Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
235 results · page 4 of 5
Apr 15, 2022Windows DNS Server Remote Code Execution VulnerabilityCVE-2022-26811 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows DNS Server Remote Code Execution VulnerabilityCVE-2022-24536 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 28, 2022A vulnerability in the bailiwick checking function in Technitium DNS Server <= v7.0 exists that allows specific malicious users to inject `NS` records of any doCVE-2021-43105 · Other software · Technitium · reported by MITREMedium 4.3
A vulnerability in the bailiwick checking function in Technitium DNS Server <= v7.0 exists that allows specific malicious users to inject `NS` records of any domain (even TLDs) into the cache and conduct a DNS cache poisoning attack.
- Product
- DNS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Windows DNS Server Remote Code Execution VulnerabilityCVE-2022-21984 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1909
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 10, 2021In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DNS servers via gethostbyname, getaddrinfo, gethostbCVE-2021-43523 · Other software · Uclibc · reported by MITRECritical 9.6
In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DNS servers via gethostbyname, getaddrinfo, gethostbyaddr, and getnameinfo can lead to output of wrong hostnames (leading to domain hijacking) or injection into applications (leading to remote code execution, XSS, applications crashes, etc.). In other words, a validation step, which is expected in any stub resolver, does not occur.
- Product
- Uclibc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comuclibc-ng.org
Oct 12, 2021Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-40469 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Aug 2, 2021Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an uCVE-2021-33195 · Other software · Golang · reported by MITREHigh 7.3
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.
- Product
- GO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comgroups.google.com
Jul 16, 2021Windows DNS Server Denial of Service VulnerabilityCVE-2021-34444 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Windows DNS Server Denial of Service Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 16, 2021Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-34442 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-34525 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2012 R2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows DNS Server Denial of Service VulnerabilityCVE-2021-34499 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Windows DNS Server Denial of Service Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-34494 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-33780 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-33754 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-33746 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 14, 2021Windows DNS Server Denial of Service VulnerabilityCVE-2021-33745 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Windows DNS Server Denial of Service Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 1, 2021A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory oveCVE-2021-23017 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.7
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
- Product
- Nginx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmailman.nginx.orgpacketstormsecurity.com
Mar 11, 2021Windows DNS Server Denial of Service VulnerabilityCVE-2021-27063 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows DNS Server Denial of Service Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-26897 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021Windows DNS Server Denial of Service VulnerabilityCVE-2021-26896 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows DNS Server Denial of Service Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-26895 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-26894 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-26893 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-26877 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2008 R2 Service Pack 1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Feb 25, 2021Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-24078 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Windows DNS Server Remote Code Execution Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Dec 31, 2020An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust.CVE-2020-35857 · Other software · Trust-dns-server Project · reported by MITREHigh 7.5
An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption.
- Product
- Trust-dns-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2020A flaw was found in samba's DNS server.CVE-2020-14383 · Other software · Samba · reported by Red HatMedium 6.5
A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services will not.
- Product
- Samba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Oct 28, 2020An issue was discovered in Dual DHCP DNS Server 7.40.CVE-2020-26133 · Other software · Dual Dhcp DNS Server Project · reported by MITREHigh 7.8
An issue was discovered in Dual DHCP DNS Server 7.40. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the DualServer.exe binary.
- Product
- Dual Dhcp DNS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2020An issue was discovered in Home DNS Server 0.10.CVE-2020-26132 · Other software · Home DNS Server Project · reported by MITREHigh 7.8
An issue was discovered in Home DNS Server 0.10. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the HomeDNSServer.exe binary.
- Product
- Home DNS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2020Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP addreCVE-2020-12620 · Other software · Pi-hole · reported by MITREHigh 7.8
Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address).
- Product
- Pi-hole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0xpanic.github.iogithub.com
Jul 14, 2020Microsoft Windows DNS Server Remote Code Execution VulnerabilityCVE-2020-1350 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 10
Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.
- Product
- Windows
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comportal.msrc.microsoft.com
Mar 4, 2020A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to change DNS servers without beCVE-2019-19225 · Other software · Dlink · reported by MITREHigh 7.5
A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to change DNS servers without being authenticated on the admin interface by submitting a crafted Forms/dns_1 POST request.
- Product
- Dsl-2680 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2019Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read operation beyond the buCVE-2019-14513 · Other software · Thekelleys · reported by MITREHigh 7.5
Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read operation beyond the buffer allocated for the packet, a different vulnerability than CVE-2017-14491.
- Product
- Dnsmasq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 15, 2019A denial of service vulnerability exists in Windows DNS Server when it fails to properly handle DNS queries, aka 'Windows DNS Server Denial of Service VulnerabiCVE-2019-0811 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
A denial of service vulnerability exists in Windows DNS Server when it fails to properly handle DNS queries, aka 'Windows DNS Server Denial of Service Vulnerability'.
- Product
- Windows Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Mar 13, 2019In tinysvcmdns through 2018-01-16, an mDNS server processing a crafted packet can perform arbitrary data read operations up to 16383 bytes from the start of theCVE-2019-9748 · Other software · Tinysvcmdns Project · reported by MITRECritical 9.1
In tinysvcmdns through 2018-01-16, an mDNS server processing a crafted packet can perform arbitrary data read operations up to 16383 bytes from the start of the buffer. This can lead to a segmentation fault in uncompress_nlabel in mdns.c and a crash of the server (depending on the memory protection of the CPU and the operating system), or disclosure of memory content via error messages or a server response. NOTE: the product's web site states "This project is un-maintained, and has been since 2013. ... There are known vulnerabilities ... You are advised to NOT use this library for any new projects / products."
- Product
- Tinysvcmdns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbitbucket.org
Jan 16, 2019An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service beinCVE-2017-3143 · Other software · ISC · reported by security-officer@isc.orgHigh 7.5
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.
- Product
- BIND 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jan 16, 2019An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSICVE-2017-3142 · Other software · ISC · reported by security-officer@isc.orgMedium 5.3
An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2.
- Product
- BIND 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Dec 11, 2018A remote code execution vulnerability exists in Windows Domain Name System (DNS) servers when they fail to properly handle requests, aka "Windows DNS Server HeaCVE-2018-8626 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
A remote code execution vulnerability exists in Windows Domain Name System (DNS) servers when they fail to properly handle requests, aka "Windows DNS Server Heap Overflow Vulnerability." This affects Windows Server 2012 R2, Windows Server 2019, Windows Server 2016, Windows 10, Windows 10 Servers.
- Product
- Windows Server 2012 R2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comportal.msrc.microsoft.com
Nov 7, 2017An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library.CVE-2017-2909 · Other software · Cesanta · reported by talos-cna@cisco.comHigh 7.5
An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service. An attacker can send a packet over the network to trigger this vulnerability.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 26, 2017In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_tyCVE-2017-15908 · Other software · Systemd Project · reported by MITREHigh 7.5
In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function of the 'systemd-resolved' service and cause a DoS of the affected service.
- Product
- Systemd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Aug 24, 2017Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticated attackers to wrCVE-2017-12074 · Network & remote access · Synology · reported by security@synology.comMedium 6.5
Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticated attackers to write arbitrary files via the domain_name parameter.
- Product
- Synology DNS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
May 12, 2017Windows DNS Server allows a denial of service vulnerability when Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows ServCVE-2017-0171 · Computers, phones & browsers · Microsoft Corporation · reported by secure@microsoft.comMedium 5.9
Windows DNS Server allows a denial of service vulnerability when Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows Server 2016 are configured to answer version queries, aka "Windows DNS Server Denial of Service Vulnerability".
- Product
- Windows DNS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comportal.msrc.microsoft.com
Mar 24, 2017The __read_etc_hosts_r function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via a crCVE-2016-2225 · Other software · Uclibc-ng Project · reported by MITREHigh 7.5
The __read_etc_hosts_r function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via a crafted packet.
- Product
- Uclibc-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrepo.or.czopenwall.com
Mar 24, 2017The __decode_dotted function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via vectorsCVE-2016-2224 · Other software · Uclibc-ng Project · reported by MITREHigh 7.5
The __decode_dotted function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via vectors involving compressed items in a reply.
- Product
- Uclibc-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrepo.or.czopenwall.com
Feb 9, 2017Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service (memory exhaustion and slave server crash) via a large zone transfer for (1) DDNS, CVE-2016-6171 · Other software · Knot-dns · reported by Red HatHigh 8.6
Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service (memory exhaustion and slave server crash) via a large zone transfer for (1) DDNS, (2) AXFR, or (3) IXFR.
- Product
- Knot DNS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Sep 26, 2016PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS serverCVE-2016-6172 · Other software · Opensuse · reported by Red HatMedium 6.8
PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.
- Product
- Leap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgdebian.org
Jul 6, 2016ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server cCVE-2016-6170 · Other software · ISC · reported by Red HatMedium 6.5
ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.
- Product
- Bind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Jun 15, 2016Use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafCVE-2016-3227 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted requests, aka "Windows DNS Server Use After Free Vulnerability."
- Product
- Windows Server 2012
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comdocs.microsoft.com
Apr 12, 2016The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in aCVE-2015-8702 · Other software · Debian · reported by MITREHigh 8.6
The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in a PTR response, as demonstrated by a "\032" (whitespace) character in a hostname.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orginspircd.org
Mar 13, 2016The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remotCVE-2016-0771 · Other software · Samba · reported by Red HatMedium 5.9
The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remote authenticated users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory by uploading a crafted DNS TXT record.
- Product
- Samba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgdebian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.