PT-2019-10240

Name of the Vulnerable Software and Affected Versions: pfSense version 2.4.4 1 Description: The issue is related to inconsistent blocking of source IP addresses based on failed HTTPS and SSH authentication. This inconsistency might allow attackers to bypass intended access restrictions, as the...

CVE-2018-20798: Incorrect Permission Assignment for Critical Resource

The expiretable configuration in pfSense 2.4.41 establishes block durations that are incompatible with the block durations implemented by sshguard, which might make it easier for attackers to bypass intended access restrictions...

PT-2019-10239

Name of the Vulnerable Software and Affected Versions: pfSense version 2.4.4 1 Description: The issue arises from the expiretable configuration in pfSense, which sets block durations that are incompatible with those implemented by sshguard. This incompatibility might facilitate attackers' attempt...

CVE-2018-20799: Undefined Security Weakness

In pfSense 2.4.41, blocking of source IP addresses on the basis of failed HTTPS authentication is inconsistent with blocking of source IP addresses on the basis of failed SSH authentication the behavior does not match the sshguard documentation, which might make it easier for attackers to bypass...

pfSense HAProxy package cross-site scripting vulnerability

pfsense is an open source routing and firewall software , based on freebsd system customization and development . A cross-site scripting vulnerability exists in pfSense's HAProxy package before version 0.5916. A remote attacker can use this vulnerability to inject arbitrary Web script or HTML wit...

Design/Logic Flaw

The HAProxy package before 0.5916 for pfSense has XSS via the desc aka Description or tableactionsaclN parameter, related to haproxylisteners.php and haproxylistenersedit.php...

CVE-2019-8953

The HAProxy package before 0.5916 for pfSense has XSS via the desc aka Description or tableactionsaclN parameter, related to haproxylisteners.php and haproxylistenersedit.php...

CVE-2019-8953

The HAProxy package before 0.5916 for pfSense has XSS via the desc aka Description or tableactionsaclN parameter, related to haproxylisteners.php and haproxylistenersedit.php...

CVE-2019-8953

The HAProxy package before 0.5916 for pfSense has XSS via the desc aka Description or tableactionsaclN parameter, related to haproxylisteners.php and haproxylistenersedit.php...

CVE-2019-8953

The HAProxy package before 0.5916 for pfSense has XSS via the desc aka Description or tableactionsaclN parameter, related to haproxylisteners.php and haproxylistenersedit.php...

CVE-2019-8953

The CVE affects pfSense’s HAProxy package prior to version 0.59_16. The vulnerability is a cross-site scripting flaw exposed via the desc (Description) or table_actionsaclN parameter in haproxy_listeners.php and haproxy_listeners_edit.php. Impact is XSS (no data exfiltration detail provided in th...

PT-2019-19279

Name of the Vulnerable Software and Affected Versions HAProxy package before 0.59 16 for pfSense Description The issue is related to Cross-Site Scripting XSS via the desc also known as Description or table actionsaclN parameter. This is connected to the files haproxy listeners.php and haproxy...

CVE-2019-8953: Improper Neutralization of Input During Web Page Generation

The HAProxy package before 0.5916 for pfSense has XSS via the desc aka Description or tableactionsaclN parameter, related to haproxylisteners.php and haproxylistenersedit.php...

Netgate pfSense Command Injection (CVE-2018-4021)

A command injection vulnerability exists in the administrative interface of Netgate pfSense. The vulnerability is due to improper sanitization of three parameters in requests sent to system. Successful exploitation results in the execution of arbitrary commands as the root user on the target serv...

pfSense 2.4.4-p1 - Cross-Site Scripting Vulnerability

Exploit for multiple platform in category web applications Exploit Title: pfSense 2.4.4-p1 | Cross-Site Scripting Exploit Author: Ozer Goker Vendor Homepage: https://www.pfsense.org Software Link: https://frafiles.pfsense.org/mirror/downloads/pfSense-CE-2.4.4-RELEASE-p1-amd64.iso.gz Version:...

pfSense 2.4.4-p1 - Cross-Site Scripting

pfSense 2.4.4-p1 - Cross-Site Scripting Exploit Title: pfSense 2.4.4-p1 | Cross-Site Scripting Date: 28.01.2019 Exploit Author: Ozer Goker Vendor Homepage: https://www.pfsense.org Software Link: https://frafiles.pfsense.org/mirror/downloads/pfSense-CE-2.4.4-RELEASE-p1-amd64.iso.gz Version: 2.4.4-...

pfSense 2.4.4-p1 - Cross-Site Scripting

Exploit Title: pfSense 2.4.4-p1 | Cross-Site Scripting Date: 28.01.2019 Exploit Author: Ozer Goker Vendor Homepage: https://www.pfsense.org Software Link: https://frafiles.pfsense.org/mirror/downloads/pfSense-CE-2.4.4-RELEASE-p1-amd64.iso.gz Version: 2.4.4-p1 Introduction pfSense® software is a...

pfSense Unsupported Version Detection

According to its self-reported version number, the remote pfSense host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. C Tenable Network Security, Inc...

pfSense 2.4.4-p1 Cross Site Scripting

Exploit Title: pfSense 2.4.4-p1 | Cross-Site Scripting Date: 28.01.2019 Exploit Author: Ozer Goker Vendor Homepage: https://www.pfsense.org Software Link: https://frafiles.pfsense.org/mirror/downloads/pfSense-CE-2.4.4-RELEASE-p1-amd64.iso.gz Version: 2.4.4-p1 Introduction pfSenseAr software is a...

pfSense 2.3.x < 2.3.5-p2 / 2.4.x < 2.4.3-p1 Multiple Vulnerabilities (SA-18_04 / SA-18_05)

According to its self-reported version number, the remote pfSense install is a version 2.3.x prior to 2.3.5-p2 or 2.4.x prior to 2.4.3-p1. It is, therefore, affected by multiple vulnerabilities: - In FreeBSD before 11.1-STABLEr332066 and 11.1-RELEASE-p10, due to insufficient initialization of...