CVE-2014-4688

pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via 1 the hostname value to diagdns.php in a Create Alias action, 2 the smartmonemail value to diagsmart.php, or 3 the database value to statusrrdgraphimg.php...

CVE-2014-4695

Multiple open redirect vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via 1 the referer parameter to snortrulesflowbits.php or 2 the returl parameter to snortselectalias.php...

CVE-2014-4693

Multiple cross-site scripting XSS vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via 1 the eng parameter to snortimportaliases.php or 2 unspecified variables to snortselectalias.php...

CVE-2014-4687

Multiple cross-site scripting XSS vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML via 1 the starttime0 parameter to firewallschedule.php, 2 the rssfeed parameter to rss.widget.php, 3 the servicestatusfilter parameter to...

CVE-2014-4689

Absolute path traversal vulnerability in pkgedit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter...

CVE-2014-4692

pfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2014-4691

Session fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web sessions via a firewall login cookie...

CVE-2014-4690

Multiple directory traversal vulnerabilities in pfSense before 2.1.4 allow 1 remote attackers to read arbitrary .info files via a crafted path in the pkg parameter to pkgmgrinstall.php and allow 2 remote authenticated users to read arbitrary files via the downloadbackup parameter to...

PT-2014-6053

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4 Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including starttime0 to "firewall schedule.php", rssfeed to "rss.widget.php", servicestatusfilter to...

PT-2014-6054

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4 Description The issue allows remote authenticated users to execute arbitrary commands. This can be achieved through various means, including the hostname value to "diag dns.php" in a Create Alias action, the...

PT-2014-6057

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4 Description A session fixation issue allows remote attackers to hijack web sessions via a firewall login cookie. Recommendations For versions prior to 2.1.4, update to version 2.1.4 or later to resolve the issue...

PT-2014-6058

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4 Description The issue allows remote attackers to obtain potentially sensitive information via script access to the session cookie, as the HTTPOnly flag is not included in the Set-Cookie header for the session...

PT-2014-6056

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4 Description The issue allows remote attackers to read arbitrary .info files via a crafted path in the pkg parameter to "pkg mgr install.php" and allows remote authenticated users to read arbitrary files via the...

PT-2014-6055

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4 Description The issue allows remote attackers to read arbitrary XML files by providing a full pathname in the xml parameter in the pkg edit.php file. Recommendations For versions prior to 2.1.4, update to versio...

PT-2014-6059

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4 Snort versions prior to 3.0.13 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the eng parameter to "snort import aliases.php" or unspecified...

PT-2014-6060

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 1.0.6 pfSense versions prior to 2.1.4 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified variables, potentially leading to cross-site scripting XSS attacks...

PT-2014-6062

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 1.0.6 pfSense versions prior to 2.1.4 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This can be achieved via the referer parameter to "suricata...

PT-2014-6061

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4 Snort versions prior to 3.0.13 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This can be achieved via the referer parameter to "snort rules...

CVE-2014-4696: Undefined Security Weakness

Multiple open redirect vulnerabilities in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via 1 the referer parameter to suricatarulesflowbits.php or 2 the returl parameter to...

CVE-2014-4688: Undefined Security Weakness

pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via 1 the hostname value to diagdns.php in a Create Alias action, 2 the smartmonemail value to diagsmart.php, or 3 the database value to statusrrdgraphimg.php...