Pi-hole

Pi-hole

17 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2020-35659

  • EPSS 0.45%
  • Veröffentlicht 24.12.2020 16:15:15
  • Zuletzt bearbeitet 21.11.2024 05:27:47

The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator visits the Quer...

7.8

CVE-2020-14162

Exploit
  • EPSS 0.12%
  • Veröffentlicht 30.07.2020 14:15:12
  • Zuletzt bearbeitet 21.11.2024 05:02:46

An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's se...

7.8

CVE-2020-12620

Exploit
  • EPSS 0.56%
  • Veröffentlicht 30.07.2020 14:15:12
  • Zuletzt bearbeitet 21.11.2024 04:59:56

Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address).

7.8

CVE-2020-14971

  • EPSS 0.07%
  • Veröffentlicht 23.06.2020 14:15:12
  • Zuletzt bearbeitet 21.11.2024 05:04:32

Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them. This occurs in settings.php. To exploit this, an attacker would request a backup of limited files v...

7.2

CVE-2020-8816

Warnung Medienbericht Exploit
  • EPSS 90.78%
  • Veröffentlicht 29.05.2020 19:15:10
  • Zuletzt bearbeitet 10.11.2025 14:42:28

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

9

CVE-2020-11108

Exploit
  • EPSS 89.59%
  • Veröffentlicht 11.05.2020 15:15:11
  • Zuletzt bearbeitet 21.11.2024 04:56:48

The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rul...

8.8

CVE-2019-13051

  • EPSS 31.59%
  • Veröffentlicht 09.10.2019 12:15:10
  • Zuletzt bearbeitet 21.11.2024 04:24:06

Pi-Hole 4.3 allows Command Injection.