pfSense 'User Manager' Cross-Site Scripting Vulnerability

pfSense is a set of network firewalls based on FreeBSD Linux. A cross-site scripting vulnerability exists in pfSense 'User Manager'. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute client-si...

CVE-2020-11457

pfSense before 2.4.5 has stored XSS in systemusermanageraddprivs.php in the WebGUI via the descr parameter aka full name of a user...

CVE-2020-11457

pfSense before 2.4.5 has stored XSS in systemusermanageraddprivs.php in the WebGUI via the descr parameter aka full name of a user...

Cross site scripting

pfSense before 2.4.5 has stored XSS in systemusermanageraddprivs.php in the WebGUI via the descr parameter aka full name of a user...

CVE-2020-11457

pfSense before 2.4.5 has stored XSS in systemusermanageraddprivs.php in the WebGUI via the descr parameter aka full name of a user...

CVE-2020-11457

PfSense present a stored XSS (via the descr field) in the WebGUI’s User Manager addprivs flow. Affected product: pfSense prior to 2.4.5; root cause: lack of input validation in system_usermanager_addprivs.php allowing arbitrary script payloads to be stored as a user’s Full Name. Impact: potential...

CVE-2020-11457: Improper Neutralization of Input During Web Page Generation

pfSense before 2.4.5 has stored XSS in systemusermanageraddprivs.php in the WebGUI via the descr parameter aka full name of a user...

PT-2020-12623

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.4.5 Description The issue concerns stored XSS in the WebGUI, specifically in the system usermanager addprivs.php file, via the descr parameter, also known as the full name of a user. Recommendations For versions pri...

Netgate pfSense Stored Cross-Site Scripting (CVE-2019-12347)

A stored cross-site scripting vulnerability exists in Netgate pfSense. The vulnerability is due to improper validation of the name and desc parameters in the acmeaccountkeysedit.php script file of the ACME package. Successful exploitation could allow the attacker to execute arbitrary script code ...

pfSense freeradius3 package cross-site scripting vulnerability

pfSense is a network firewall based on FreeBSD Linux. freeradius3 package is a Remote User Dial-In Authentication Service RADIUS package used in it. A cross-site scripting vulnerability exists in the /usr/local/www/freeradiusviewconfig.php file in versions of pfSense freeradius3 package prior to...

CVE-2019-18667

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

CVE-2019-18667

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

Default credentials

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

CVE-2019-18667

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

CVE-2019-18667

CVE-2019-18667 affects pfSense deployments using the freeradius3 package on FreeBSD. The vulnerability is in /usr/local/www/freeradius_view_config.php and arises from insufficient input validation, enabling a user-supplied XSS payload in password or username fields to execute arbitrary JavaScript...

CVE-2019-18667

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

PT-2019-15567

Name of the Vulnerable Software and Affected Versions freeradius3 package versions prior to 0.15.7 3 for pfSense on FreeBSD Description The issue allows a user with an XSS payload as username or password to execute arbitrary JavaScript code on a victim's browser. This is due to a vulnerability in...

CVE-2019-18667: Improper Neutralization of Input During Web Page Generation

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

Netgate pfSense Stored Cross-Site Scripting (CVE-2019-8953)

A stored cross-site scripting vulnerability exists in Netgate pfSense. The vulnerability is due to improper validation of desc and tableactionsaclN parameters in the haproxylistenersedit.php script file...

Unspecified vulnerability in pfSense widgetkey

pfSense is a set of network firewalls based on FreeBSD Linux. In pfSense version 2.4.4-p3, a security vulnerability exists in the widgets/widgets/picture.widget.php file. The vulnerability stems from the use of the widgetkey parameter without filtering, which can be exploited by an attacker to...