CVE-2022-33993

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Misinterpretation of special domain name characters in DNRD (aka Domain Name Relay Daemon) 2.20.3 leads to cache poisoning because domain names and their associated IP addresses are cached in their misinterpreted form.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://dnrd.sourceforge.net/Product, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/08/14/1Mailing List, Third Party Advisory
https://www.usenix.org/conference/usenixsecurity21/presentation/jeitnerThird Party Advisory
https://www.usenix.org/conference/usenixsecurity22/presentation/jeitnerThird Party Advisory
http://dnrd.sourceforge.net/Product, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/08/14/1Mailing List, Third Party Advisory
https://www.usenix.org/conference/usenixsecurity21/presentation/jeitnerThird Party Advisory
https://www.usenix.org/conference/usenixsecurity22/presentation/jeitnerThird Party Advisory

Timeline

Published: Aug 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-339943.0The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" fea CVE-2022-339957.5A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite file CVE-2022-339968.8Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions CVE-2022-34006.5The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action i CVE-2022-340006.5libjxl 0.6.1 has an assertion failure in LowMemoryRenderPipeline::Init() in render_pipeline/low_memory_render_pipeline.cc.CVE-2022-340016.5Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously.CVE-2022-340026.5The ‘document’ parameter of PDS Vista 7’s /application/documents/display.aspx page is vulnerable to a Local File Inclusion vulnerability whi CVE-2022-340059.8An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. There is Remote Code Execution due to a hardcoded password for CVE-2022-340067.8An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. When installing, Microsoft SQL Express 2019 installs by default CVE-2022-340076.1EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry.CVE-2022-340087.8Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation. To escalate privilege, a low-privileged attacker can us CVE-2022-340095.5Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket. This occurs because the