Netgate

Pfsense

53 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.8

CVE-2015-2295

Exploit
  • EPSS 37.75%
  • Veröffentlicht 10.04.2015 15:00:03
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the del...

4.3

CVE-2015-2294

Exploit
  • EPSS 1.3%
  • Veröffentlicht 01.04.2015 14:59:02
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) zone parameter to status_captiveportal.php; (2) if or (3) dragtable parameter to firew...

7.8

CVE-2015-1414

  • EPSS 0.89%
  • Veröffentlicht 27.02.2015 15:59:00
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of...

5.8

CVE-2014-4696

  • EPSS 0.05%
  • Veröffentlicht 02.07.2014 10:35:26
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple open redirect vulnerabilities in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the referer parameter to suricata_rules_flowbit...

5.8

CVE-2014-4695

  • EPSS 0.05%
  • Veröffentlicht 02.07.2014 10:35:26
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple open redirect vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the referer parameter to snort_rules_flowbits.php...

4.3

CVE-2014-4694

  • EPSS 0.06%
  • Veröffentlicht 02.07.2014 10:35:26
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in suricata_select_alias.php in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via unspecified variables.

4.3

CVE-2014-4693

  • EPSS 0.06%
  • Veröffentlicht 02.07.2014 10:35:26
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the eng parameter to snort_import_aliases.php or (2) unspecified va...

4.3

CVE-2014-4692

  • EPSS 0.07%
  • Veröffentlicht 02.07.2014 10:35:26
  • Zuletzt bearbeitet 12.04.2025 10:46:40

pfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

4.3

CVE-2014-4687

  • EPSS 0.09%
  • Veröffentlicht 02.07.2014 10:35:25
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the starttime0 parameter to firewall_schedule.php, (2) the rssfeed parameter to rss.widget.php, (3) the ...

6.8

CVE-2014-4691

  • EPSS 0.12%
  • Veröffentlicht 02.07.2014 10:35:25
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Session fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web sessions via a firewall login cookie.