William Costa

Name of the Vulnerable Software and Affected Versions: pfSense version 2.5.0 Description: The issue allows for stored Cross-Site Scripting (XSS) via the Description field in the services wol edit.php file. Recommendations: For pfSense version 2.5.0, update to a version that includes a fix for this issue to prevent exploitation.

A cross-site scripting (XSS) issue exists in the WebGUI, allowing remote attackers to inject arbitrary web script or HTML via the `zone` parameter in a del action to "services captiveportal zones.php" API endpoint.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `refr` parameter to "index.php".

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a crafted filename extension that is improperly handled during MIME sniffing of chat traffic. The vendor disputes the significance of this report, citing that the user must accept an interstitial warning before the HTML file content is rendered, and the HTML content's origin is a sandbox domain.

A cross-site request forgery (CSRF) issue exists in the gui/password-wadmin.apl component, allowing remote attackers to hijack the authentication of arbitrary users. This can be exploited by tricking a user into performing unintended actions on the web application.

A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `sortdir` parameter in the auth-settings-x.php file.

A cross-site scripting (XSS) issue allows remote authenticated administrators to inject arbitrary web script or HTML via the `new` parameter in the SysUser module to admin. This can be achieved by accessing specific API endpoints, although the exact endpoint is not specified.

A cross-site scripting (XSS) issue exists in the web administration interface, allowing remote attackers to inject arbitrary web script or HTML via the `locale` parameter to the "gui partA/" endpoint.

The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the `msg id` parameter in the "index.php" file.

The issue is related to a cross-site scripting vulnerability in the web interface of FortiOS, specifically in the "user/ldap user/add" endpoint. This vulnerability is caused by insufficient protection of the web page structure. It allows a remote attacker to inject arbitrary JavaScript or HTML code through the `filter` parameter.

The issue is caused by insufficient protection of the web page structure in the FortiOS operating system, specifically in the firewall/schedule/recurrdlg component. This allows a remote attacker to inject arbitrary JavaScript or HTML code through the `mkey` parameter, resulting in a cross-site scripting (XSS) vulnerability.

The issue is related to multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `txtSearch` parameter to various pages, including 'admin/hostdependencies.php' and 'admin/hosts.php', which utilize the search functionality in 'functions/content class.php'.