CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-48256
https://notcve.org/view.php?id=CVE-2022-48256
Technitium DNS Server before 10.0 allows a self-CNAME denial-of-service attack in which a CNAME loop causes an answer to contain hundreds of records. Technitium DNS Server anterior a 10.0 permite un ataque de denegación de servicio CNAME propio en el que un bucle CNAME provoca que una respuesta contenga cientos de registros. • https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-100 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30258
https://notcve.org/view.php?id=CVE-2022-30258
An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and highly impactful, because the exploitation conforms to de facto DNS specifications and operational practices, and overcomes current mitigation patches for "Ghost" domain names. Se descubrió un problema en Technitium DNS Server hasta 8.0.2 que permite la variante V2 de resolución de nombres de dominio no deseada. Un nombre de dominio revocado aún se puede resolver durante mucho tiempo, incluidos dominios caducados y dominios maliciosos eliminados. • https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-81 • CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30257
https://notcve.org/view.php?id=CVE-2022-30257
An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and highly impactful, because the exploitation conforms to de facto DNS specifications and operational practices, and overcomes current mitigation patches for "Ghost" domain names. Se descubrió un problema en Technitium DNS Server hasta 8.0.2 que permite la variante V1 de resolución de nombres de dominio no deseada. Un nombre de dominio revocado aún se puede resolver durante mucho tiempo, incluidos dominios caducados y dominios maliciosos eliminados. • https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-81 • CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-27615
https://notcve.org/view.php?id=CVE-2022-27615
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before 2.2.2-5027 allows remote authenticated users to delete arbitrary files via unspecified vectors. Una vulnerabilidad de limitación inapropiada de un nombre de ruta a un directorio restringido ("Salto de Ruta") en el componente cgi en el Servidor DNS de Synology versiones anteriores a 2.2.2-5027, permite a usuarios remotos autenticados eliminar archivos arbitrarios por medio de vectores no especificados • https://www.synology.com/security/advisory/Synology_SA_20_27 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43105
https://notcve.org/view.php?id=CVE-2021-43105
A vulnerability in the bailiwick checking function in Technitium DNS Server <= v7.0 exists that allows specific malicious users to inject `NS` records of any domain (even TLDs) into the cache and conduct a DNS cache poisoning attack. Se presenta una vulnerabilidad en la función bailiwick checking en Technitium DNS Server versiones anteriores a v7.0 incluyéndola, que permite a usuarios maliciosos específicos inyectar registros "NS" de cualquier dominio (incluso TLD) en el caché y conducir un ataque de envenenamiento de caché de DNS • https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md •