Endian Firewall vulnerabilities

Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the NEW_PASSWORD_1 or NEW_PASSWORD_2 parameter to cgi-bin/chpasswd.cgi.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /manage/password/web/. An authenticated attacker can inject arbitrary JavaScript.

Endian Firewall version 3.3.25 and prior have a stored cross-site scripting (XSS) vulnerability via the new_cert_name parameter in /manage/ca/certificate/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /manage/vpnauthentication/user/. An authenticated attacker can inject arbitrary JavaScript that executes when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /manage/ipsec/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the REMARK parameter in /cgi-bin/openvpnclient.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /manage/dnsmasq/localdomains/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the ADDRESS BCC parameter in /cgi-bin/smtprouting.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the domain parameter in /manage/smtpscan/domainrouting/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the DOMAIN parameter in /cgi-bin/smtpdomains.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the group parameter in /cgi-bin/proxygroup.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior have a stored XSS vulnerability via the user parameter in /cgi-bin/proxyuser.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the mimetypes parameter in /cgi-bin/proxypolicy.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /cgi-bin/xtaccess.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /cgi-bin/vpnfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /cgi-bin/zonefw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/outgoingfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

In Endian Firewall version 3.3.25 and prior, a stored XSS vulnerability was found in the remark parameter in /cgi-bin/incoming.cgi. An authenticated attacker can inject JavaScript that executes when other users view the page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/snat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/dnat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the dscp parameter in /manage/qos/rules/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the name parameter in /manage/qos/classes/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark user ham spam parameter in /cgi-bin/salearn.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

In Endian Firewall version 3.3.25 and prior, a stored XSS vulnerability was found in the remark parameter in /manage/dhcp/fixed_leases/. An authenticated attacker can inject JavaScript that executes when other users view the page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the NAME parameter in /cgi-bin/uplinkeditor.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /manage/dnsmasq/hosts/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/routing.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

In Endian Firewall version 3.3.25 and prior, authenticated users can execute arbitrary OS commands via the DATE parameter in /cgi-bin/logs_smtp.cgi. The parameter value is used to construct a file path passed to a Perl open() call, allowing command injection due to incomplete regex validation.

Endian Firewall version 3.3.25 and earlier allows authenticated users to execute arbitrary OS commands via the DATE parameter in /cgi-bin/logs_openvpn.cgi. The parameter value is used to build a file path passed to Perl's open() function, enabling command injection due to incomplete regex validation.

Endian Firewall version 3.3.25 and earlier allows authenticated users to execute arbitrary OS commands via the DATE parameter in /cgi-bin/logs_log.cgi. The parameter value is used to build a file path passed to Perl's open() function, enabling command injection due to incomplete regex validation.

In Endian Firewall version 3.3.25 and prior, authenticated users can execute arbitrary OS commands via the DATE parameter in /cgi-bin/logs_ids.cgi. The parameter value is used to construct a file path passed to a Perl open() call, allowing command injection due to incomplete regex validation.

In Endian Firewall version 3.3.25 and prior, authenticated users can execute arbitrary OS commands via the DATE parameter in /cgi-bin/logs_firewall.cgi. The parameter value is used to construct a file path passed to a Perl open() call, allowing command injection due to incomplete regex validation.

In Endian Firewall version 3.3.25 and prior, authenticated users can execute arbitrary OS commands via the DATE parameter in /cgi-bin/logs_clamav.cgi. The parameter value is used to construct a file path passed to a Perl open() call, allowing command injection due to incomplete regex validation.