CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-34361 – Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)
https://notcve.org/view.php?id=CVE-2024-34361
05 Jul 2024 — Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlocklistFromUrl()` function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a patch for this issue. Pi-hole es un sumidero de DNS que protege los dispositivos de contenido no deseado sin ins... • https://github.com/T0X1Cx/CVE-2024-34361-PiHole-SSRF-to-RCE • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 1CVE-2024-28247 – Pihole Authenticated Arbitrary File Read with root privileges
https://notcve.org/view.php?id=CVE-2024-28247
27 Mar 2024 — The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal server files arbitrarily, and because the application runs from behind, reading files is done as a privileged user.If the URL that is in the list of "Adslists" begins with "file*" it is understood that it is updating from a local file, on the other hand if it does not begin ... • https://github.com/T0X1Cx/CVE-2024-28247-Pi-hole-Arbitrary-File-Read • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-269: Improper Privilege Management •
CVSS: 5.7EPSS: 0%CPEs: 1EXPL: 1CVE-2021-32793 – Stored XSS Vulnerability in the Pi-hole Webinterface
https://notcve.org/view.php?id=CVE-2021-32793
04 Aug 2021 — Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the function to add domains to blocklists or allowlists is vulnerable to a stored cross-site-scripting vulnerability. User input added as a wildcard domain to a blocklist or allowlist is unfiltered in the web interface. Since the payload is stored permanently as a wildcard domain, this is a persistent XSS vulnerability. A remote attacker can theref... • https://github.com/pi-hole/AdminLTE/releases/tag/v5.5.1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 2CVE-2021-32706 – (Authenticated) Remote Code Execution Possible in Web Interface 5.5
https://notcve.org/view.php?id=CVE-2021-32706
04 Aug 2021 — Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1. La interf... • https://packetstorm.news/files/id/180843 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-29448 – Stored DOM XSS in Pi-hole Admin Web Interface
https://notcve.org/view.php?id=CVE-2021-29448
15 Apr 2021 — Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details. Pi-hole es una aplicación de bloqueo de anuncios y rastreadores de Internet a nivel de red de Linux. El ataque XSS Almacenado se presenta en el portal de Administración de Pi-hole, que puede ser explotado por el actor ... • https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-cwwf-93p7-73j9 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 4CVE-2021-29449 – Multiple Privilege Escalation Vulnerabilities Pihole
https://notcve.org/view.php?id=CVE-2021-29449
14 Apr 2021 — Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details. Pi-hole es una aplicación de bloqueo de anuncios y rastreadores de Internet a nivel de red de Linux. Se detectaron múltiples vulnerabilidades de escalada de privilegios en versión 5.2.4 de Pi-hole core. • https://packetstorm.news/files/id/163715 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-269: Improper Privilege Management •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 1CVE-2020-35592
https://notcve.org/view.php?id=CVE-2020-35592
18 Feb 2021 — Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie. Pi-hole versiones 5.0, 5.1 y 5.1.1, permite un ataque de tipo XSS por medio del encabezado Options al URI admin/. Un usuario remoto puede inyectar un script web o HTML arbitrario debido a un saneamiento incorrec... • https://discourse.pi-hole.net/c/announcements/5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 1CVE-2020-35591
https://notcve.org/view.php?id=CVE-2020-35591
18 Feb 2021 — Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker access to the user's account through the active session. Pi-hole versiones 5.0, 5.1 y 5.1.1, permite una Fijación de Sesión. • https://discourse.pi-hole.net/c/announcements/5 • CWE-384: Session Fixation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-35659
https://notcve.org/view.php?id=CVE-2020-35659
24 Dec 2020 — The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator visits the Query Log or Long-term data Query Log page. El registro de consultas DNS en Pi-hole versiones anteriores a 5.2.2, es vulnerable a un ataque XSS almacenado. Un atacante con la capacidad de consultar directa o indirectamente el DNS con un hostname malicioso puede... • https://blog.mirch.io/2020/12/24/pihole-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-14162
https://notcve.org/view.php?id=CVE-2020-14162
30 Jul 2020 — An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's setdns command. Se detectó un problema en Pi-Hole versiones hasta 5.0. El usuario local de www-data presenta privilegios de sudo para ejecutar el script core de pihole como root sin una contraseña, lo que podría permitir a un atacante obtener acceso root por medio... • https://0xpanic.github.io/2020/07/21/Pihole.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-269: Improper Privilege Management •