CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-24698
https://notcve.org/view.php?id=CVE-2020-24698
02 Oct 2020 — An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker might be able to cause a double-free, leading to a crash or possibly arbitrary code execution. by sending crafted queries with a GSS-TSIG signature. Se detectó un problema en PowerDNS Authoritative versiones hasta 4.3.0, cuando es usado --enable-experimental-gss-tsig. Un atacante remoto no autenticado podría causar una doble liberación, conllevando a un bloqueo... • https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-06.html • CWE-415: Double Free •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-24697
https://notcve.org/view.php?id=CVE-2020-24697
02 Oct 2020 — An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can cause a denial of service by sending crafted queries with a GSS-TSIG signature. Se detectó un problema en PowerDNS Authoritative versiones hasta 4.3.0, cuando es usado --enable-experimental-gss-tsig. Un atacante no autenticado remoto puede causar una denegación de servicio mediante el envío de consultas diseñadas con una firma GSS-TSIG • https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-06.html •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-24696
https://notcve.org/view.php?id=CVE-2020-24696
02 Oct 2020 — An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can trigger a race condition leading to a crash, or possibly arbitrary code execution, by sending crafted queries with a GSS-TSIG signature. Se detectó un problema en PowerDNS Authoritative versiones hasta 4.3.0, cuando es usado --enable-experimental-gss-tsig. Un atacante no autenticado remoto puede desencadenar una condición de carrera conllevando a un bloqueo... • https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-06.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-17482 – Ubuntu Security Notice USN-7203-1
https://notcve.org/view.php?id=CVE-2020-17482
02 Oct 2020 — An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an authorized user with the ability to insert crafted records into a zone might be able to leak the content of uninitialized memory. Se ha encontrado un problema en PowerDNS Authoritative Server versiones anteriores a 4.3.1, donde un usuario autorizado con la capacidad de insertar registros diseñados en una zona podría filtrar el contenido de la memoria no inicializada Wei Hao discovered that PowerDNS Authoritative Server incorrectl... • https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-05.html • CWE-908: Use of Uninitialized Resource •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-10162 – Debian Security Advisory 4470-1
https://notcve.org/view.php?id=CVE-2019-10162
23 Jun 2019 — A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify. Se ha detectado una vulnerabilidad en Authoritative Server de PowerDNS anterior a versiones 4.1.10, 4.0.... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00036.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2019-10163 – Debian Security Advisory 4470-1
https://notcve.org/view.php?id=CVE-2019-10163
23 Jun 2019 — A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to cause a high CPU load or even prevent any further updates to any slave zone by sending a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue. Se ha detectado una vulnerabilidad en Authoritative Server de PowerDNS anterior a versiones 4.1.9, 4.0.8, que permite a un servidor maestro autorizado y remoto causar una alta ca... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00036.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-14626 – Ubuntu Security Notice USN-7203-1
https://notcve.org/view.php?id=CVE-2018-14626
29 Nov 2018 — PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cache pollution via crafted query that can lead to denial of service. PowerDNS Authoritative Server desde la versión 4.1.0 hasta la 4.1.4 y PowerDNS Recursor desde la versión 4.0.0 hasta la 4.1.4, son vulnerables a una contaminación de memora caché de paquetes mediante una consulta manipulada que puede provocar una denegación de servicio (DoS). Wei Hao discovered that PowerD... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14626 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-10851 – Ubuntu Security Notice USN-7203-1
https://notcve.org/view.php?id=CVE-2018-10851
29 Nov 2018 — PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, are vulnerable to a memory leak while parsing malformed records that can lead to remote denial of service. PowerDNS Authoritative Server desde la versión 3.3.0 hasta la 4.1.4 excluyendo las versiones 4.1.5 y 4.0.6, y PowerDNS Recursor desde la versión 3.2 hasta la 4.1.4 excluyendo las versiones 4.1.5 y 4.0.9, son vulnerables a una fuga de memoria cuando se analizan regi... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10851 • CWE-400: Uncontrolled Resource Consumption CWE-772: Missing Release of Resource after Effective Lifetime •