CVE-2015-10011

CVE-2015-10011 affects OpenDNS OpenResolve, specifically the resolverapi/endpoints.py component. The root cause is improper output neutralization for logs, enabling high-severity impact per CVSSv3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base score 9.8). A patch is identified (9eba6ba5abd...

PT-2023-10189 · Opendns · Opendns Openresolve

Name of the Vulnerable Software and Affected Versions: OpenDNS OpenResolve affected versions not specified Description: A problem was found in OpenDNS OpenResolve, related to the function get of the file resolverapi/endpoints.py of the component API. This issue leads to cross site scripting. The...

go-resolver's DNSSEC validation not performed correctly

go-resolver's DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and delegation chain...

go-resolver vulnerable to attacker-controlled domains due to unvalidated RRSIG RRs

go-resolver's DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a...

GHSA-87MM-QXM5-CP3F go-resolver vulnerable to attacker-controlled domains due to unvalidated RRSIG RRs

go-resolver's DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a...

GHSA-JR65-GPJ5-CW74 go-resolver's DNSSEC validation not performed correctly

go-resolver's DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and delegation chain...

EulerOS Virtualization 2.10.0 : unbound (EulerOS-SA-2022-2922)

According to the versions of the unbound packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the 'ghost domain names' attack. The...

go-resolver 数据伪造问题漏洞

go-resolver is a Golang DNSSEC validation parser library implemented on top of miekg/dns by the peterzen personal developer. A security vulnerability exists in go-resolver, which stems from DNSSEC authentication not being performed correctly...

go-resolver 数据伪造问题漏洞

go-resolver is a Golang DNSSEC validation parser library implemented on top of miekg/dns by the peterzen personal developer. A security vulnerability exists in go-resolver, which stems from DNSSEC authentication not being performed correctly...

AIX 7.1 TL 5 : bind (IJ44422)

https://vulners.com/cve/CVE-2022-38178 ISC BIND is vulnerable to a denial of service, caused by a memory leak in the DNSSEC verification code for the EdDSA algorithm. By spoofing the target resolver with responses that have a malformed EdDSA signature, a remote attacker could exploit this...

AIX 7.2 TL 5 : bind (IJ44426) (deprecated)

https://vulners.com/cve/CVE-2022-38178 https://vulners.com/cve/CVE-2022-38178 ISC BIND is vulnerable to a denial of service, caused by a memory leak in the DNSSEC verification code for the EdDSA algorithm. By spoofing the target resolver with responses that have a malformed EdDSA signature, a...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2022-2838)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP10 : bind (EulerOS-SA-2022-2838)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively...

K03755971: BIG-IP DNS resolver vulnerability CVE-2022-28706

Security Advisory Description When the DNS resolver configuration is used, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. CVE-2022-28706 Impact Traffic is disrupted while the TMM process restarts. This vulnerability allows a remote attacker to cause a...

Unbound: Multiple Vulnerabilities

Background Unbound is a validating, recursive, and caching DNS resolver. Description Multiple vulnerabilities have been discovered in Unbound. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no...

GLSA-202212-02 : Unbound: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202212-02 Unbound: Multiple Vulnerabilities - NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the ghost domain names attack. The vulnerability works by targeting an Unbound instance. Unbound...

Researchers Uncover New Drokbk Malware that Uses GitHub as a Dead Drop Resolver

The subgroup of an Iranian nation-state group known as Nemesis Kitten has been attributed as behind a previously undocumented custom malware dubbed Drokbk that uses GitHub as a dead drop resolver to exfiltrate data from an infected computer, or to receive commands. "The use of GitHub as a virtual...

CLSA-2022-1670518442 Fix CVE(s): CVE-2016-6170, CVE-2016-2775

SECURITY UPDATE: degrade resolver performance and possibly DoS - debian/patches/CVE-2016-2775.patch: fix possible infinite loop in lwresd due to a long query name - CVE-2016-2775 SECURITY UPDATE: improper restriction of zone size limit - debian/patches/CVE-2016-6170.patch: allow the maximum numbe...

EulerOS 2.0 SP8 : bind (EulerOS-SA-2022-2788)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively...

The vulnerability of the ProxyResolverV8::SetPacScript function (proxy_resolver_v8.cc) in Android operating systems allows a hacker to execute arbitrary code.

The vulnerability of the ProxyResolverV8::SetPacScript function proxyresolverv8.cc in Android operating systems is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...