Known vulnerabilities in pfsense

Software: pfsense
Software CPE: cpe:2.3:a:rubicon_communications:pfsense:*:*:*:*:*:*:*:*
Total vulnerabilities: 24
Public exploits: 5
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting pfsense pfsense is affected by 24 known vulnerabilities: 2 high, 13 medium, 9 low Critical High Medium Low

Vulnerabilities (24)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU61367 - Improper input validation
CVE-2022-24299
CWE-20 Medium
No
No
2.6.0 15.03.2022 SB2022031507
#VU61366 - Improper Access Control
CVE-2022-26019
CWE-284 Low
No
No
2.6.0 15.03.2022 SB2022031507
#VU61365 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-20729
CWE-79 Low
No
No
2.6.0 15.03.2022 SB2022031506
#VU60833 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-41282
CWE-94 Medium
Available
No
2.6.0 23.02.2022 SB2022022310
#VU52720 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-27933
CWE-79 Low
No
No
2.5.1 28.04.2021 SB2021042835
#VU27508 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-10797
CWE-79 Low
No
No
2.4.5 04.05.2020 SB2020040745
#VU26657 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-11457
CWE-79 Medium
Available
No
2.4.5 07.04.2020 SB2020040745
#VU21376 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-12949
CWE-79 Low
No
No
- 27.09.2019 SB2019062525
#VU21375 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2019-16701
CWE-611 Medium
Available
No
- 27.09.2019 SB2019092524
#VU21374 - Improper input validation
CVE-2019-16915
CWE-20 Medium
No
No
2.4.5 27.09.2019 SB2019092701
#VU21373 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-16914
CWE-79 Low
No
No
2.4.5 27.09.2019 SB2019092701
#VU21372 - Cross-Site Request Forgery (CSRF)
CVE-2019-16667
CWE-352 Medium
Available
No
2.4.5 27.09.2019 SB2019092701
#VU35860 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-12584
CWE-79 Low
No
No
2.4.4 03.06.2019 SB2019060323
#VU35861 - Command injection
CVE-2019-12585
CWE-77 High
No
No
2.4.4 03.06.2019 SB2019060323
#VU35868 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-12347
CWE-79 Low
Available
No
- 29.05.2019 SB2018120317
#VU36084 - Security Features
CVE-2018-20798
CWE-254 Medium
No
No
- 01.03.2019 SB2018120317
#VU36085 - Improper input validation
CVE-2018-20799
CWE-20 Medium
No
No
- 01.03.2019 SB2018120317
#VU36341 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2018-4019
CWE-78 Medium
No
No
- 03.12.2018 SB2018120317
#VU36342 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2018-4020
CWE-78 Medium
No
No
- 03.12.2018 SB2018120317
#VU36343 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2018-4021
CWE-78 Medium
No
No
- 03.12.2018 SB2018120317


Showing elements 1 - 20 out of 24