Opnsense: Security Vulnerabilities
A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score
6.1
EPSS Score
0.012
Published
2023-08-09
OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp.
CVSS Score
7.5
EPSS Score
0.006
Published
2023-08-09
A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester.
CVSS Score
6.1
EPSS Score
0.013
Published
2021-11-08
An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not filtered and can redirect user to any website.
CVSS Score
6.1
EPSS Score
0.027
Published
2021-05-03
OPNsense 18.7.x before 18.7.7 has Incorrect Access Control.
CVSS Score
6.5
EPSS Score
0.006
Published
2019-06-17
Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request.
CVSS Score
7.2
EPSS Score
0.033
Published
2019-05-20
Page 4