Deciso OPNsense Security Vulnerability

Deciso OPNsense is a FreeBSD-based open source firewall and routing software from the Dutch company Deciso. A security vulnerability exists in OPNsense versions prior to 23.7, which stems from a permission misconfiguration issue in configd.socket...

Deciso OPNsense Security Vulnerability

Deciso OPNsense is a FreeBSD-based open source firewall and routing software from Dutch company Deciso. A security vulnerability exists in Deciso OPNsense versions prior to 23.7, which stems from a misconfiguration of permissions in the directory /tmp...

CVE-2023-39008

The CVE-2023-39008 entry describes a command-injection vulnerability in the /api/cron/settings/setJob/ component of OPNsense. Affected products are OPNsense Community Edition prior to 23.7 and OPNsense Business Edition prior to 23.4.2. The underlying issue allows an attacker to execute arbitrary ...

CVE-2023-38998

An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL...

CVE-2023-39004

Insecure permissions in the configuration directory /conf/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information e.g., hashed root password which could lead to privilege escalation...

CVE-2023-39007

/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php...

CVE-2023-39007

/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php...

Deciso OPNsense Security Vulnerability

Deciso OPNsense is a suite of FreeBSD-based open source firewall and routing software from Dutch company Deciso. A security vulnerability exists in OPNsense versions prior to 23.7, which stems from a directory with misconfigured permissions. An attacker can exploit this vulnerability to access...

Deciso OPNsense Path Traversal Vulnerability

Deciso OPNsense is a suite of FreeBSD-based open source firewall and routing software from Dutch company Deciso. A path traversal vulnerability exists in OPNsense versions prior to 23.7, which stems from a directory traversal vulnerability in the Captive Portal template. An attacker can exploit...

CVE-2023-39005

Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2...

CVE-2023-38999

OPNsense CSRF in the System Halt API (/system/halt) affects Community Edition <23.7 and Business Edition

CVE-2023-39000

A reflected cross-site scripting XSS vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path...

CVE-2023-39004

Insecure permissions in the configuration directory /conf/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information e.g., hashed root password which could lead to privilege escalation...

CVE-2023-38998

An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL...

CVE-2023-39007

OPNsense Cron component is affected: Community Edition prior to 23.7 and Business Edition prior to 23.4.2 suffer a Cross-Site Scripting (XSS) via openAction in /ui/cron/item/open (Cron/ItemController.php). The vulnerability is triggered by opening a Cron item and, per CVSS 3.1 details, requires u...

CVE-2023-39008

A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands...

CVE-2023-39006

The Crash Reporter crashreporter.php component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization...

Deciso OPNsense Cross-Site Scripting Vulnerability

Deciso OPNsense is a suite of FreeBSD-based open source firewall and routing software from Dutch company Deciso. A cross-site scripting vulnerability exists in OPNsense versions prior to 23.7, which stems from an improper input cleanup issue in the Crash Reporter component...

CVE-2023-38998

An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL...

PT-2023-26728 · Opnsense · Opnsense Community Edition +1

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: A cross-site scripting XSS issue exists in the act parameter of system certmanager.php, allowing attackers to execute arbitrary...