Vulnerabilities > Powerdns
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-09-11 | CVE-2016-7068 | Resource Exhaustion vulnerability in multiple products An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. | 7.8 |
| 2018-09-10 | CVE-2016-7072 | Resource Exhaustion vulnerability in multiple products An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. | 5.0 |
| 2018-07-27 | CVE-2017-15120 | NULL Pointer Dereference vulnerability in multiple products An issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL pointer dereference when parsing a specially crafted answer containing a CNAME of a different class than IN. | 5.0 |
| 2018-07-16 | CVE-2018-1046 | Out-of-bounds Write vulnerability in Powerdns Pdns pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. | 9.3 |
| 2018-01-23 | CVE-2017-15094 | Missing Release of Resource after Effective Lifetime vulnerability in Powerdns Recursor An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. | 4.3 |
| 2018-01-23 | CVE-2017-15093 | Improper Input Validation vulnerability in Powerdns Recursor When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. | 3.5 |
| 2018-01-23 | CVE-2017-15092 | Cross-site Scripting vulnerability in Powerdns Recursor A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content. | 4.3 |
| 2018-01-23 | CVE-2017-15091 | Improperly Implemented Security Check for Standard vulnerability in Powerdns Authoritative An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, where some operations that have an impact on the state of the server are still allowed even though the API has been configured as read-only via the api-readonly keyword. | 5.5 |
| 2018-01-23 | CVE-2017-15090 | Improper Verification of Cryptographic Signature vulnerability in Powerdns Recursor An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. | 4.3 |
| 2018-01-22 | CVE-2018-1000003 | Improper Input Validation vulnerability in Powerdns Recursor 4.1.0 Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay. | 4.3 |