Netgate Pfsense vulnerabilities, page 3
51 vulnerabilities
Known vulnerabilities in Netgate Pfsense, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2019-16701netgatepfsense
EPSS score19.61%
pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value.CVE-2019-11816netgatepfsense+1EPSS score3.21%
Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request.CVE-2019-12347netgatepfsenseEPSS score58.58%
In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. The vulnerability occurs due to input validation errors.CVE-2019-12949netgatepfsenseEPSS score3.03%
In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diag_command.php and rrd_fetch_json.php (timePeriod parameter), to a server. Then, the remote attacker can run any command with root privileges on that server.CVE-2019-12585apcupsdapcupsd+1EPSS score5.03%
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php.CVE-2019-12584apcupsdapcupsd+1EPSS score2.56%
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php.CVE-2023-42327netgatepfsenseEPSS score55.36%
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page.CVE-2023-42326netgatepfsense+1EPSS score64.02%
An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components.CVE-2023-42325netgatepfsenseEPSS score57.92%
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page.CVE-2023-48123netgatepfsense+1EPSS score67.85%
An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file.CVE-2023-27253netgatepfsenseEPSS score89.50%
A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.