Skip to content

Netgate Pfsense vulnerabilities

netgate pfsenseNetgate pfSense Community Edition 2.4.4 - p2 (arm64) is affected by: Cross Site Scripting (XSS)....CVE-2020-192035.4 MediumJuly 12, 2021
netgate pfsenseAn XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2...CVE-2020-107976.1 MediumApril 29, 2020
netgate pfsensepfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the...CVE-2020-11457Public exploit5.4 MediumApril 1, 2020
netgate pfsensediag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as...CVE-2019-16667Public exploitEPSS 54.5%8.8 HighSeptember 26, 2019
netgate pfsenseAn XSS issue was discovered in pfSense through 2.4.4-p3. In services_captiveportal_mac.php, the...CVE-2019-169146.1 MediumSeptember 26, 2019
netgate pfsenseAn issue was discovered in pfSense through 2.4.4-p3. widgets/widgets/picture.widget.php uses the...CVE-2019-169159.8 CriticalSeptember 26, 2019
netgate pfsensepfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document...CVE-2019-16701Public exploitEPSS 19.6%8.8 HighSeptember 25, 2019
netgate pfsenseIn pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into...CVE-2019-12949Public exploit6.1 MediumJune 25, 2019
apcupsd, netgate pfsense +1 moreApcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an...CVE-2019-125859.8 CriticalJune 3, 2019
apcupsd, netgate pfsense +1 moreApcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS...CVE-2019-125846.1 MediumJune 3, 2019
netgate pfsenseIn pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the...CVE-2019-12347Public exploitEPSS 58.6%6.1 MediumMay 29, 2019
netgate pfsense, opnsense +1 moreIncorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4...CVE-2019-118167.2 HighMay 20, 2019
netgate pfsenseIn pfSense 2.4.4_1, blocking of source IP addresses on the basis of failed HTTPS authentication...CVE-2018-207997.5 HighMarch 1, 2019
netgate pfsenseThe expiretable configuration in pfSense 2.4.4_1 establishes block durations that are...CVE-2018-207987.5 HighMarch 1, 2019
netgate pfsenseAn exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE...CVE-2018-4021EPSS 70.3%7.2 HighDecember 3, 2018
netgate pfsenseAn exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE...CVE-2018-4020EPSS 48.7%7.2 HighDecember 3, 2018
netgate pfsenseAn exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE...CVE-2018-4019EPSS 48.7%7.2 HighDecember 3, 2018
netgate pfsenseAn authenticated command injection vulnerability exists in status_interfaces.php via...CVE-2018-16055EPSS 11.2%8.8 HighSeptember 26, 2018
netgate pfsense, opnsense project opnsense +1 morepfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page...CVE-2017-1000479Public exploitEPSS 31.7%8.8 HighJanuary 3, 2018
netgate pfsenseCross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to...CVE-2015-65114.3 MediumAugust 18, 2015
netgate pfsenseMultiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote...CVE-2015-65104.3 MediumAugust 18, 2015
netgate pfsenseMultiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote...CVE-2015-65094.3 MediumAugust 18, 2015
netgate pfsenseCross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to...CVE-2015-65084.3 MediumAugust 18, 2015
netgate pfsenseCross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote...CVE-2015-4029EPSS 20.4%4.3 MediumAugust 18, 2015
netgate pfsenseCross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the...CVE-2015-2295Public exploitEPSS 65.7%6.8 MediumApril 10, 2015
netgate pfsenseMultiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow...CVE-2015-2294EPSS 24.0%4.3 MediumApril 1, 2015
freebsd, debian linux, netgate pfsense +2 moreInteger overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before...CVE-2015-1414Fix available7.8 HighFebruary 25, 2015
netgate pfsense, pfsense suricata package +1 moreMultiple open redirect vulnerabilities in the Suricata package before 1.0.6 for pfSense through 2...CVE-2014-46965.8 MediumJuly 2, 2014
netgate pfsense, pfsense snort package +1 moreMultiple open redirect vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1...CVE-2014-46955.8 MediumJuly 2, 2014
netgate pfsense, pfsense suricata package +1 moreMultiple cross-site scripting (XSS) vulnerabilities in suricata_select_alias.php in the Suricata...CVE-2014-46944.3 MediumJuly 2, 2014
netgate pfsense, pfsense snort package +1 moreMultiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for...CVE-2014-46934.3 MediumJuly 2, 2014
netgate pfsensepfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie...CVE-2014-46924.3 MediumJuly 2, 2014
netgate pfsenseSession fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web...CVE-2014-46916.8 MediumJuly 2, 2014
netgate pfsenseMultiple directory traversal vulnerabilities in pfSense before 2.1.4 allow (1) remote attackers...CVE-2014-46905.0 MediumJuly 2, 2014
netgate pfsenseAbsolute path traversal vulnerability in pkg_edit.php in pfSense before 2.1.4 allows remote...CVE-2014-46895.0 MediumJuly 2, 2014
netgate pfsensepfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the...CVE-2014-4688Public exploit6.5 MediumJuly 2, 2014
netgate pfsenseMultiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.1.4 allow remote...CVE-2014-46874.3 MediumJuly 2, 2014