pfsense 2.3.2 Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: pfsense 2.3.2 Fixed in: 2.3.3 Fixed Version Link: https://pfsense.org/download/ Vendor Website: https://www.pfsense.org/ Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor: 02/06/2017 Disclosed to public:...

pfsense 2.3.2 Cross Site Request Forgery

Security Advisory - Curesec Research Team 1. Introduction Affected Product: pfsense 2.3.2 Fixed in: 2.3.3 Fixed Version Link: https://pfsense.org/download/ Vendor Website: https://www.pfsense.org/ Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendor: 02/06/2017 Disclosed to public:...

How to protect web applications on Google Cloud Platform with WAF?

Many of the developers we speak to are interested in taking advantage of Google Compute Cloud for developing and hosting their web applications. The advantages are many from reasonable costs to built in scalability to high level of availability built right into the platform. However, the develope...

Personalized User Focused Security: Stethoscope

Stethoscope is a web application that collects information from existing device data sources e.g., JAMF or LANDESK on a given user’s devices and gives them clear and specific recommendations for securing their systems. Stethoscope consists of two primary pieces: a Python-based back-end and a...

Centralize or Distribute IPset Blacklists: vallumd

Centralize or Distribute IPset Blacklists If you maintain a server on the Internet, it’s very likely you encountered one or more brute force attacks. Not a problem, just install fail2ban. Done. But if you’re running multiple servers, each of them running their fail2ban instance, they’ll all have...

Vulnerability Disclosed in Ubquiti Networks Admin Interface

Update Ubiquiti Networks, a maker of networking gear for service providers, has been since November dealing with a critical command-injection vulnerability in the administration interface of more than 40 of its products. Researchers at SEC Consult went public with the issue this week after...

How do I open firewall ports for App Layering

...

Trend Micro Deep Discovery Email Inspector firewall_setting Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Deep Discovery Email Inspector. Authentication is not required to exploit this vulnerability. The specific flaw exists within firewallsetting.php. The issue results from the lack of...

CVE-2016-5933

IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM Reference : 1997223...

Design/Logic Flaw

IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM Reference : 1997223...

CVE-2016-5933

IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM Reference : 1997223...

CVE-2016-5933

IBM Tivoli Monitoring Basic Services Vulnerability (CVE-2016-5933) affects IBM Tivoli Monitoring with the Firewall Gateway feature activated. The issue is a host header injection that could lead to HTTP cache poisoning or firewall bypass. Affected releases include IBM Tivoli Monitoring 6.2.x and ...

CVE-2016-5933

IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM Reference : 1997223...

CVE-2017-6411

Cross Site Request Forgery CSRF on D-Link DSL-2730U C1 IN1.00 devices allows remote attackers to change the DNS or firewall configuration or any password...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF on D-Link DSL-2730U C1 IN1.00 devices allows remote attackers to change the DNS or firewall configuration or any password...

CVE-2017-6411

Cross Site Request Forgery CSRF on D-Link DSL-2730U C1 IN1.00 devices allows remote attackers to change the DNS or firewall configuration or any password...

CVE-2017-6411

Cross Site Request Forgery CSRF on D-Link DSL-2730U C1 IN1.00 devices allows remote attackers to change the DNS or firewall configuration or any password...

CVE-2017-6411

CVE-2017-6411 describes a Cross-Site Request Forgery (CSRF) vulnerability in the D-Link DSL-2730U C1 IN_1.00 router. The flaw enables remote attackers to alter settings such as DNS or firewall configurations, or even modify passwords, via the device’s management interface. Public references in th...

PT-2017-17049 · D Link · D-Link Dsl-2730B

Name of the Vulnerable Software and Affected Versions: D-Link DSL-2730U C1 IN 1.00 Description: The issue allows remote attackers to perform unauthorized actions, including changing the DNS or firewall configuration, or modifying any password, due to a Cross Site Request Forgery CSRF weakness...

pfSense 2.3.2 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: pfSense 2.3.2 XSS - CSRF-bypass & Reverse-root-shell Date: 01/03/2017 Author: Yann CAM @ASafety / Synetis Vendor or Software Link: www.pfsense.org Version: 2.3.2 Category: XSS, CSRF-bypass and Remote root reverse-shell Access Google dork: Tested on: FreeBSD pfSense firewall/router...