Vulnerabilities

TI-2011-03591 CVE-2011-4069 · GHSA-wc4g-x5vw-8v9q

html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP…

MEDIUM 45

html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted username.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01555 Published 2018-02-01 No fix listed CWE-90

TI-2011-03590 CVE-2011-4068 · GHSA-f9q6-6w4m-g923

The check_password function in html/admin/login.php in PacketFence before 3.0.2 allows…

MEDIUM 45

The check_password function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01514 Published 2018-02-01 No fix listed CWE-287

TI-2012-04035 CVE-2012-4742 · GHSA-5j42-43m8-5xcg

The web_node_register function in web.pm in PacketFence before 3.0.2 might allow remote…

LOW 38

The web_node_register function in web.pm in PacketFence before 3.0.2 might allow remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02727 Published 2012-08-31 No fix listed

TI-2012-04034 CVE-2012-4741 · GHSA-r267-cj3p-f63m

The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used…

LOW 26

The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used for authentication for users with custom VLAN assignment extensions, which allows remote attackers to spoof user identities via the…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01382 Published 2012-08-31 No fix listed CWE-287

TI-2012-04033 CVE-2012-4740 · GHSA-jq58-6p8v-r4h8

Cross-site scripting (XSS) vulnerability in the captive portal in PacketFence before…

LOW 22

Cross-site scripting (XSS) vulnerability in the captive portal in PacketFence before 3.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01161 Published 2012-08-31 No fix listed CWE-79