AZL-10999 CVE-2022-2795 affecting package bind for versions less than 9.16.33-1

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service...

ALPINE-CVE-2022-2795

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service...

DEBIAN-CVE-2022-2795

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service...

Red Hat OpenShift 安全漏洞

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that supports building, testing, deploying, and running applications. A security vulnerability exists in Red Hat OpenShift. An attacker exploited the vulnerability to provide incorrect names using a DNS...

UBUNTU-CVE-2022-2795

By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service...

nodejs: DNS rebinding in --inspect via invalid IP addresses

A vulnerability was found in NodeJS, where the IsAllowedHost check can be easily bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided for instance, 10.0.2.555 is provided, browsers such as Firefox will make DNS requests ...

CVE-2022-28321

The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pamaccess.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a...

CLSA-2022-1663184219 Fixed CVE-2022-2526 in systemd

CVE-2022-2526: use unref the DnsStream in callbacks correctly...

PT-2022-4937 · Isc +12 · Bind +12

Name of the Vulnerable Software and Affected Versions: BIND versions prior to the fixed version Description: The issue is related to a flaw in the DNSSEC implementation of the BIND DNS server, specifically with the incorrect verification of the EdDSA cryptographic signature. This can be exploited...

PT-2022-4936 · Isc +12 · Bind +12

Name of the Vulnerable Software and Affected Versions: BIND versions prior to the fixed version Description: The issue is related to a memory leak in the DNSSEC code for the ECDSA algorithm. By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can...

CVE-2022-34724

Windows DNS Server Denial of Service Vulnerability...

nodejs: DNS rebinding in --inspect via invalid IP addresses

A vulnerability was found in NodeJS, where the IsAllowedHost check can be easily bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided for instance, 10.0.2.555 is provided, browsers such as Firefox will make DNS requests ...

Microsoft Windows DNS 安全漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows DNS. The following products and editions are affected:Windows Server 2019,Windows Server 2019 Server Core installation,Windows Server...

ActivityWatch 安全漏洞

ActivityWatch is a free and open source automated time tracker from ActivityWatch Open Source. A security vulnerability exists in versions of ActivityWatch prior to 0.12.0b2 that stems from vulnerability to DNS rebinding attacks, which can be exploited by an attacker to...

PT-2022-20564 · Unknown · Activitywatch

Name of the Vulnerable Software and Affected Versions: ActivityWatch versions prior to 0.12.0b2 Description: The issue allows attackers to perform DNS rebinding attacks, giving them full access to the ActivityWatch REST API. This impacts all users running the affected versions of ActivityWatch...

CVE-2022-32743

Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it...

The vulnerability of the DNS-server BIND daemon, which allows a hacker to cause a service failure.

The vulnerability of the DNS-server BIND daemon is related to the use of the assert function or similar operators. Exploiting this vulnerability allows a remote attacker to cause a service failure...

USN-5583-1 systemd vulnerability

It was discovered that systemd incorrectly handled certain DNS requests, which leads to user-after-free vulnerability. An attacker could possibly use this issue to cause a crash or execute arbitrary code. CVE-2022-2526...

systemd-resolved: use-after-free when dealing with DnsStream in resolved-dns-stream.c

A use-after-free vulnerability was found in systemd. This issue occurs due to the onstreamio function and dnsstreamcomplete function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the...

CVE-2022-37428

PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a denial of service daemon crash via a DNS query that leads to an answer with specific properties...