Ipcop : Security Vulnerabilities, CVEs,
Cross-site scripting (XSS) vulnerability in proxylog.dat in IPCop 1.4.1 and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the (1) url or (2) part variables.
Max CVSS
6.8
EPSS Score
0.70%
Published
2005-01-10
Updated
2017-07-11
cgi-bin/iptablesgui.cgi in IPCop (aka IPCop Firewall) before 2.1.5 allows remote authenticated users to execute arbitrary code via shell metacharacters in the TABLE parameter. NOTE: this can be exploited remotely by leveraging a separate cross-site scripting (XSS) vulnerability.
Max CVSS
6.5
EPSS Score
0.47%
Published
2015-01-02
Updated
2015-01-05
Cross-site scripting (XSS) vulnerability in cgi-bin/ipinfo.cgi in IPCop (aka IPCop Firewall) before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING. NOTE: this can be used to bypass the cross-site request forgery (CSRF) protection mechanism by setting the Referer.
Max CVSS
4.3
EPSS Score
0.31%
Published
2015-01-02
Updated
2017-09-08
IPCop (aka IPCop Firewall) before 1.4.10 has world-readable permissions for the backup.key file, which might allow local users to overwrite system configuration files and gain privileges by creating a malicious encrypted backup archive owned by "nobody", then executing ipcoprscfg to restore from this backup.
Max CVSS
2.1
EPSS Score
0.04%
Published
2005-12-31
Updated
2017-07-20
Race condition in IPCop (aka IPCop Firewall) before 1.4.10 might allow local users to overwrite system configuration files and gain privileges by replacing a backup archive during the time window when the archive is owned by "nobody" but not yet encrypted, then executing ipcoprscfg to restore from this backup.
Max CVSS
1.2
EPSS Score
0.04%
Published
2005-12-31
Updated
2008-09-05
5 vulnerabilities found