CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2021-42770
https://notcve.org/view.php?id=CVE-2021-42770
A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester. Se ha detectado una vulnerabilidad de tipo Cross-site scripting (XSS) en OPNsense versiones anteriores a 21.7.4, por medio de la devolución de atributos LDAP en el comprobador de autenticación • https://cert.orange.com https://github.com/orangecertcc/security-research/security/advisories/GHSA-r32j-xgg3-w2rw https://opnsense.org/opnsense-21-7-4-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-23015
https://notcve.org/view.php?id=CVE-2020-23015
An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not filtered and can redirect user to any website. Se detectó un problema de redireccionamiento abierto en OPNsense versiones hasta 20.1.5. El parámetro de redireccionamiento "url" en la página de inicio de sesión no se filtró y puede redireccionar al usuario a cualquier sitio web. • https://github.com/opnsense/core/issues/4061 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-18958
https://notcve.org/view.php?id=CVE-2018-18958
OPNsense 18.7.x before 18.7.7 has Incorrect Access Control. OPNsense versión 18.7.x en versiones anteriores a la 18.7.7 presenta un Control de Acceso Incorrecto. • https://forum.opnsense.org/index.php?board=11.0 https://forum.opnsense.org/index.php?topic=10181.0 • CWE-284: Improper Access Control •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2019-11816
https://notcve.org/view.php?id=CVE-2019-11816
Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request. El control de acceso incorrecto en la WebUI en OPNsense antes de la versión 19.1.8, y pfsense antes de 2.4.4-p3 permite a los usuarios autenticados remotos escalar los privilegios a administrador a través de una solicitud especialmente diseñada. • https://forum.opnsense.org/index.php?topic=12787.0 https://www.netgate.com/blog/pfsense-2-4-4-release-p3-now-available.html •
CVSS: 8.8EPSS: 1%CPEs: 2EXPL: 3CVE-2017-1000479 – Clickjacking Vulnerability In CSRF Error Page pfSense
https://notcve.org/view.php?id=CVE-2017-1000479
pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed in 2.4.2-RELEASE. OPNsense, a 2015 fork of pfSense, was not vulnerable since version 16.1.16 released on June 06, 2016. The unprotected web form was removed from the code during an internal security audit under "possibly insecure" suspicions. pfSense, en sus versiones 2.4.1 y anteriores, es vulnerable a ataques de secuestro de clics en la página de error CSRF. Esto resulta en la ejecución con privilegios de código arbitrario. • http://www.openwall.com/lists/oss-security/2017/11/22/7 https://doc.pfsense.org/index.php/2.4.2_New_Features_and_Changes https://github.com/opnsense/core/commit/d218b225 https://github.com/pfsense/pfsense/commit/386d89b07 https://www.netgate.com/blog/pfsense-2-4-2-release-p1-and-2-3-5-release-p1-now-available.html https://www.securify.nl/en/advisory/SFY20171101/clickjacking-vulnerability-in-csrf-error-page-pfsense.html https://securify.nl/en/advisory/SFY20171101/clickjacking-vuln • CWE-352: Cross-Site Request Forgery (CSRF) •