400 matches found
CVE-2023-39007
/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php...
CVE-2023-39005
Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2...
CVE-2023-39004
Insecure permissions in the configuration directory /conf/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information e.g., hashed root password which could lead to privilege escalation...
CVE-2023-39000
A reflected cross-site scripting XSS vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path...
Deciso OPNsense Security Vulnerability
Deciso OPNsense is a FreeBSD-based open source firewall and routing software from Dutch company Deciso. A security vulnerability exists in Deciso OPNsense versions prior to 23.7, which stems from a misconfiguration of permissions in the directory /tmp...
CVE-2023-39003
CVE-2023-39003 affects OPNSense Community Edition < 23.7 and OPNSense Business Edition
CVE-2023-39005
Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2...
CVE-2023-38999
A Cross-Site Request Forgery CSRF in the System Halt API /system/halt of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service DoS via a crafted GET request...
Deciso OPNsense Cross-Site Scripting Vulnerability
Deciso OPNsense is a FreeBSD-based open source firewall and routing software from the Dutch company Deciso. A cross-site scripting vulnerability exists in OPNsense versions prior to 23.7, which stems from a cross-site scripting XSS vulnerability in the act parameter of the systemcertmanager.php...
Deciso OPNsense Cross-Site Scripting Vulnerability
Deciso OPNsense is a FreeBSD-based open source firewall and routing software from Dutch company Deciso. A cross-site scripting vulnerability exists in Deciso OPNsense versions prior to 23.7, which stems from a cross-site scripting XSS vulnerability in component /ui/cron/item/open...
CVE-2023-39002
OPNsense XSS (CVE-2023-39002) exists in the act parameter of system_certmanager.php. Affected: Community Edition prior to 23.7 and Business Edition prior to 23.4.2. Description and connected sources confirm an XSS that allows crafting payloads to execute arbitrary scripts/HTML. Practical impact o...
CVE-2023-39001
CVE-2023-39001 describes a command-injection vulnerability in the OPNSense component diag_backup.php. It affects OPNSense Community Edition prior to 23.7 and OPNSense Business Edition prior to 23.4.2, allowing an attacker to execute arbitrary commands via a crafted backup configuration file. The ...
CVE-2023-39001
A command injection vulnerability in the component diagbackup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file...
CVE-2023-39008
The CVE-2023-39008 entry describes a command-injection vulnerability in the /api/cron/settings/setJob/ component of OPNsense. Affected products are OPNsense Community Edition prior to 23.7 and OPNsense Business Edition prior to 23.4.2. The underlying issue allows an attacker to execute arbitrary ...
CVE-2023-39006
The Crash Reporter crashreporter.php component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization...
Deciso OPNsense Input Validation Error Vulnerability
Deciso OPNsense is a suite of FreeBSD-based open source firewall and routing software from Dutch company Deciso. An input validation error vulnerability exists in versions prior to OPNsense 23.7, which stems from an open redirect on the Login page that allows an attacker to redirect a victim to a...
PT-2023-26723 · Opnsense · Opnsense Community Edition +1
Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: The issue is an open redirect in the Login page of OPNsense, allowing attackers to redirect a victim user to an arbitrary web si...
Deciso OPNsense Security Vulnerability
Deciso OPNsense is a FreeBSD-based open source firewall and routing software from the Dutch company Deciso. A security vulnerability exists in OPNsense versions prior to 23.7, which stems from a permission misconfiguration issue in configd.socket...
CVE-2023-39004
Insecure permissions in the configuration directory /conf/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information e.g., hashed root password which could lead to privilege escalation...