pfSense 2.2 - Multiple Vulnerabilities

Exploit for php platform in category web applications Product: pfSense Vendor: Electric Sheep Fencing LLC Vulnerable Versions: 2.2 and probably prior Tested Version: 2.2 Advisory Publication: March 4, 2015 without technical details Vendor Notification: March 4, 2015 Vendor Patch: March 5, 2015...

pfSense 2.2 - Multiple Vulnerabilities

Advisory ID: HTB23251 Product: pfSense Vendor: Electric Sheep Fencing LLC Vulnerable Versions: 2.2 and probably prior Tested Version: 2.2 Advisory Publication: March 4, 2015 without technical details Vendor Notification: March 4, 2015 Vendor Patch: March 5, 2015 Public Disclosure: March 25, 2015...

pfSense 2.2 - Multiple Vulnerabilities

pfSense 2.2 - Multiple Vulnerabilities Advisory ID: HTB23251 Product: pfSense Vendor: Electric Sheep Fencing LLC Vulnerable Versions: 2.2 and probably prior Tested Version: 2.2 Advisory Publication: March 4, 2015 without technical details Vendor Notification: March 4, 2015 Vendor Patch: March 5,...

pfSense 2.2 Cross Site Request Forgery / Cross Site Scripting

Advisory ID: HTB23251 Product: pfSense Vendor: Electric Sheep Fencing LLC Vulnerable Versions: 2.2 and probably prior Tested Version: 2.2 Advisory Publication: March 4, 2015 without technical details Vendor Notification: March 4, 2015 Vendor Patch: March 5, 2015 Public Disclosure: March 25, 2015...

Multiple Cross-Site Scripting Vulnerabilities in pfSense

pfSense is a free, open-source customized version of FreeBSD designed for use as a firewall and router. Multiple cross-site scripting vulnerabilities exist in pfSense. The vulnerabilities are caused by passing the "queue" HTTP GET parameter to the "/firewallshaper.php" script, the "if" and...

pfSense Cross-Site Request Forgery Vulnerability

pfSense is a free, open-source customized version of FreeBSD designed for use as a firewall and router. A cross-site request forgery vulnerability exists in pfSense. Due to insufficient authentication of HTTP requests originating in the "/systemfirmwarerestorefullbackup.php" script, a remote...

Arbitrary file deletion and multiple XSS vulnerabilities in pfSense

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in web interface of pfSense, which can be exploited to perform Cross-Site Scripting XSS attacks against administrator of pfSense and delete arbitrary files via CSRF Cross-Site Request Forgery attacks. Successful exploitati...

CVE-2014-4693

Multiple cross-site scripting XSS vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via 1 the eng parameter to snortimportaliases.php or 2 unspecified variables to snortselectalias.php...

CVE-2014-4692

pfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2014-4695

Multiple open redirect vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via 1 the referer parameter to snortrulesflowbits.php or 2 the returl parameter to snortselectalias.php...

CVE-2014-4694

Multiple cross-site scripting XSS vulnerabilities in suricataselectalias.php in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via unspecified variables...

CVE-2014-4696

Multiple open redirect vulnerabilities in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via 1 the referer parameter to suricatarulesflowbits.php or 2 the returl parameter to...

CVE-2014-4688

pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via 1 the hostname value to diagdns.php in a Create Alias action, 2 the smartmonemail value to diagsmart.php, or 3 the database value to statusrrdgraphimg.php...

CVE-2014-4691

Session fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web sessions via a firewall login cookie...

CVE-2014-4687

Multiple cross-site scripting XSS vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML via 1 the starttime0 parameter to firewallschedule.php, 2 the rssfeed parameter to rss.widget.php, 3 the servicestatusfilter parameter to...

CVE-2014-4690

Multiple directory traversal vulnerabilities in pfSense before 2.1.4 allow 1 remote attackers to read arbitrary .info files via a crafted path in the pkg parameter to pkgmgrinstall.php and allow 2 remote authenticated users to read arbitrary files via the downloadbackup parameter to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via 1 the eng parameter to snortimportaliases.php or 2 unspecified variables to snortselectalias.php...

Directory traversal

Multiple directory traversal vulnerabilities in pfSense before 2.1.4 allow 1 remote attackers to read arbitrary .info files via a crafted path in the pkg parameter to pkgmgrinstall.php and allow 2 remote authenticated users to read arbitrary files via the downloadbackup parameter to...

Session fixation

Session fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web sessions via a firewall login cookie...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in suricataselectalias.php in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via unspecified variables...