CVE-2015-2295

PfSense WebGUI (pfSense before 2.2.1) is affected by CVE-2015-2295 due to CSRF in system_firmware_restorefullbackup.php, enabling an attacker to hijack admin authentication and issue deletefile requests that can remove arbitrary files with root privileges. Several connected advisories corroborate...

CVE-2015-2295

Cross-site request forgery CSRF vulnerability in systemfirmwarerestorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter...

Directory traversal

Multiple directory traversal vulnerabilities in pfSense before 2.1.4 allow 1 remote attackers to read arbitrary .info files via a crafted path in the pkg parameter to pkgmgrinstall.php and allow 2 remote authenticated users to read arbitrary files via the downloadbackup parameter to...