CVE-2019-12949

CVE-2019-12949 من ثغرة البرمجة النصية عبر المواقع إلى تنفيذ الأوامر عن بُعد في pfSense 2.4.4-p2 و 2.4.4-p3 وصف المعلومات: في pfSense 2.4.4-p2 و 2.4.4-p3، إذا كان من الممكن خداع المسؤول المصادق للنقر على زر في صفحة تصيّد، يمكن للمهاجم رفع كود برمجي تعسفي قابل للتنفيذ عبر dingcommand.php و...

pfSense < 2.4.5 Multiple Vulnerabilities

According to its self-reported version number, the remote pfSense install is to 2.4.5. It is, therefore, affected by multiple vulnerabilities, including the following: - In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a...

CVE-2019-12949

In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diagcommand.php and rrdfetchjson.php timePeriod parameter, to a server. Then, the remote...

CVE-2019-12949: Improper Neutralization of Input During Web Page Generation

In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diagcommand.php and rrdfetchjson.php timePeriod parameter, to a server. Then, the remote...