Show filters
20 Total Results
Displaying 11-20 of 20
Sort by:
Attacker Value
Unknown
CVE-2023-39001
Disclosure Date: August 09, 2023 (last updated October 10, 2023)
A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file.
0
Attacker Value
Unknown
CVE-2023-39000
Disclosure Date: August 09, 2023 (last updated October 10, 2023)
A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path.
0
Attacker Value
Unknown
CVE-2023-38999
Disclosure Date: August 09, 2023 (last updated October 10, 2023)
A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
0
Attacker Value
Unknown
CVE-2023-38998
Disclosure Date: August 09, 2023 (last updated October 10, 2023)
An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL.
0
Attacker Value
Unknown
CVE-2023-38997
Disclosure Date: August 09, 2023 (last updated February 23, 2024)
A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands as root via a crafted ZIP archive.
0
Attacker Value
Unknown
CVE-2021-42770
Disclosure Date: November 08, 2021 (last updated February 23, 2025)
A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester.
0
Attacker Value
Unknown
CVE-2020-23015
Disclosure Date: May 03, 2021 (last updated February 22, 2025)
An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not filtered and can redirect user to any website.
0
Attacker Value
Unknown
CVE-2018-18958
Disclosure Date: June 17, 2019 (last updated November 27, 2024)
OPNsense 18.7.x before 18.7.7 has Incorrect Access Control.
0
Attacker Value
Unknown
CVE-2019-11816
Disclosure Date: May 20, 2019 (last updated November 27, 2024)
Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request.
0
Attacker Value
Unknown
CVE-2017-1000479
Disclosure Date: January 03, 2018 (last updated November 26, 2024)
pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed in 2.4.2-RELEASE. OPNsense, a 2015 fork of pfSense, was not vulnerable since version 16.1.16 released on June 06, 2016. The unprotected web form was removed from the code during an internal security audit under "possibly insecure" suspicions.
0
