Pi Hole
by Pi Hole
Source repositories
CVEs (31)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-41175 | 0.00 | — | 0.01 | Oct 26, 2021 | Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was… | |||
| CVE-2021-3812 | 0.00 | — | 0.01 | Sep 17, 2021 | adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||
| CVE-2021-3706 | 0.00 | — | 0.01 | Sep 15, 2021 | adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag | |||
| CVE-2021-32793 | 0.00 | — | 0.01 | Aug 4, 2021 | Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the function to add domains to blocklists or allowlists is vulnerable to a stored cross-site-scripting vulnerability.… | |||
| CVE-2021-29448 | 0.00 | — | 0.01 | Apr 15, 2021 | Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch… | |||
| CVE-2020-35592 | 0.00 | — | 0.01 | Feb 18, 2021 | Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the… | |||
| CVE-2020-35591 | 0.00 | — | 0.01 | Feb 18, 2021 | Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes… | |||
| CVE-2020-35659 | 0.00 | — | 0.01 | Dec 24, 2020 | The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator visits the Query Log or Long-term data Query… | |||
| CVE-2020-14162 | 0.00 | — | 0.01 | Jul 30, 2020 | An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's setdns command. | |||
| CVE-2020-12620 | 0.00 | — | 0.01 | Jul 30, 2020 | Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address). | |||
| CVE-2020-14971 | 0.00 | — | 0.01 | Jun 23, 2020 | Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them. This occurs in settings.php. To exploit this, an attacker would request a backup of limited files via teleporter.php. These are… |
- CVE-2021-41175Oct 26, 2021risk 0.00cvss —epss 0.01
Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was…
- CVE-2021-3812Sep 17, 2021risk 0.00cvss —epss 0.01
adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CVE-2021-3706Sep 15, 2021risk 0.00cvss —epss 0.01
adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag
- CVE-2021-32793Aug 4, 2021risk 0.00cvss —epss 0.01
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the function to add domains to blocklists or allowlists is vulnerable to a stored cross-site-scripting vulnerability.…
- CVE-2021-29448Apr 15, 2021risk 0.00cvss —epss 0.01
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch…
- CVE-2020-35592Feb 18, 2021risk 0.00cvss —epss 0.01
Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the…
- CVE-2020-35591Feb 18, 2021risk 0.00cvss —epss 0.01
Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes…
- CVE-2020-35659Dec 24, 2020risk 0.00cvss —epss 0.01
The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator visits the Query Log or Long-term data Query…
- CVE-2020-14162Jul 30, 2020risk 0.00cvss —epss 0.01
An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's setdns command.
- CVE-2020-12620Jul 30, 2020risk 0.00cvss —epss 0.01
Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address).
- CVE-2020-14971Jun 23, 2020risk 0.00cvss —epss 0.01
Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them. This occurs in settings.php. To exploit this, an attacker would request a backup of limited files via teleporter.php. These are…
Page 2 of 2