Multiple Cross-Site Scripting (XSS) vulnerabilities were found in the pfSense
WebGUI on pfSense 2.2.6 and earlier versions.
On system_gateway_groups_edit.php, a gateway Description ("descr") was being
printed without encoding, leading to a potential stored XSS.
Multiple limiter parameters referenced on firewall_shaper_vinterface.php on
pfSense 2.2.6 and earlier were printed without encoding when rejected by input
validation, leading to a reflected XSS. The redesigned GUI used on pfSense 2.3
is not affected.
The "container" parameter referenced on firewall_shaper_layer7.php on pfSense
2.2.6 and earleir was printed without encoding when rejected by input
validation, leading to a reflected XSS. The Layer 7 feature is deprecated and
had already been removed from the master branch (2.3), thus it is not affected.
Due to the lack of proper encoding on the affected variables and pages,
session cookie or other information from the session may be compromised.