Vulnerabilities > Netgate

DATE CVE VULNERABILITY TITLE RISK
2023-03-17 CVE-2023-27253 XML Injection (aka Blind XPath Injection) vulnerability in Netgate Pfsense 2.7.0
A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.
network
low complexity
netgate CWE-91
8.8
2023-02-22 CVE-2022-29273 Cross-site Scripting vulnerability in Netgate Pfsense
pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.
network
low complexity
netgate CWE-79
6.1
2022-12-15 CVE-2020-21219 Cross-site Scripting vulnerability in Netgate Acme and Pfsense
Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code via the RootFolder field to acme_certificate_edit.php page of the ACME package.
network
low complexity
netgate CWE-79
6.1
2022-09-05 CVE-2022-31814 Unspecified vulnerability in Netgate Pfblockerng 2.1.426
pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header.
network
low complexity
netgate
critical
9.8
2022-03-31 CVE-2021-20729 Cross-site Scripting vulnerability in multiple products
Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a remote attacker to inject an arbitrary script via a malicious URL.
4.3
2022-03-31 CVE-2022-24299 Improper Input Validation vulnerability in Netgate Pfsense and Pfsense Plus
Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command.
network
low complexity
netgate CWE-20
6.5
2022-03-31 CVE-2022-26019 Unspecified vulnerability in Netgate Pfsense and Pfsense Plus
Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result in arbitrary command execution.
network
netgate
8.5
2021-07-12 CVE-2020-19201 Cross-site Scripting vulnerability in Netgate Pfsense
A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.4-p2 and earlier.
network
netgate CWE-79
3.5
2021-07-12 CVE-2020-19203 Cross-site Scripting vulnerability in Netgate Pfsense
An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense software WebGUI, on version 2.4.4-p2 and earlier.
network
netgate CWE-79
3.5
2020-04-29 CVE-2020-10797 Cross-site Scripting vulnerability in Netgate Pfsense
An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version.
network
netgate CWE-79
4.3