrect verification of the EdDSA cryptographic signature. This can be exploited...

PT-2022-4936

Name of the Vulnerable Software and Affected Versions BIND versions prior to the fixed version Description The issue is related to a memory leak in the DNSSEC code for the ECDSA algorithm. By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigge...

CVE-2022-34724

Windows DNS Server Denial of Service Vulnerability...

nodejs: DNS rebinding in --inspect via invalid IP addresses

A vulnerability was found in NodeJS, where the IsAllowedHost check can be easily bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided for instance, 10.0.2.555 is provided, browsers such as Firefox will make DNS requests ...

Microsoft Windows DNS 安全漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows DNS. The following products and editions are affected:Windows Server 2019,Windows Server 2019 Server Core installation,Windows Server...

PT-2022-20564 · Unknown · Activitywatch

Name of the Vulnerable Software and Affected Versions: ActivityWatch versions prior to 0.12.0b2 Description: The issue allows attackers to perform DNS rebinding attacks, giving them full access to the ActivityWatch REST API. This impacts all users running the affected versions of ActivityWatch...

ActivityWatch 安全漏洞

ActivityWatch is a free and open source automated time tracker from ActivityWatch Open Source. A security vulnerability exists in versions of ActivityWatch prior to 0.12.0b2 that stems from vulnerability to DNS rebinding attacks, which can be exploited by an attacker to...

PublicCMS server-side request forgery vulnerability

PublicCMS is an open source content management system CMS written in Java by PublicCMS, China. publicCMS 4.0.202011.b previous versions exist server-side request forgery vulnerability, the vulnerability stems from the file parameter for access to the IP and domain name is not restricted. An...

CVE-2022-32743

Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it...

DNS-server BIND DoS

The vulnerability of the DNS-server BIND daemon is related to the use of the assert function or similar operators. Exploiting this vulnerability allows a remote attacker to cause a service failure...

USN-5583-1 systemd vulnerability

It was discovered that systemd incorrectly handled certain DNS requests, which leads to user-after-free vulnerability. An attacker could possibly use this issue to cause a crash or execute arbitrary code. CVE-2022-2526...

systemd-resolved: use-after-free when dealing with DnsStream in resolved-dns-stream.c

A use-after-free vulnerability was found in systemd. This issue occurs due to the onstreamio function and dnsstreamcomplete function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the...

UBUNTU-CVE-2022-37428

PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a denial of service daemon crash via a DNS query that leads to an answer with specific properties...

CVE-2022-37428

PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a denial of service daemon crash via a DNS query that leads to an answer with specific properties...

resolved-dns-stream Code Execution

The vulnerabilities of the onstreamio and dnsstreamcomplete functions in the resolved-dns-stream.c component of the initialization and service management subsystem of the Systemd-based Linux operating systems are related to the use of memory after it is freed. Exploiting these vulnerabilities cou...

PT-2022-4938

Name of the Vulnerable Software and Affected Versions BIND versions affected versions not specified Description The issue is related to a flaw in the resolver code of the DNS server, which can be exploited by flooding the target resolver with queries, significantly impairing its performance and...

GNU Binutils 资源管理错误漏洞

GNU Binutils is a set of binary tools developed by the GNU Project, mainly used to deal with target files e.g., executables, libraries, etc., covering compilation, linking, debugging, and other phases of the function. GNU Binutils suffers from an excessive memory consumption vulnerability, which...

CVE-2022-33991

dproxy-nexgen aka dproxy nexgen forwards and caches DNS queries with the CD aka checking disabled bit set to 1. This leads to disabling of DNSSEC protection provided by upstream resolvers...