CVE-2019-12949

In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diagcommand.php and rrdfetchjson.php timePeriod parameter, to a server. Then, the remote...

Command injection

In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diagcommand.php and rrdfetchjson.php timePeriod parameter, to a server. Then, the remote...

CVE-2019-12949

In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diagcommand.php and rrdfetchjson.php timePeriod parameter, to a server. Then, the remote...

CVE-2019-12949

CVE-2019-12949 affects pfSense 2.4.4-p2 and 2.4.4-p3. An authenticated admin can be lured into clicking a phishing-page button, triggering XSS via diag_command.php and rrd_fetch_json.php (timePeriod parameter) that uploads arbitrary executable code to the server. The attacker can then run command...

CVE-2019-12584

Apcupsd 0.3.915, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsdstatus.php...

CVE-2019-12585

Apcupsd 0.3.915, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsdstatus.php...

Command injection

Apcupsd 0.3.915, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsdstatus.php...

Cross site scripting

Apcupsd 0.3.915, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsdstatus.php...

CVE-2019-12585

Apcupsd 0.3.915, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsdstatus.php...

CVE-2019-12584

Apcupsd 0.3.915, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsdstatus.php...

CVE-2019-12585

Apcupsd 0.3.915, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsdstatus.php...

CVE-2019-12585

CVE-2019-12585 affects apcupsd 0.3.91_5 (used in pfSense up to 2.4.4-RELEASE-p3) and other products. The issue is an Arbitrary Command Execution via apcupsd_status.php. Public sources (NVD/Red Hat OSV/Red Hat CVE pages) describe the vulnerability as a command-injection style flaw with network acc...

EUVD-2019-4179

Apcupsd 0.3.915, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsdstatus.php...

CVE-2019-12585

Apcupsd 0.3.915, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsdstatus.php...

CVE-2019-12584

Apcupsd 0.3.915, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsdstatus.php...

CVE-2019-12584

Apcupsd 0.3.915, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsdstatus.php...

Apcupsd Cross-Site Scripting Vulnerability

pfSense is a set of network firewalls based on FreeBSD Linux. apcupsd is one of the uninterruptible power supply daemons. A cross-site scripting vulnerability exists in the apcupsdstatus.php file in Apcupsd version 0.3.915 in pfSense 2.4.4-RELEASE-p3 and earlier versions and other products. The...

pfSense cross-site scripting vulnerability (CNVD-2019-16508)

pfSense is a set of network firewalls based on FreeBSD Linux. A cross-site scripting vulnerability exists in version 2.4.4-p3 of pfSense, which stems from the lack of proper validation of client-side data by a WEB application. An attacker can exploit this vulnerability to execute client-side code...

Cross site scripting

In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acmeaccountkeysedit.php action. The vulnerability occurs due to input validation errors...

CVE-2019-12347

In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acmeaccountkeysedit.php action. The vulnerability occurs due to input validation errors...