dnslib 安全漏洞

dnslib is an open source Python library for encoding/decoding DNS wired format packets. A security vulnerability exists in dnslib that stems from the fact that the dnslib package does not verify that the ID value in a DNS reply matches the ID value in a query...

CVE-2022-22846

The dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query...

Qualcomm 芯片安全漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits mainly semiconductor devices, but also passive components, etc. and is often manufactured on the surface of semiconductor wafers. The Qualcomm chip has a security vulnerability that stems from a denial of...

Dnsmasq 缓冲区错误漏洞

dnsmasq is a lightweight DNS forwarding and DHCP, TFTP server written in C. Dnsmasq 2.86 suffers from a buffer error vulnerability that stems from having a heap-based buffer overflow in answerrequest called from FuzzAnswerTheRequest and fuzzrfc1035.c...

Iball WRD12EN 跨站请求伪造漏洞

The Iball WRD12EN is a router from iBall Iball India. The iBall WRD12EN version 1.0.0 suffers from a cross-site request forgery vulnerability that stems from a software request that lacks cross-site request forgery token validation, which can be exploited by an attacker to enable DNS settings or...

Brave 信息泄露漏洞

Brave is a fast, private and secure web browser from Brave USA. Brave Desktop suffers from an information disclosure vulnerability that originates in Brave Desktop 1.17 through 1.33 prior to 1.33.106, when cname-based adblocking and proxy extensions with SOCKS fallback are enabled, that uses the...

The vulnerability of the dname_pkt_copy function in the DNS server Unbound, allowing a hacker to cause a service failure

The vulnerability of the dnamepktcopy function in the Unbound DNS server is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the DNS Server component of the Microsoft Windows operating system, which allows a perpetrator to execute arbitrary code.

The vulnerability of the DNS Server component of the Microsoft Windows operating system is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

log4shell.tools !buildhttps://github.com/alexbakker/log4sh...

OESA-2021-1459 bind security update

Domain Name System DNS Server. Security Fixes: In BIND 9.3.0 - 9.11.35, 9.12.0 - 9.16.21, and versions 9.9.3-S1 - 9.11.35-S1 and 9.16.8-S1 - 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 - 9.17.18 of the BIND 9.17 development branch, exploitation of broken...

golang: net: lookup functions may return invalid host names

A flaw was found in Go. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in the net package and methods on the Resolver type, may return arbitrary values retrieved from DNS, allowing injection of unexpected contents. The highest threat from this vulnerability is to integri...

The vulnerability of the dname_pkt_copy function in the DNS server Unbound, allowing a hacker to cause a service failure

The vulnerability of the dnamepktcopy function in the Unbound DNS server is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a malicious actor to cause service failures...

A flaw was found in c-ares library where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

...

DEBIAN-CVE-2021-3672

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as we...

AZL-38359 CVE-2021-3672 affecting package ceph for versions less than 18.2.2-1

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as we...

ALPINE-CVE-2021-3672

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as we...

AZL-6928 CVE-2021-43523 affecting package uclibc-ng for versions less than 1.0.37-2

In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DNS servers via gethostbyname, getaddrinfo, gethostbyaddr, and getnameinfo can lead to output of wrong hostnames leading to domain hijacking or injection into applications leading to remote...

dnsmasq: fixed outgoing port used when --server is used with an interface name

A flaw was found in dnsmasq. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and...

RLSA-2021:4384 Moderate: bind security and bug fix update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

PT-2021-19563 · Unknown · Capital Embedded Ar Classic R20-11 +1

Name of the Vulnerable Software and Affected Versions: Capital Embedded AR Classic 431-422 versions all Capital Embedded AR Classic R20-11 versions all prior to V2303 Description: A vulnerability has been identified where the DHCP client application does not validate the length of the Domain Name...