2.7.0

DATE	CVE	VULNERABILITY TITLE	RISK
2023-12-06	CVE-2023-48123	Unspecified vulnerability in Netgate Pfsense and Pfsense Plus An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file. network low complexity netgate	8.8
2023-11-14	CVE-2023-42326	Command Injection vulnerability in Netgate Pfsense and Pfsense Plus An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components. network low complexity netgate CWE-77	8.8
2023-11-14	CVE-2023-42325	Cross-site Scripting vulnerability in Netgate Pfsense 2.7.0 Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page. network low complexity netgate CWE-79	5.4
2023-11-14	CVE-2023-42327	Cross-site Scripting vulnerability in Netgate Pfsense 2.7.0 Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page. network low complexity netgate CWE-79	5.4
2023-03-17	CVE-2023-27253	XML Injection (aka Blind XPath Injection) vulnerability in Netgate Pfsense 2.7.0 A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml. network low complexity netgate CWE-91	8.8