1153 matches found
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in systemfirmwarerestorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter...
CVE-2015-2295
Cross-site request forgery CSRF vulnerability in systemfirmwarerestorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter...
CVE-2015-2295
PfSense WebGUI (pfSense before 2.2.1) is affected by CVE-2015-2295 due to CSRF in system_firmware_restorefullbackup.php, enabling an attacker to hijack admin authentication and issue deletefile requests that can remove arbitrary files with root privileges. Several connected advisories corroborate...
CVE-2015-2295
Cross-site request forgery CSRF vulnerability in systemfirmwarerestorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter...
PT-2015-5701
Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.2.1 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack administrator authentication for requests that delete arbitrary files via the deletefile parameter in the system...
CVE-2015-2295: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in systemfirmwarerestorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter...
CVE-2015-2294
Multiple cross-site scripting XSS vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 zone parameter to statuscaptiveportal.php; 2 if or 3 dragtable parameter to firewallrules.php; 4 queue parameter in an add action to...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 zone parameter to statuscaptiveportal.php; 2 if or 3 dragtable parameter to firewallrules.php; 4 queue parameter in an add action to...
CVE-2015-2294
Multiple cross-site scripting XSS vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 zone parameter to statuscaptiveportal.php; 2 if or 3 dragtable parameter to firewallrules.php; 4 queue parameter in an add action to...
CVE-2015-2294
pfSense before 2.2.1 is affected by multiple WebGUI XSS vulnerabilities (CVE-2015-2294) and a CSRF issue (CVE-2015-2295). The root cause is insufficient validation/sanitization of user-supplied input across many parameters (zone, if/dragtable, queue, id, and various filterlogentries_*; plus syste...
CVE-2015-2294
Multiple cross-site scripting XSS vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 zone parameter to statuscaptiveportal.php; 2 if or 3 dragtable parameter to firewallrules.php; 4 queue parameter in an add action to...
PT-2015-5700
Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.2.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters in different PHP files, including status captiveportal.php, firewall rules.php, firewall shaper.php,...
KLA10528 Code injection vulnerability in pfsense
Cross-site scripting vulnerabilities were found in pfSense. By exploiting these vulnerabilities malicious users can enject arbitrary sctip or HTML. These vulnerabilities can be exploited remotely via a specially designed parameters for web interface. Original advisories pfSense advisory...
CVE-2015-2294: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 zone parameter to statuscaptiveportal.php; 2 if or 3 dragtable parameter to firewallrules.php; 4 queue parameter in an add action to...
pfSense 2.2 - Multiple Vulnerabilities
Exploit for php platform in category web applications Product: pfSense Vendor: Electric Sheep Fencing LLC Vulnerable Versions: 2.2 and probably prior Tested Version: 2.2 Advisory Publication: March 4, 2015 without technical details Vendor Notification: March 4, 2015 Vendor Patch: March 5, 2015...
pfSense 2.2 - Multiple Vulnerabilities
pfSense 2.2 - Multiple Vulnerabilities Advisory ID: HTB23251 Product: pfSense Vendor: Electric Sheep Fencing LLC Vulnerable Versions: 2.2 and probably prior Tested Version: 2.2 Advisory Publication: March 4, 2015 without technical details Vendor Notification: March 4, 2015 Vendor Patch: March 5,...
pfSense 2.2 - Multiple Vulnerabilities
Advisory ID: HTB23251 Product: pfSense Vendor: Electric Sheep Fencing LLC Vulnerable Versions: 2.2 and probably prior Tested Version: 2.2 Advisory Publication: March 4, 2015 without technical details Vendor Notification: March 4, 2015 Vendor Patch: March 5, 2015 Public Disclosure: March 25, 2015...
Multiple Cross-Site Scripting Vulnerabilities in pfSense
pfSense is a free, open-source customized version of FreeBSD designed for use as a firewall and router. Multiple cross-site scripting vulnerabilities exist in pfSense. The vulnerabilities are caused by passing the "queue" HTTP GET parameter to the "/firewallshaper.php" script, the "if" and...
pfSense Cross-Site Request Forgery Vulnerability
pfSense is a free, open-source customized version of FreeBSD designed for use as a firewall and router. A cross-site request forgery vulnerability exists in pfSense. Due to insufficient authentication of HTTP requests originating in the "/systemfirmwarerestorefullbackup.php" script, a remote...
pfSense 2.2 Cross Site Request Forgery / Cross Site Scripting
Advisory ID: HTB23251 Product: pfSense Vendor: Electric Sheep Fencing LLC Vulnerable Versions: 2.2 and probably prior Tested Version: 2.2 Advisory Publication: March 4, 2015 without technical details Vendor Notification: March 4, 2015 Vendor Patch: March 5, 2015 Public Disclosure: March 25, 2015...