Netgate

Pfsense

53 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.8

CVE-2015-2295

Exploit
  • EPSS 37.75%
  • Published 10.04.2015 15:00:03
  • Last modified 12.04.2025 10:46:40

Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the del...

4.3

CVE-2015-2294

Exploit
  • EPSS 1.3%
  • Published 01.04.2015 14:59:02
  • Last modified 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) zone parameter to status_captiveportal.php; (2) if or (3) dragtable parameter to firew...

7.8

CVE-2015-1414

  • EPSS 0.89%
  • Published 27.02.2015 15:59:00
  • Last modified 12.04.2025 10:46:40

Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of...

5.8

CVE-2014-4696

  • EPSS 0.05%
  • Published 02.07.2014 10:35:26
  • Last modified 12.04.2025 10:46:40

Multiple open redirect vulnerabilities in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the referer parameter to suricata_rules_flowbit...

5.8

CVE-2014-4695

  • EPSS 0.05%
  • Published 02.07.2014 10:35:26
  • Last modified 12.04.2025 10:46:40

Multiple open redirect vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the referer parameter to snort_rules_flowbits.php...

4.3

CVE-2014-4694

  • EPSS 0.06%
  • Published 02.07.2014 10:35:26
  • Last modified 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in suricata_select_alias.php in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via unspecified variables.

4.3

CVE-2014-4693

  • EPSS 0.06%
  • Published 02.07.2014 10:35:26
  • Last modified 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the eng parameter to snort_import_aliases.php or (2) unspecified va...

4.3

CVE-2014-4692

  • EPSS 0.07%
  • Published 02.07.2014 10:35:26
  • Last modified 12.04.2025 10:46:40

pfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

4.3

CVE-2014-4687

  • EPSS 0.09%
  • Published 02.07.2014 10:35:25
  • Last modified 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the starttime0 parameter to firewall_schedule.php, (2) the rssfeed parameter to rss.widget.php, (3) the ...

6.8

CVE-2014-4691

  • EPSS 0.12%
  • Published 02.07.2014 10:35:25
  • Last modified 12.04.2025 10:46:40

Session fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web sessions via a firewall login cookie.