CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-12620
https://notcve.org/view.php?id=CVE-2020-12620
30 Jul 2020 — Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address). Pi-hole versión 4.4, permite a un usuario escribir en el archivo /etc/pihole/dns-servers.conf para escalar privilegios por medio de una inyección de comandos (metacaracteres de shell después de una dirección IP) • https://0xpanic.github.io/2020/07/21/Pihole.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14971
https://notcve.org/view.php?id=CVE-2020-14971
23 Jun 2020 — Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them. This occurs in settings.php. To exploit this, an attacker would request a backup of limited files via teleporter.php. These are placed into a .tar.gz archive. The attacker then modifies the host parameter in dnsmasq.d files, and then compresses and uploads these files again. • https://blog.telspace.co.za/2020/06/pi-hole-code-injection-cve-2020-14971.html • CWE-862: Missing Authorization •
CVSS: 9.1EPSS: 96%CPEs: 1EXPL: 8CVE-2020-8816 – Pi-Hole AdminLTE Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-8816
28 May 2020 — Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. Pi-hole Web versión v4.3.2 (también se conoce como AdminLTE), permite una Ejecución de Código Remota por usuarios privilegiados del panel por medio de un arrendamiento estático de DHCP diseñado. • https://packetstorm.news/files/id/158737 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 97%CPEs: 1EXPL: 12CVE-2020-11108 – Pi-hole 4.4.0 - Remote Code Execution (Authenticated)
https://notcve.org/view.php?id=CVE-2020-11108
10 May 2020 — The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh. El actualizador de Gravity en Pi-hole versiones hasta 4.4, permite a un adversario autenticado cargar archivos arbitrarios. • https://packetstorm.news/files/id/157748 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-13051
https://notcve.org/view.php?id=CVE-2019-13051
09 Oct 2019 — Pi-Hole 4.3 allows Command Injection. Pi-Hole versión 4.3, permite la inyección de comandos. • https://github.com/pr0tean/CVE-2019-13051 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •