CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-44275
https://notcve.org/view.php?id=CVE-2023-44275
28 Sep 2023 — OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard. OPNsense anterior a 23.7.5 permite XSS a través del parámetro column_count index.php en el panel del lobby. • https://github.com/opnsense/core/commit/484753b2abe3fd0fcdb73d8bf00c3fc3709eb8b7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-44276
https://notcve.org/view.php?id=CVE-2023-44276
28 Sep 2023 — OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard. OPNsense anterior a 23.7.5 permite XSS a través del parámetro de secuencia index.php en el panel del lobby. • https://github.com/opnsense/core/commit/484753b2abe3fd0fcdb73d8bf00c3fc3709eb8b7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.3EPSS: 1%CPEs: 1EXPL: 1CVE-2023-38997
https://notcve.org/view.php?id=CVE-2023-38997
09 Aug 2023 — A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands as root via a crafted ZIP archive. Una vulnerabilidad de traspaso de directorios en las plantillas del portal cautivo de OPNsense Community Edition antes de 23.7 y Business Edition antes de 23.4.2 permite a los atacantes ejecutar comandos arbitrarios del sistema como root a través de un archivo ZIP manipulado. • https://github.com/opnsense/core/commit/448762d440b51574f1906c0ec2f5ea6dc4f16eb2 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-38998
https://notcve.org/view.php?id=CVE-2023-38998
09 Aug 2023 — An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL. • https://github.com/opnsense/core/commit/6bc025af1705dcdd8ef22ff5d4fcb986fa4e45f8 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-38999
https://notcve.org/view.php?id=CVE-2023-38999
09 Aug 2023 — A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request. • https://github.com/opnsense/core/commit/5d68f43d1f254144831881fc87d885eed120cf3c • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39000
https://notcve.org/view.php?id=CVE-2023-39000
09 Aug 2023 — A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path. • https://github.com/opnsense/core/commit/d1f350ce70e477adc86d445f5cda9b24f9ff0168 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 39%CPEs: 1EXPL: 1CVE-2023-39001
https://notcve.org/view.php?id=CVE-2023-39001
09 Aug 2023 — A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file. • https://github.com/opnsense/core/commit/e800097d0c287bb665f0751a98a67c75ef7b45e5 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.4EPSS: 3%CPEs: 1EXPL: 1CVE-2023-39002
https://notcve.org/view.php?id=CVE-2023-39002
09 Aug 2023 — A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. • https://github.com/opnsense/core/commit/a4f6a8f8d604271f81984cfcbba0471af58e34dc • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39003
https://notcve.org/view.php?id=CVE-2023-39003
09 Aug 2023 — OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp. • http://opnsense.com • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-39004
https://notcve.org/view.php?id=CVE-2023-39004
09 Aug 2023 — Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation. • http://opnsense.com • CWE-732: Incorrect Permission Assignment for Critical Resource •