Поиск уязвимостей
Количество 3
Количество 3
CVE-2026-111218
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
GHSA-224g-fpr5-96gw
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.
BDU:2026-17514
Уязвимость функции delete_queue() программного межсетевого экрана Netgate pfSense, позволяющая нарушителю выполнить произвольный код
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root. | CVSS3: 7.2 | 9% Низкий | 24 дня назад |
| GHSA-224g-fpr5-96gw Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root. | CVSS3: 7.2 | 9% Низкий | 24 дня назад |
 | BDU:2026-17514 Уязвимость функции delete_queue() программного межсетевого экрана Netgate pfSense, позволяющая нарушителю выполнить произвольный код | CVSS3: 7.2 | 9% Низкий | 25 дней назад |
Уязвимостей на страницу