CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39006
https://notcve.org/view.php?id=CVE-2023-39006
The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization. • https://github.com/opnsense/core/commit/1c05a19d9d52c7bfa4ac52114935d9fe76d5d181 https://logicaltrust.net/blog/2023/08/opnsense.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39001
https://notcve.org/view.php?id=CVE-2023-39001
A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file. • https://github.com/opnsense/core/commit/e800097d0c287bb665f0751a98a67c75ef7b45e5 https://logicaltrust.net/blog/2023/08/opnsense.html • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-38998
https://notcve.org/view.php?id=CVE-2023-38998
An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL. • https://github.com/opnsense/core/commit/6bc025af1705dcdd8ef22ff5d4fcb986fa4e45f8 https://logicaltrust.net/blog/2023/08/opnsense.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-38999
https://notcve.org/view.php?id=CVE-2023-38999
A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request. • https://github.com/opnsense/core/commit/5d68f43d1f254144831881fc87d885eed120cf3c https://logicaltrust.net/blog/2023/08/opnsense.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39000
https://notcve.org/view.php?id=CVE-2023-39000
A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path. • https://github.com/opnsense/core/commit/d1f350ce70e477adc86d445f5cda9b24f9ff0168 https://logicaltrust.net/blog/2023/08/opnsense.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •