Latest pfsense pfsense Vulnerabilities

● CVE-2023-42326

An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components.

Netgate pfSense<=2.7.0

Netgate pfSense Plus<=23.05.1

pfSense pfSense=2.7.0

pfSense pfSense Plus=23.05.01

● CVE-2023-42325

Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page.

Netgate pfSense=2.7.0

pfSense pfSense=2.7.0

pfSense pfSense Plus=23.05.01

● CVE-2023-42327

Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page.

Netgate pfSense=2.7.0

pfSense pfSense=2.7.0

pfSense pfSense Plus=23.05.01

● CVE-2023-29975

An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification.

pfSense pfSense=2.6.0

● CVE-2023-29974

An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.

pfSense pfSense=2.6.0

● CVE-2023-29973

Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall.

pfSense pfSense=2.6.0

● CVE-2020-19678

Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter to suricata/suricata...

Oisf Suricata=1.4.6

pfSense pfSense=2.1.3

Pfsense Suricata Package=1.0.1

● CVE-2023-27100

Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force prot...

Netgate pfSense Plus=22.05.1

pfSense pfSense=2.6.0

● CVE-2022-42247

pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a cra...

pfSense pfSense=2.5.2

● CVE-2021-20729

Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a remote attacker to inj...

Netgate pfSense Plus<=21.05

pfSense pfSense<=2.5.2

● CVE-2021-41282

diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netsta...

pfSense pfSense=2.5.2

● CVE-2022-23993

/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS.

pfSense pfSense<2.6.0

pfSense pfSense Plus<22.01

● CVE-2020-26693

A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbitrary web scripts via exploitation of the load_balancer_monit...

pfSense pfSense=2.4.5-p1

● CVE-2021-27933

pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field.

pfSense pfSense=2.5.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.