CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-48256
https://notcve.org/view.php?id=CVE-2022-48256
13 Jan 2023 — Technitium DNS Server before 10.0 allows a self-CNAME denial-of-service attack in which a CNAME loop causes an answer to contain hundreds of records. Technitium DNS Server anterior a 10.0 permite un ataque de denegación de servicio CNAME propio en el que un bucle CNAME provoca que una respuesta contenga cientos de registros. • https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-100 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30257
https://notcve.org/view.php?id=CVE-2022-30257
21 Nov 2022 — An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and highly impactful, because the exploitation conforms to de facto DNS specifications and operational practices, and overcomes current mitigation patches for "Ghost" domain names. Se descubrió un problema en Technitium... • https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-81 • CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-30258
https://notcve.org/view.php?id=CVE-2022-30258
21 Nov 2022 — An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and highly impactful, because the exploitation conforms to de facto DNS specifications and operational practices, and overcomes current mitigation patches for "Ghost" domain names. Se descubrió un problema en Technitium... • https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-81 • CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 8.5EPSS: 1%CPEs: 1EXPL: 0CVE-2022-27615
https://notcve.org/view.php?id=CVE-2022-27615
28 Jul 2022 — Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before 2.2.2-5027 allows remote authenticated users to delete arbitrary files via unspecified vectors. Una vulnerabilidad de limitación inapropiada de un nombre de ruta a un directorio restringido ("Salto de Ruta") en el componente cgi en el Servidor DNS de Synology versiones anteriores a 2.2.2-5027, permite a usuarios remotos autenticados eliminar archivos arbitrarios por med... • https://www.synology.com/security/advisory/Synology_SA_20_27 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43105
https://notcve.org/view.php?id=CVE-2021-43105
28 Mar 2022 — A vulnerability in the bailiwick checking function in Technitium DNS Server <= v7.0 exists that allows specific malicious users to inject `NS` records of any domain (even TLDs) into the cache and conduct a DNS cache poisoning attack. Se presenta una vulnerabilidad en la función bailiwick checking en Technitium DNS Server versiones anteriores a v7.0 incluyéndola, que permite a usuarios maliciosos específicos inyectar registros "NS" de cualquier dominio (incluso TLD) en el caché y conducir un ataque de envene... • https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md •
CVSS: 7.5EPSS: 2%CPEs: 9EXPL: 0CVE-2020-8621 – Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.c
https://notcve.org/view.php?id=CVE-2020-8621
21 Aug 2020 — In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affected. En BIND versiones 9.14.0 -) 9.16.5, 9.17.0 -) 9.17.3, si un servidor está configurado con minimización de QNAME y "forward first", entonces un atacante que pueda enviarle consultas puede ser capaz de desencadenar la condición que... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html • CWE-617: Reachable Assertion •
CVSS: 6.5EPSS: 0%CPEs: 19EXPL: 0CVE-2020-8622 – A truncated TSIG response can lead to an assertion failure
https://notcve.org/view.php?id=CVE-2020-8622
21 Aug 2020 — In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the pack... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html • CWE-400: Uncontrolled Resource Consumption CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 2%CPEs: 16EXPL: 0CVE-2020-8623 – A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c
https://notcve.org/view.php?id=CVE-2020-8623
21 Aug 2020 — In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker En BIND versiones 9.10.0 -) 9.11.21, 9.12.0 -) 9.16.5, 9.17.0 -) 9... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html • CWE-400: Uncontrolled Resource Consumption CWE-617: Reachable Assertion •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12074
https://notcve.org/view.php?id=CVE-2017-12074
24 Aug 2017 — Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticated attackers to write arbitrary files via the domain_name parameter. Una vulnerabilidad de salto de directorio en SYNO.DNSServer.Zone.MasterZoneConf en Synology DNS Server en versiones anteriores a la 2.2.1-3042 permite que atacantes remotos escriban archivos arbitrarios mediante el parámetro domain_name. • https://www.synology.com/en-global/support/security/Synology_SA_17_46_DNS_Server • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •