CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39000
https://notcve.org/view.php?id=CVE-2023-39000
09 Aug 2023 — A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path. • https://github.com/opnsense/core/commit/d1f350ce70e477adc86d445f5cda9b24f9ff0168 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39004
https://notcve.org/view.php?id=CVE-2023-39004
09 Aug 2023 — Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation. • http://opnsense.com • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39002
https://notcve.org/view.php?id=CVE-2023-39002
09 Aug 2023 — A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. • https://github.com/opnsense/core/commit/a4f6a8f8d604271f81984cfcbba0471af58e34dc • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 20%CPEs: 1EXPL: 1CVE-2023-39007
https://notcve.org/view.php?id=CVE-2023-39007
09 Aug 2023 — /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php. • https://github.com/opnsense/core/commit/5edff49db1cd8b5078611e2f542d91c02af2b25c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2021-42770
https://notcve.org/view.php?id=CVE-2021-42770
08 Nov 2021 — A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester. Se ha detectado una vulnerabilidad de tipo Cross-site scripting (XSS) en OPNsense versiones anteriores a 21.7.4, por medio de la devolución de atributos LDAP en el comprobador de autenticación • https://cert.orange.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-23015
https://notcve.org/view.php?id=CVE-2020-23015
03 May 2021 — An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not filtered and can redirect user to any website. Se detectó un problema de redireccionamiento abierto en OPNsense versiones hasta 20.1.5. El parámetro de redireccionamiento "url" en la página de inicio de sesión no se filtró y puede redireccionar al usuario a cualquier sitio web. • https://github.com/opnsense/core/issues/4061 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-18958
https://notcve.org/view.php?id=CVE-2018-18958
17 Jun 2019 — OPNsense 18.7.x before 18.7.7 has Incorrect Access Control. OPNsense versión 18.7.x en versiones anteriores a la 18.7.7 presenta un Control de Acceso Incorrecto. • https://forum.opnsense.org/index.php?board=11.0 • CWE-284: Improper Access Control •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2019-11816
https://notcve.org/view.php?id=CVE-2019-11816
20 May 2019 — Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request. El control de acceso incorrecto en la WebUI en OPNsense antes de la versión 19.1.8, y pfsense antes de 2.4.4-p3 permite a los usuarios autenticados remotos escalar los privilegios a administrador a través de una solicitud especialmente diseñada. • https://forum.opnsense.org/index.php?topic=12787.0 •
CVSS: 8.8EPSS: 2%CPEs: 2EXPL: 2CVE-2017-1000479
https://notcve.org/view.php?id=CVE-2017-1000479
03 Jan 2018 — pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed in 2.4.2-RELEASE. OPNsense, a 2015 fork of pfSense, was not vulnerable since version 16.1.16 released on June 06, 2016. The unprotected web form was removed from the code during an internal security audit under "possibly insecure" suspicions. pfSense, en sus versiones 2.4.1... • http://www.openwall.com/lists/oss-security/2017/11/22/7 • CWE-352: Cross-Site Request Forgery (CSRF) •