Pfsense vulnerabilities, page 3
49 vulnerabilities
Known vulnerabilities in Pfsense products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 8 products.
CVE-2022-24299netgatepfsense+2
EPSS score1.93%
Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command.CVE-2022-23993pfsensepfsense+1EPSS score1.53%
/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS.CVE-2011-4197pfsensepfsenseEPSS score1.92%
etc/inc/certs.inc in the PKI implementation in pfSense before 2.0.1 creates each X.509 certificate with a true value for the CA basic constraint, which allows remote attackers to create sub-certificates for arbitrary subjects by leveraging the private key.CVE-2011-5047pfsensepfsenseEPSS score1.09%
Cross-site scripting (XSS) vulnerability in status_rrd_graph.php in pfSense before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the style parameter.CVE-2019-18667pfsensepfsense-pkg-freeradius3EPSS score4.00%
/usr/local/www/freeradius_view_config.php in the freeradius3 package before 0.15.7_3 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser.CVE-2023-29974pfsensepfsenseEPSS score1.75%
An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.CVE-2023-29973pfsensepfsenseEPSS score1.63%
Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall.CVE-2023-29975pfsensepfsenseEPSS score1.68%
An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification.CVE-2023-27100netgatepfsense_plus+1EPSS score9.84%
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.