pfSense < 2.2.1 Multiple Vulnerabilities (SA-15_02 - SA-15_04)

According to its self-reported version number, the remote pfSense install is prior to 2.2.1. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid106493; scriptversion"1.7...

pfSense < 2.2.6 Multiple Vulnerabilities (SA-15_09 / SA-15_10 / SA-15_11)

According to its self-reported version number, the remote pfSense install is prior to 2.2.6. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106498; scriptversion"1.11"; scriptcvsdate"Date: 2019/11/08"; scriptcve...

Electric Sheep Fencing pfSense 'graph' Parameter Command Execution Vulnerability

Electric Sheep Fencing pfsense is a free and open source FreeBSD-based firewall and router software from Electric Sheep Fencing. A security vulnerability exists in Electric Sheep Fencing pfSense versions prior to 2.3. A remote attacker can exploit this vulnerability by sending the 'graph' paramet...

pfSense Default SSH Credentials

The remote device is a pfSense device that uses a set of known, default credentials. An attacker who is able to connect to the service can use these credentials to gain control of the device. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106273; scriptversion...

CVE-2016-10709

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the statusrrdgraphimg.php graph parameter, related to rrdgraphimg.php...

Design/Logic Flaw

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the statusrrdgraphimg.php graph parameter, related to rrdgraphimg.php...

CVE-2016-10709

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the statusrrdgraphimg.php graph parameter, related to rrdgraphimg.php...

CVE-2016-10709

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the statusrrdgraphimg.php graph parameter, related to rrdgraphimg.php...

CVE-2016-10709

Summary of CVE-2016-10709 : pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a ‘|’ character in the status_rrd_graph_img.php graph parameter (related to _rrd_graph_img.php). This is a post-authentication command-injection vulnerability affecting the web GU...

pfSense Web Interface Detection

Binary data pfsensewebuidetect.nbin...

ESF pfSense system_groupmanager.php Command Injection

A command injection vulnerability exists in the web console of the ESF pfSense firewall. The vulnerability is due to a failure on part of the application to properly parse input supplied to the members parameter in the systemgroupmanager.php script...

pfSense 2.1.4 - status_rrd_graph_img.php Command Injection

pfSense 2.1.4 - statusrrdgraphimg.php Command Injection !/usr/bin/env python3 Exploit Title: pfSense = 2.1.3 statusrrdgraphimg.php Command Injection. Date: 2018-01-12 Exploit Author: absolomb Vendor Homepage: https://www.pfsense.org/ Software Link: https://atxfiles.pfsense.org/mirror/downloads/ol...

pfSense < 2.1.4 - status_rrd_graph_img.php Command Injection Exploit

Exploit for php platform in category web applications !/usr/bin/env python3 Exploit Title: pfSense = 2.1.3 statusrrdgraphimg.php Command Injection. Date: 2018-01-12 Exploit Author: absolomb Vendor Homepage: https://www.pfsense.org/ Software Link: https://atxfiles.pfsense.org/mirror/downloads/old/...

pfSense 2.1.3 status_rrd_graph_img.php Command Injection

!/usr/bin/env python3 Exploit Title: pfSense = 2.1.3 statusrrdgraphimg.php Command Injection. Date: 2018-01-12 Exploit Author: absolomb Vendor Homepage: https://www.pfsense.org/ Software Link: https://atxfiles.pfsense.org/mirror/downloads/old/ Version: =2.1.3 Tested on: FreeBSD 8.3-RELEASE-p16 CV...

pfSense < 2.1.4 - 'status_rrd_graph_img.php' Command Injection

!/usr/bin/env python3 Exploit Title: pfSense = 2.1.3 statusrrdgraphimg.php Command Injection. Date: 2018-01-12 Exploit Author: absolomb Vendor Homepage: https://www.pfsense.org/ Software Link: https://atxfiles.pfsense.org/mirror/downloads/old/ Version: =2.1.3 Tested on: FreeBSD 8.3-RELEASE-p16 CV...

Electric Sheep Fencing pfsense clickjacking vulnerability

Electric Sheep Fencing pfsense is a free and open source FreeBSD-based firewall and router software from Electric Sheep Fencing. A clickjacking vulnerability exists in the cross-site request forgery error page of the /usr/local/www/csrf/csrf-magic.php file of the WebGUI in versions prior to...

Electric Sheep Fencing pfsense clickjacking vulnerability

Electric Sheep Fencing pfsense is a free and open source FreeBSD-based firewall and router software from Electric Sheep Fencing. A clickjacking vulnerability exists in Electric Sheep Fencing pfSense 2.4.1 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code...

Design/Logic Flaw

pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed in 2.4.2-RELEASE. OPNsense, a 2015 fork of pfSense, was not...

CVE-2017-1000479

pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed in 2.4.2-RELEASE. OPNsense, a 2015 fork of pfSense, was not...

CVE-2017-1000479

pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed in 2.4.2-RELEASE. OPNsense, a 2015 fork of pfSense, was not...