CVE-2020-10797

CVE-2020-10797 affects pfSense before 2.4.5. A cross-site scripting (XSS) vulnerability exists in the hostname field of diag_ping.php; after inputs are passed to the command and the command executes, the $result variable is not sanitized before being printed. Public references corroborate the XSS...

pfSense 2.4.4-P3 - (User Manager) Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting Exploit Author: Matthew Aberegg Vendor Homepage: https://www.pfsense.org Version: PfSense 2.4.4-P3 Tested on: FreeBSD 11.2-RELEASE-p10 CVE : CVE-2020-11457...

pfSense 2.4.4-P3 User Manager Cross Site Scripting

Exploit Title: pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting Date: 2020-04-02 Exploit Author: Matthew Aberegg Vendor Homepage: https://www.pfsense.org Version: PfSense 2.4.4-P3 Tested on: FreeBSD 11.2-RELEASE-p10 CVE : CVE-2020-11457 Vulnerability Details Description : A...

pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting

Exploit Title: pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting Date: 2020-04-02 Exploit Author: Matthew Aberegg Vendor Homepage: https://www.pfsense.org Version: PfSense 2.4.4-P3 Tested on: FreeBSD 11.2-RELEASE-p10 CVE : CVE-2020-11457 Vulnerability Details Description : A...

pfSense 'User Manager' Cross-Site Scripting Vulnerability

pfSense is a set of network firewalls based on FreeBSD Linux. A cross-site scripting vulnerability exists in pfSense 'User Manager'. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute client-si...

CVE-2020-11457

pfSense before 2.4.5 has stored XSS in systemusermanageraddprivs.php in the WebGUI via the descr parameter aka full name of a user...

CVE-2020-11457

pfSense before 2.4.5 has stored XSS in systemusermanageraddprivs.php in the WebGUI via the descr parameter aka full name of a user...

Cross site scripting

pfSense before 2.4.5 has stored XSS in systemusermanageraddprivs.php in the WebGUI via the descr parameter aka full name of a user...

CVE-2020-11457

pfSense before 2.4.5 has stored XSS in systemusermanageraddprivs.php in the WebGUI via the descr parameter aka full name of a user...

CVE-2020-11457

PfSense present a stored XSS (via the descr field) in the WebGUI’s User Manager addprivs flow. Affected product: pfSense prior to 2.4.5; root cause: lack of input validation in system_usermanager_addprivs.php allowing arbitrary script payloads to be stored as a user’s Full Name. Impact: potential...

Netgate pfSense Stored Cross-Site Scripting (CVE-2019-12347)

A stored cross-site scripting vulnerability exists in Netgate pfSense. The vulnerability is due to improper validation of the name and desc parameters in the acmeaccountkeysedit.php script file of the ACME package. Successful exploitation could allow the attacker to execute arbitrary script code ...

pfSense freeradius3 package cross-site scripting vulnerability

pfSense is a network firewall based on FreeBSD Linux. freeradius3 package is a Remote User Dial-In Authentication Service RADIUS package used in it. A cross-site scripting vulnerability exists in the /usr/local/www/freeradiusviewconfig.php file in versions of pfSense freeradius3 package prior to...

CVE-2019-18667

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

CVE-2019-18667

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

Default credentials

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

CVE-2019-18667

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

CVE-2019-18667

CVE-2019-18667 affects pfSense deployments using the freeradius3 package on FreeBSD. The vulnerability is in /usr/local/www/freeradius_view_config.php and arises from insufficient input validation, enabling a user-supplied XSS payload in password or username fields to execute arbitrary JavaScript...

Netgate pfSense Stored Cross-Site Scripting (CVE-2019-8953)

A stored cross-site scripting vulnerability exists in Netgate pfSense. The vulnerability is due to improper validation of desc and tableactionsaclN parameters in the haproxylistenersedit.php script file...

Unspecified vulnerability in pfSense widgetkey

pfSense is a set of network firewalls based on FreeBSD Linux. In pfSense version 2.4.4-p3, a security vulnerability exists in the widgets/widgets/picture.widget.php file. The vulnerability stems from the use of the widgetkey parameter without filtering, which can be exploited by an attacker to...

pfSense Cross-Site Request Forgery Vulnerability (CNVD-2019-43356)

pfsense is an open source routing and firewall software , based on freebsd system customization and development . pfSense 2.4.4-p3 in diagcommand.php cross-site request forgery vulnerability. An attacker can exploit this vulnerability to execute OS commands via the txtCommand or txtRecallBuffer...