Filtered by vendor Ipfire Subscriptions
Filtered by product Ipfire Subscriptions
Total 7 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-9757 1 Ipfire 1 Ipfire 2024-08-05 N/A
IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell. This can be exploited directly by authenticated users, or through CSRF.
CVE-2018-16232 1 Ipfire 1 Ipfire 2024-08-05 8.8 High
An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi. This allows an authenticated user with privileges for the affected page to execute arbitrary commands.
CVE-2020-21142 1 Ipfire 1 Ipfire 2024-08-04 6.1 Medium
Cross Site Scripting (XSS) vulnerabilty in IPFire 2.23 via the IPfire web UI in the mail.cgi.
CVE-2020-19204 1 Ipfire 1 Ipfire 2024-08-04 5.4 Medium
An authenticated Stored Cross-Site Scriptiong (XSS) vulnerability exists in Lightning Wire Labs IPFire 2.21 (x86_64) - Core Update 130 in the "routing.cgi" Routing Table Entries via the "Remark" text box or "remark" parameter. It allows an authenticated WebGUI user to execute Stored Cross-site Scripting in the Routing Table Entries.
CVE-2020-19202 1 Ipfire 1 Ipfire 2024-08-04 5.4 Medium
An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Page" text box or "TITLE" parameter in IPFire 2.21 (x86_64) - Core Update 130. It allows an authenticated WebGUI user with privileges to execute Stored Cross-site Scripting in the Captive Portal page.
CVE-2021-33393 1 Ipfire 1 Ipfire 2024-08-03 8.8 High
lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the ownership/permissions of other files may be present as well.
CVE-2022-36368 1 Ipfire 1 Ipfire 2024-08-03 4.8 Medium
Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with administrative privilege to inject an arbitrary script.