Skip to content

Product

dns-sync project dns-sync vulnerabilities

2 published CVES affecting dns-sync project dns-sync, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
1
High
1
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest dns-sync project dns-sync CVEs

Newest publication first

  1. CVE-2017-16100 Command Injection in dns-sync

    Published
    CriticalCVSS 9.8 EPSS 5.1%

    dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.

  2. CVE-2014-9682 dns-sync command injection vulnerability

    Published
    HighCVSS 10.0 EPSS 2.8%

    The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.