Vulnerabilities (CVE)

Filtered by vendor Powerdns Subscribe
Filtered by product Recursor
Total 34 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2018-1000003 1 Powerdns 1 Recursor 2024-02-28 4.3 MEDIUM 3.7 LOW
Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.
CVE-2017-15093 1 Powerdns 1 Recursor 2024-02-28 3.5 LOW 5.3 MEDIUM
When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. It was discovered that the new netmask and IP addresses of forwarded zones were not sufficiently validated, allowing an authenticated user to inject new configuration directives into the Recursor's configuration.
CVE-2017-15090 1 Powerdns 1 Recursor 2024-02-28 4.3 MEDIUM 5.9 MEDIUM
An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records.
CVE-2017-15092 1 Powerdns 1 Recursor 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.
CVE-2017-15094 1 Powerdns 1 Recursor 2024-02-28 4.3 MEDIUM 5.9 MEDIUM
An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or process-no-validate (default).
CVE-2015-1868 2 Fedoraproject, Powerdns 3 Fedora, Authoritative, Recursor 2024-02-28 7.8 HIGH N/A
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.
CVE-2015-5470 1 Powerdns 2 Authoritative, Recursor 2024-02-28 7.8 HIGH N/A
The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.
CVE-2014-8601 2 Debian, Powerdns 2 Debian Linux, Recursor 2024-02-28 5.0 MEDIUM N/A
PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote attackers to cause a denial of service ("performance degradations") via a large or infinite number of referrals, as demonstrated by resolving domains hosted by ezdns.it.
CVE-2009-4010 1 Powerdns 1 Recursor 2024-02-28 7.5 HIGH N/A
Unspecified vulnerability in PowerDNS Recursor before 3.1.7.2 allows remote attackers to spoof DNS data via crafted zones.
CVE-2009-4009 1 Powerdns 1 Recursor 2024-02-28 10.0 HIGH N/A
Buffer overflow in PowerDNS Recursor before 3.1.7.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted packets.
CVE-2008-1637 1 Powerdns 1 Recursor 2024-02-28 6.8 MEDIUM N/A
PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.
CVE-2008-3217 1 Powerdns 1 Recursor 2024-02-28 6.8 MEDIUM N/A
PowerDNS Recursor before 3.1.6 does not always use the strongest random number generator for source port selection, which makes it easier for remote attack vectors to conduct DNS cache poisoning. NOTE: this is related to incomplete integration of security improvements associated with addressing CVE-2008-1637.
CVE-2006-4251 1 Powerdns 1 Recursor 2024-02-28 7.5 HIGH N/A
Buffer overflow in PowerDNS Recursor 3.1.3 and earlier might allow remote attackers to execute arbitrary code via a malformed TCP DNS query that prevents Recursor from properly calculating the TCP DNS query length.
CVE-2006-4252 1 Powerdns 1 Recursor 2024-02-28 5.0 MEDIUM N/A
PowerDNS Recursor 3.1.3 and earlier allows remote attackers to cause a denial of service (resource exhaustion and application crash) via a CNAME record with a zero TTL, which triggers an infinite loop.