Ipfire kayıtları

ipfire üreticisine ait 32 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren: 0 · %0
Silahlaştırılmış: 2 · %6,3
Pre-auth RCE: 4
Düzeltme kaydı olan: %0
Yayından KEV’e ortanca: KEV’e giren kayıt yok

Yıllara göre kayıt

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')25
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')5
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')1

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

Saldırı profili

Tüm kayıtlar

32 kayıt

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
53Planlayın	CVE-2021-33393Silahlaştırılmış	lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account.ipfire · ipfire	Yüksek8,8	—	%59,6	9 Haz 2021
46Planlayın	CVE-2017-9757Silahlaştırılmış	IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell.ipfire · ipfire · CWE-78 RCE Komut enjeksiyonu CSRF	Yüksek8,8	—	%37,2	19 Haz 2017
38İzleyin	CVE-2025-34311İstismar yok	IPFire < v2.29 Command Injection via Proxy Report Creationipfire · ipfire · CWE-78 RCE Komut enjeksiyonu	Yüksek8,7	—	%13,5	28 Eki 2025
37İzleyin	CVE-2018-16232İstismar yok	An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi.ipfire · ipfire · CWE-78 RCE Komut enjeksiyonu	Yüksek8,8	—	%7,8	17 Eki 2018
35İzleyin	CVE-2025-34312İstismar yok	IPFire < v2.29 Command Injection via URL Filter Blacklistipfire · ipfire · CWE-78 RCE Komut enjeksiyonu	Yüksek8,7	—	%2,2	28 Eki 2025
28İzleyin	CVE-2025-34304İstismar yok	IPFire < v2.29 SQL Injection via OpenVPN Connection Logsipfire · ipfire · CWE-89 SQL enjeksiyonu	Yüksek7,1	—	%0,4	28 Eki 2025
26İzleyin	CVE-2025-50974İstismar yok	The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorpipfire · ipfire · CWE-78 pre-auth RCE Komut enjeksiyonu	Orta6,5	—	%0,4	26 Ağu 2025
24İzleyin	CVE-2020-21142İstismar yok	Cross Site Scripting (XSS) vulnerabilty in IPFire 2.23 via the IPfire web UI in the mail.cgi.ipfire · ipfire · CWE-79 Kimlik doğrulamasız XSS	Orta6,1	—	%0,7	28 Haz 2021
24İzleyin	CVE-2025-50976İstismar yok	IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME quipfire · ipfire · CWE-79 Kimlik doğrulamasız XSS	Orta6,1	—	%0,2	26 Ağu 2025
22İzleyin	CVE-2025-34301İstismar yok	IPFire < v2.29 Stored XSS via Location Group Creationipfire · ipfire · CWE-79 XSS	Orta5,1	—	%5,3	28 Eki 2025
22İzleyin	CVE-2025-34309İstismar yok	IPFire < v2.29 Stored XSS via Dynamic DNS Hostipfire · ipfire · CWE-79 XSS	Orta5,1	—	%5,3	28 Eki 2025
21İzleyin	CVE-2020-19204İstismar yok	An authenticated Stored Cross-Site Scriptiong (XSS) vulnerability exists in Lightning Wire Labs IPFire 2.21 (x86_64) - Core Update 130 in thipfire · ipfire · CWE-79 XSS	Orta5,4	—	%0,7	12 Tem 2021
21İzleyin	CVE-2020-19202İstismar yok	An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Page" text box or "TITipfire · ipfire · CWE-79 XSS	Orta5,4	—	%0,6	17 Haz 2021
21İzleyin	CVE-2025-50975İstismar yok	IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT, TGT_PORT, dnatportipfire · ipfire · CWE-79 XSS	Orta5,4	—	%0,3	26 Ağu 2025
20İzleyin	CVE-2025-34303İstismar yok	IPFire < v2.29 Stored XSS via Whitelisted Host Creationipfire · ipfire · CWE-79 XSS	Orta5,1	—	%0,5	28 Eki 2025
20İzleyin	CVE-2025-34305İstismar yok	IPFire < v2.29 Stored XSS via Multiple Methods in cleanhtml()ipfire · ipfire · CWE-79 XSS	Orta5,1	—	%0,5	28 Eki 2025
20İzleyin	CVE-2025-34306İstismar yok	IPFire < v2.29 Stored XSS via Default IP Search Valueipfire · ipfire · CWE-79 XSS	Orta5,1	—	%0,5	28 Eki 2025
20İzleyin	CVE-2025-34307İstismar yok	IPFire < v2.29 Stored XSS via Default Country Searchipfire · ipfire · CWE-79 XSS	Orta5,1	—	%0,5	28 Eki 2025
20İzleyin	CVE-2025-34308İstismar yok	IPFire < v2.29 Stored XSS via Default Time Syncipfire · ipfire · CWE-79 XSS	Orta5,1	—	%0,5	28 Eki 2025
20İzleyin	CVE-2025-34310İstismar yok	IPFire < v2.29 Stored XSS via Quality of Service (QoS) Settingsipfire · ipfire · CWE-79 XSS	Orta5,1	—	%0,5	28 Eki 2025
20İzleyin	CVE-2025-34317İstismar yok	IPFire < v2.29 Stored XSS via DNS Creation (dns.cgi)ipfire · ipfire · CWE-79 XSS	Orta5,1	—	%0,5	28 Eki 2025
20İzleyin	CVE-2025-34302İstismar yok	IPFire < v2.29 Stored XSS via Service Creationipfire · ipfire · CWE-79 XSS	Orta5,1	—	%0,5	28 Eki 2025
20İzleyin	CVE-2025-34314İstismar yok	IPFire < v2.29 Stored XSS via Time Constraint Rule URL Filteripfire · ipfire · CWE-79 XSS	Orta5,1	—	%0,5	28 Eki 2025
20İzleyin	CVE-2025-34315İstismar yok	IPFire < v2.29 Stored XSS via Remote Syslog Server Addressipfire · ipfire · CWE-79 XSS	Orta5,1	—	%0,5	28 Eki 2025
20İzleyin	CVE-2025-34316İstismar yok	IPFire < v2.29 Stored XSS via Mail Server Settingsipfire · ipfire · CWE-79 XSS	Orta5,1	—	%0,5	28 Eki 2025

CVE-2021-33393
53Planlayın
lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account.
YüksekCVSS 8,8SilahlaştırılmışEPSS %60
ipfire · ipfire9 Haz 2021
CVE-2017-9757
46Planlayın
IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell.
YüksekCVSS 8,8SilahlaştırılmışEPSS %37
- RCE
- Komut enjeksiyonu
- CSRF
ipfire · ipfire19 Haz 2017
CVE-2025-34311
38İzleyin
IPFire < v2.29 Command Injection via Proxy Report Creation
YüksekCVSS 8,7İstismar yokEPSS %13
- RCE
- Komut enjeksiyonu
ipfire · ipfire28 Eki 2025
CVE-2018-16232
37İzleyin
An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi.
YüksekCVSS 8,8İstismar yokEPSS %8
- RCE
- Komut enjeksiyonu
ipfire · ipfire17 Eki 2018
CVE-2025-34312
35İzleyin
IPFire < v2.29 Command Injection via URL Filter Blacklist
YüksekCVSS 8,7İstismar yokEPSS %2
- RCE
- Komut enjeksiyonu
ipfire · ipfire28 Eki 2025
CVE-2025-34304
28İzleyin
IPFire < v2.29 SQL Injection via OpenVPN Connection Logs
YüksekCVSS 7,1İstismar yokEPSS %0
- SQL enjeksiyonu
ipfire · ipfire28 Eki 2025
CVE-2025-50974
26İzleyin
The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorp
OrtaCVSS 6,5İstismar yokEPSS %0
- pre-auth RCE
- Komut enjeksiyonu
ipfire · ipfire26 Ağu 2025
CVE-2020-21142
24İzleyin
Cross Site Scripting (XSS) vulnerabilty in IPFire 2.23 via the IPfire web UI in the mail.cgi.
OrtaCVSS 6,1İstismar yokEPSS %1
- Kimlik doğrulamasız
- XSS
ipfire · ipfire28 Haz 2021
CVE-2025-50976
24İzleyin
IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME qu
OrtaCVSS 6,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
ipfire · ipfire26 Ağu 2025
CVE-2025-34301
22İzleyin
IPFire < v2.29 Stored XSS via Location Group Creation
OrtaCVSS 5,1İstismar yokEPSS %5
- XSS
ipfire · ipfire28 Eki 2025
CVE-2025-34309
22İzleyin
IPFire < v2.29 Stored XSS via Dynamic DNS Host
OrtaCVSS 5,1İstismar yokEPSS %5
- XSS
ipfire · ipfire28 Eki 2025
CVE-2020-19204
21İzleyin
An authenticated Stored Cross-Site Scriptiong (XSS) vulnerability exists in Lightning Wire Labs IPFire 2.21 (x86_64) - Core Update 130 in th
OrtaCVSS 5,4İstismar yokEPSS %1
- XSS
ipfire · ipfire12 Tem 2021
CVE-2020-19202
21İzleyin
An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Page" text box or "TIT
OrtaCVSS 5,4İstismar yokEPSS %1
- XSS
ipfire · ipfire17 Haz 2021
CVE-2025-50975
21İzleyin
IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT, TGT_PORT, dnatport
OrtaCVSS 5,4İstismar yokEPSS %0
- XSS
ipfire · ipfire26 Ağu 2025
CVE-2025-34303
20İzleyin
IPFire < v2.29 Stored XSS via Whitelisted Host Creation
OrtaCVSS 5,1İstismar yokEPSS %0
- XSS
ipfire · ipfire28 Eki 2025
CVE-2025-34305
20İzleyin
IPFire < v2.29 Stored XSS via Multiple Methods in cleanhtml()
OrtaCVSS 5,1İstismar yokEPSS %0
- XSS
ipfire · ipfire28 Eki 2025
CVE-2025-34306
20İzleyin
IPFire < v2.29 Stored XSS via Default IP Search Value
OrtaCVSS 5,1İstismar yokEPSS %0
- XSS
ipfire · ipfire28 Eki 2025
CVE-2025-34307
20İzleyin
IPFire < v2.29 Stored XSS via Default Country Search
OrtaCVSS 5,1İstismar yokEPSS %0
- XSS
ipfire · ipfire28 Eki 2025
CVE-2025-34308
20İzleyin
IPFire < v2.29 Stored XSS via Default Time Sync
OrtaCVSS 5,1İstismar yokEPSS %0
- XSS
ipfire · ipfire28 Eki 2025
CVE-2025-34310
20İzleyin
IPFire < v2.29 Stored XSS via Quality of Service (QoS) Settings
OrtaCVSS 5,1İstismar yokEPSS %0
- XSS
ipfire · ipfire28 Eki 2025
CVE-2025-34317
20İzleyin
IPFire < v2.29 Stored XSS via DNS Creation (dns.cgi)
OrtaCVSS 5,1İstismar yokEPSS %0
- XSS
ipfire · ipfire28 Eki 2025
CVE-2025-34302
20İzleyin
IPFire < v2.29 Stored XSS via Service Creation
OrtaCVSS 5,1İstismar yokEPSS %0
- XSS
ipfire · ipfire28 Eki 2025
CVE-2025-34314
20İzleyin
IPFire < v2.29 Stored XSS via Time Constraint Rule URL Filter
OrtaCVSS 5,1İstismar yokEPSS %0
- XSS
ipfire · ipfire28 Eki 2025
CVE-2025-34315
20İzleyin
IPFire < v2.29 Stored XSS via Remote Syslog Server Address
OrtaCVSS 5,1İstismar yokEPSS %0
- XSS
ipfire · ipfire28 Eki 2025
CVE-2025-34316
20İzleyin
IPFire < v2.29 Stored XSS via Mail Server Settings
OrtaCVSS 5,1İstismar yokEPSS %0
- XSS
ipfire · ipfire28 Eki 2025