CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 4CVE-2015-2294 – pfSense 2.2 Cross Site Request Forgery / Cross Site Scripting
https://notcve.org/view.php?id=CVE-2015-2294
25 Mar 2015 — Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) zone parameter to status_captiveportal.php; (2) if or (3) dragtable parameter to firewall_rules.php; (4) queue parameter in an add action to firewall_shaper.php; (5) id parameter in an edit action to services_unbound_acls.php; or (6) filterlogentries_time, (7) filterlogentries_sourceipaddress, (8) filterlogentries_sourceport, (9) filterlogentries... • https://packetstorm.news/files/id/131022 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 51%CPEs: 1EXPL: 4CVE-2015-2295 – pfSense 2.2 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2015-2295
25 Mar 2015 — Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter. Vulnerabilidad de CSRF en system_firmware_restorefullbackup.php en la GUI web en pfSense anterior a 2.2.1 permite a atacantes remotos secuestrar la autenticación de administradores para solicitudes que eliminan ficheros arbitrarios a través de... • https://packetstorm.news/files/id/131022 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 1%CPEs: 9EXPL: 0CVE-2015-1414 – Debian Security Advisory 3175-2
https://notcve.org/view.php?id=CVE-2015-1414
26 Feb 2015 — Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory. Desbordamiento de enteros en FreeBSD anterior a 8.4 p24, 9.x anterior a 9.3 p10. 10.0 anterior a p18, y 10.1 anterior a p6 permite a atacantes remotos causar una denegación de servicio (caída) a través de un paquete IGMP, lo que provoca un ... • http://www.debian.org/security/2015/dsa-3175 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4687
https://notcve.org/view.php?id=CVE-2014-4687
02 Jul 2014 — Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the starttime0 parameter to firewall_schedule.php, (2) the rssfeed parameter to rss.widget.php, (3) the servicestatusfilter parameter to services_status.widget.php, (4) the txtRecallBuffer parameter to exec.php, or (5) the HTTP Referer header to log.widget.php. Múltiples vulnerabilidades de XSS en pfSense anterior a 2.1.4 permiten a atacantes remotos inyectar secu... • https://pfsense.org/security/advisories/pfSense-SA-14_09.webgui.asc • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 3CVE-2014-4688 – pfSense < 2.1.4 - 'status_rrd_graph_img.php' Command Injection
https://notcve.org/view.php?id=CVE-2014-4688
02 Jul 2014 — pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the hostname value to diag_dns.php in a Create Alias action, (2) the smartmonemail value to diag_smart.php, or (3) the database value to status_rrd_graph_img.php. pfSense anterior a 2.1.4 permite a usuarios remotos autenticados ejecutar comandos arbitrarios a través del valor (1) hostname en diag_dns.php en una acción Crear Alias, (2) smartmonemail en diag_smart.php, o (3) database en status_rrd_graph_img.php. pfSen... • https://packetstorm.news/files/id/145909 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4689
https://notcve.org/view.php?id=CVE-2014-4689
02 Jul 2014 — Absolute path traversal vulnerability in pkg_edit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter. Vulnerabilidad de recorrido de directorio absoluto en pkg_edit.php en pfSense anterior a 2.1.4 permite a atacantes remotos leer ficheros XML arbitrarios a través de un nombre completo de ruta en el parámetro xml. • https://pfsense.org/security/advisories/pfSense-SA-14_11.webgui.asc • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4690
https://notcve.org/view.php?id=CVE-2014-4690
02 Jul 2014 — Multiple directory traversal vulnerabilities in pfSense before 2.1.4 allow (1) remote attackers to read arbitrary .info files via a crafted path in the pkg parameter to pkg_mgr_install.php and allow (2) remote authenticated users to read arbitrary files via the downloadbackup parameter to system_firmware_restorefullbackup.php. Múltiples vulnerabilidades de salto de directorio en pfSense anterior a 2.1.4 permiten a (1) atacantes remotos leer ficheros .info arbitrarios a través de una ruta manipulada en el pa... • https://pfsense.org/security/advisories/pfSense-SA-14_11.webgui.asc • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4691
https://notcve.org/view.php?id=CVE-2014-4691
02 Jul 2014 — Session fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web sessions via a firewall login cookie. Vulnerabilidad de fijación de sesión en pfSense anterior a 2.1.4 permite a atacantes remotos secuestrar sesiones web a través de una cookie de inicio de sesión firewall. • https://pfsense.org/security/advisories/pfSense-SA-14_12.webgui.asc •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4692
https://notcve.org/view.php?id=CVE-2014-4692
02 Jul 2014 — pfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. pfSense anterior a 2.1.4, cuando HTTP está utilizado, no incluye la etiqueta HTTPOnly en una cabecera Set-Cookie para la cookie de la sesión, lo que facilita a atacantes remotos obtener información potencialmente sensible a través de acceso de secuencias de comandos a... • https://pfsense.org/security/advisories/pfSense-SA-14_12.webgui.asc • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2014-4693
https://notcve.org/view.php?id=CVE-2014-4693
02 Jul 2014 — Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the eng parameter to snort_import_aliases.php or (2) unspecified variables to snort_select_alias.php. Múltiples vulnerabilidades de XSS en el paquete Snort anterior a 3.0.13 para pfSense hasta 2.1.4 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de (1) el parámetro eng en snort_impo... • https://pfsense.org/security/advisories/pfSense-SA-14_13.packages.asc • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •