https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:13:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337084 EUVD-2026-337084 https://cve.radiocsirt.org/vuln/euvd-2026-337084 https://cve.radiocsirt.org/vuln/fkie_cve-2025-34176 <p>In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enables an attacker to enumerate files on the target. The attacker must be authenticated with at least &#34;WebCfg - Services: suricata package&#34; permissions.</p> <p>In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enables an attacker to enumerate files on the target. The attacker must be authenticated with at least &#34;WebCfg - Services: suricata package&#34; permissions.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-34176 https://cve.radiocsirt.org/vuln/ghsa-4fgr-95mh-x7h2 <p>In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enables an attacker to enumerate files on the target. The attacker must be authenticated with at least &#34;WebCfg - Services: suricata package&#34; permissions.</p> <p>In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enables an attacker to enumerate files on the target. The attacker must be authenticated with at least &#34;WebCfg - Services: suricata package&#34; permissions.</p> https://cve.radiocsirt.org/vuln/ghsa-4fgr-95mh-x7h2 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2016 <p>Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Netgate pfSense ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und vertrauliche Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Netgate pfSense ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2016