CVE-2024-54779

Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to Cross Site Scripting (XSS) in the widgets/log.widget.php file. The root cause is a lack of security measures protecting the website structure, specifically involving the widgetkey variable , which cou...

CVE-2024-57273

Netgate pfSense CE (prior to 2.8.0 beta) and corresponding Plus builds are vulnerable to a Cross-site scripting (XSS) flaw in the Automatic Configuration Backup (ACB) service. The vulnerability is caused by an unsanitized "reason" field and a derivable device key generated from a public SSH key. ...

CVE-2024-54780

Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget. The root cause is the improper sanitization of user-supplied input sent to the OpenVPN management interface. An authenticated attacker can exploit this by inje...