DeutschShown in its original language — a full translation is planned for a future version.
Netgate pfSense: Mehrere Schwachstellen
view advisory published 2025-09-09
Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Netgate pfSense ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und vertrauliche Informationen offenzulegen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-34178US | medium5.4 | — | ||
In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This c… | ||||
| CVE-2025-34177US | medium5.4 | — | ||
In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This c… | ||||
| CVE-2025-34176US | medium4.3 | — | ||
In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly use… | ||||
| CVE-2025-34175US | medium6.1 | — | ||
In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This… | ||||
| CVE-2025-34174US | medium5.4 | — | ||
In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings be… | ||||
| CVE-2025-34173US | medium4.3 | — | ||
In pfSense CE /usr/local/www/snort/snort_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related characters/strings before being used t… | ||||
| CVE-2025-34172US | medium6.1 | — | ||
In pfSense CE /usr/local/www/haproxy/haproxy_stats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable refle… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan