CVE-2019-25368

This vulnerability allows attackers to run malicious JavaScript in the web browser of users who are logged into the OPNsense system, potentially stealing their session cookies or other sensitive information. It requires the attacker to send specially crafted requests to a specific part of the system while the user is authenticated.

This vulnerability allows attackers to run malicious scripts in the browsers of users visiting the OPNsense web interface, potentially stealing sensitive information or performing actions on behalf of the user. To exploit this, attackers need to send specially crafted requests to the system without needing to log in.

This vulnerability allows attackers to inject harmful scripts into users' browsers by sending specially crafted requests to the mailserver parameter on the OPNsense interface. It requires no authentication, meaning anyone can exploit it if they know how to send the right type of request.

This vulnerability allows attackers to inject harmful scripts into users' browsers by exploiting a specific parameter in OPNsense's VPN settings. To succeed, the attacker needs to send specially crafted requests that include malicious JavaScript, which can then execute unwanted actions on the user's device when they access the affected page.

This vulnerability allows an attacker to inject harmful scripts that can run in the web browsers of other users who view certain firewall rule pages. To exploit this, the attacker must be authenticated and can send specially crafted data through a specific form field.