926 matches found
pfSense-pkg-WireGuard vulnerable to directory traversal
Overview pfSense-pkg-WireGuard provided by pfSense is an add-on package for pfSense CE and pfSense Plus. pfSense-pkg-WireGuard contains a directory traversal vulnerability CWE-22. Yutaka WATANABE of Ierae Security Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer...
JVN#85572374: pfSense-pkg-WireGuard vulnerable to directory traversal
pfSense-pkg-WireGuard provided by pfSense is an add-on package for pfSense CE and pfSense Plus. pfSense-pkg-WireGuard contains a directory traversal vulnerability CWE-22. Impact pfSense users may view files in the private folders which they do not have privileges to access. Solution Update the...
pfSense-pkg-WireGuard 路径遍历漏洞
pfSense-pkg-WireGuard is a VPN component for pfSense in the pfSense open source. A path traversal vulnerability exists in pfSense-pkg-WireGuard that allows an attacker to view files in a private folder that they are not authorized to access...
CVE-2021-41282
diagroutes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection...
CVE-2021-41282
diagroutes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection...
CVE-2021-41282
diagroutes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection...
Command injection
diagroutes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection...
CVE-2021-41282
CVE-2021-41282 affects pfSense 2.5.2 where diag_routes.php uses netstat output parsed by sed. Despite escapeshellarg, an attacker with authenticated access and the required WebCfg privilege can inject sed code, enabling arbitrary file write and potential web shell execution. Descriptions across c...
Vulnerability fixed in pfSense
NetGate has fixed a vulnerability in pfSense versions lower than and equal to 2.5.2. A malicious person with user privileges within the same network is able to write arbitrary code to the system. Due to the lack of Cross-Site Request Forgery Protection CSRF on the vulnerable system, it is possibl...
pfSense Diag Routes Web Shell Upload
This module exploits an arbitrary file creation vulnerability in the pfSense HTTP interface CVE-2021-41282. The vulnerability affects versions use exploit/unix/http/pfsense/diagrouteswebshell msf undefineddiagrouteswebshell show actions ...actions... msf undefineddiagrouteswebshell set ACTION msf...
pfSense 注入漏洞
pfSense is a set of network firewalls based on FreeBSD Linux. pfSense suffers from an injection vulnerability that can be exploited by an attacker to run code via diagroutes.php...
CVE-2022-23993
/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $REQUEST'pkgfilter' in a PHP echo call, causing XSS...
CVE-2022-23993
/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $REQUEST'pkgfilter' in a PHP echo call, causing XSS...
Cross site scripting
/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $REQUEST'pkgfilter' in a PHP echo call, causing XSS...
CVE-2022-23993
/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $REQUEST'pkgfilter' in a PHP echo call, causing XSS...
CVE-2022-23993
/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $REQUEST'pkgfilter' in a PHP echo call, causing XSS...
CVE-2022-23993
CVE-2022-23993 concerns pfSense CE (pre-2.6.0) and pfSense Plus (pre-22.01). The vulnerability arises from how pfSense serves /usr/local/www/pkg.php, where $_REQUEST['pkg_filter'] is echoed, enabling a cross-site scripting (XSS) condition. The issue is rooted in user input being reflected in a PH...
pfSense 跨站脚本漏洞
pfSense is a set of network firewalls based on FreeBSD Linux. A security vulnerability exists in pfSense versions prior to 2.5.2, which originates from a php echo in /usr/local/www/pkg.php using $ REQUESTpkg filter...
CVE-2020-19201
A Stored Cross-Site Scripting XSS vulnerability was found in statusfilterreload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4-p2 and earlier. The page did not encode output from the filter reload process, and a stored XSS was possible via the descr description...
CVE-2020-19203
An authenticated Cross-Site Scripting XSS vulnerability was found in widgets/widgets/wakeonlanwidget.php, a component of the pfSense software WebGUI, on version 2.4.4-p2 and earlier. The widget did not encode the descr description parameter of wake-on-LAN entries in its output, leading to a...