pfSense <= 2.2.5 - Config File CSRF漏洞

No description provided by source...

doc.pfsense.org XSS vulnerability

Vulnerable URL: https://doc.pfsense.org/thumb.php?f=xssposed%23%3Cbody%09onload=confirm%28String.fromCharCode%2888,83,83,80,79,83,69,68%29%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 16:36 GMT Vulnerability type:| XSS Vulnerability...

pfSense Firewall 2.2.5 - Config File Cross-Site Request Forgery

pfSense Firewall 2.2.5 - Config File Cross-Site Request Forgery function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "https://192.168.0.103/diagbackup.php", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8";...

pfSense Firewall 2.2.5 - Config File Cross-Site Request Forgery

Exploit for php platform in category web applications function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "https://192.168.0.103/diagbackup.php", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8";...

pfSense Firewall 2.2.5 Cross Site Request Forgery

function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "https://192.168.0.103/diagbackup.php", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8"; xhr.setRequestHeader"Accept-Language", "en-US,en;q=0.5";...

pfSense Firewall 2.2.5 - Config File Cross-Site Request Forgery

function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "https://192.168.0.103/diagbackup.php", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8"; xhr.setRequestHeader"Accept-Language", "en-US,en;q=0.5";...

pfSense <= 2.2.5 Wizard XML Directory Traversal Vulnerability - Active Check

pfSense is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:pfsense:pfsense";...

pfSense Detection (HTTP)

HTTP based detection of pfSense. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.806807";...

PFSense 2.2.5 Directory Traversal

Title : PFSense 12 1 LFI example Lfi example on step1submitphpaction; /etc/passwd...

pfSense 2.2.5 - Directory Traversal

pfSense 2.2.5 - Directory Traversal Title : PFSense 12 1 LFI example Lfi example on step1submitphpaction; /etc/passwd /pfsensewi...

PFSense 2.2.5 - Directory Traversal Vulnerability

Exploit for php platform in category web applications Title : PFSense 12 1 LFI example Lfi example on step1submitphpaction;/stepsubmitphpa...

pfSense 2.2.5 - Directory Traversal

Title : PFSense 12 1 LFI example Lfi example on step1submitphpaction; /etc/passwd the parameter is passed to...

PfSense命令注入漏洞

漏洞简介 该漏洞的编号为CVE-2014-4688，存在于PfSense的2.1.3以及更低版本中。该漏洞源于php程序中没有对用户的输入值进行严格的校验，导致用户恶意输入达到命令执行函数时会产生严重后果。其中，diagdns.php， diagsmart.php， statusrrdgraphimg.php三个脚本文件受到该漏洞的影响。 漏洞分析 在diagdns.php中，用户提交的host值经过处理后将传到dig变量中执行。攻击者通过构造host值执行任意命令。...

pfSense WebGUI Zone Parameter Cross-Site Scripting (CVE-2015-4029)

A cross-site scripting vulnerability has been reported in pfSense. The vulnerability is due to servicescaptiveportalzones.php not validating the zone parameter when the act parameter is set to del. A remote attacker can exploit this vulnerability by enticing a user to open a specially crafted lin...

pfSense directory traversal vulnerability analysis-vulnerability warning-the black bar safety net

pfSense is based on FreeBSD, designed for Firewall and router features to customize the open source version. In this article, we will introduce in pfSense 2. 1. 3 and the lower version in the CVE-2 0 1 4-4 6 9 0 vulnerability; the higher the version, pfSense has fixed this vulnerability. 0×0 1...

PfSense XSS vulnerability analysis-vulnerability warning-the black bar safety net

PfSense is based on FreeBSD operating system open source network firewall software, has been around the world of company is widely used to protect its infrastructure. In the last year, we in PfSense, found some security vulnerabilities, the black bar safety net has reported, and submitted to the...

PfSense command injection vulnerability analysis-vulnerability warning-the black bar safety net

In this article, we will introduce in PfSense 2. 1. 3 and the lower version in the CVE-2 0 1 4-4 6 8 8 vulnerability; the higher the version, pfSense has fixed this vulnerability. 0x01 Diagdns. php script command injection vulnerability Shown below is the script diagdns. in php there is a command...

pfSense Multiple Vulnerabilities (pfSense-SA-15_06.webgui)

pfSense is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:pfsense:pfsense"; if description...

Electric Sheep Fencing pfsense cross-site scripting vulnerability (CNVD-2015-05673)

Electric Sheep Fencing pfsense is a free and open source FreeBSD-based firewall and router software from Electric Sheep Fencing. A cross-site scripting vulnerability exists in Electric Sheep Fencing pfsense, which can be exploited by remote attackers to inject arbitrary Web script or HTML...

Electric Sheep Fencing pfsense cross-site scripting vulnerability (CNVD-2015-05674)

Electric Sheep Fencing pfsense is a free and open source FreeBSD-based firewall and router software from Electric Sheep Fencing. A cross-site scripting vulnerability exists in Electric Sheep Fencing pfSense versions prior to 2.2.3, which stems from the servicesntpd.php script not adequately...