CVE-2020-24698

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker might be able to cause a double-free, leading to a crash or possibly arbitrary code execution. by sending crafted queries with a GSS-TSIG signature.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

No affected versions have been published.

Timeline

Published: Oct 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-246996.1The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.CVE-2020-247005.4OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring.CVE-2020-247016.1OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).CVE-2020-247038.8An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled ser CVE-2020-247046.1An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytic CVE-2020-247058.8An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled ser CVE-2020-247066.1An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager CVE-2020-247077.8Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.CVE-2020-247085.4Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.CVE-2020-247095.4Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.CVE-2020-247105.3Gophish before 0.11.0 allows SSRF attacks.CVE-2020-247116.5The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking atta