PT-2012-2027

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.0.1 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the style parameter in the status rrd graph.php...

CVE-2011-4197: Undefined Security Weakness

etc/inc/certs.inc in the PKI implementation in pfSense before 2.0.1 creates each X.509 certificate with a true value for the CA basic constraint, which allows remote attackers to create sub-certificates for arbitrary subjects by leveraging the private key...

CVE-2011-5047: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in statusrrdgraph.php in pfSense before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the style parameter...

[MATTA-2011-001] pfSense x509 Insecure Certificate Creation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Matta Consulting - Matta Advisory https://www.trustmatta.com pfSense x509 Insecure Certificate Creation Advisory ID: MATTA-2011-001 CVE reference: CVE-2011-4197 Affected platforms: pfSense Version: 2.0 Date: 2011-October-09 Security risk: High...

pfSense invalid certificates issue

All certificates are issued with CA:true flag...

CVE-2010-4412

Multiple cross-site scripting XSS vulnerabilities in pfSense 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via 1 the id parameter in an olsrd.xml action to pkgedit.php, 2 the xml parameter to pkg.php, or the if parameter to 3 statusgraph.php or 4 interfaces.php, a differe...

CVE-2010-4246

Multiple cross-site scripting XSS vulnerabilities in graph.php in pfSense 1.2.3 and 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via the 1 ifnum or 2 ifname parameter, a different vulnerability than CVE-2008-1182...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in pfSense 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via 1 the id parameter in an olsrd.xml action to pkgedit.php, 2 the xml parameter to pkg.php, or the if parameter to 3 statusgraph.php or 4 interfaces.php, a differe...

CVE-2010-4246

Multiple cross-site scripting XSS vulnerabilities in graph.php in pfSense 1.2.3 and 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via the 1 ifnum or 2 ifname parameter, a different vulnerability than CVE-2008-1182...

CVE-2010-4412

Multiple cross-site scripting XSS vulnerabilities in pfSense 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via 1 the id parameter in an olsrd.xml action to pkgedit.php, 2 the xml parameter to pkg.php, or the if parameter to 3 statusgraph.php or 4 interfaces.php, a differe...

CVE-2010-4246

CVE-2010-4246 describes multiple cross-site scripting (XSS) vulnerabilities in pfSense, specifically in the file graph.php for pfSense versions 1.2.3 and 2 beta 4. The vulnerabilities allow remote attackers to inject arbitrary web script or HTML by supplying the parameters (1) ifnum or (2) ifname...

CVE-2010-4412

CVE-2010-4412 describes multiple cross-site scripting (XSS) vulnerabilities in pfSense 2 beta 4. The issues allow remote attackers to inject arbitrary web script or HTML via (1) id in olsrd.xml action to pkg_edit.php, (2) xml in pkg.php, or (3) if in status_graph.php, or (4) interfaces.php. The r...

CVE-2010-4412: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in pfSense 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via 1 the id parameter in an olsrd.xml action to pkgedit.php, 2 the xml parameter to pkg.php, or the if parameter to 3 statusgraph.php or 4 interfaces.php, a differe...

CVE-2010-4246: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in graph.php in pfSense 1.2.3 and 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via the 1 ifnum or 2 ifname parameter, a different vulnerability than CVE-2008-1182...

PT-2010-5488

Multiple cross-site scripting XSS vulnerabilities in pfSense 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via 1 the id parameter in an olsrd.xml action to pkg edit.php, 2 the xml parameter to pkg.php, or the if parameter to 3 status graph.php or 4 interfaces.php, a...

PT-2010-5376

Name of the Vulnerable Software and Affected Versions pfSense versions 1.2.3 through 2 beta 4 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the ifnum or ifname parameters in...

pfSense Cross Site Scripting

"Those who cannot learn from history are doomed to repeat it." - George Santayana http://cvstrac.pfsense.org/chngview?cn=20994 "Comment: Make scripts XSS input safe. " Date: 2008-Feb-11 23:33:24 local 2008-Feb-12 04:33:24 UTC So in 2010, pfsense 2 beta 4: ... xss - pkgedit.php...

pfSense - pkg_edit.php?id Cross-Site Scripting

pfSense - pkgedit.php?id Cross-Site Scripting source: https://www.securityfocus.com/bid/45272/info pfSense is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in...

pfSense - 'status_graph.php?if' Cross-Site Scripting

source: https://www.securityfocus.com/bid/45272/info pfSense is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

pfSense - 'pkg_edit.php?id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/45272/info pfSense is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...