18936 matches found
CVE-2017-13314
In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missing permission check. This could lead to local escalation of privilege allowing users to access non-VPN networks, when they are supposed to be restricted to the VPN networks, with...
CVE-2017-13314
In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missing permission check. This could lead to local escalation of privilege allowing users to access non-VPN networks, when they are supposed to be restricted to the VPN networks, with...
CVE-2017-13314
In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missing permission check. This could lead to local escalation of privilege allowing users to access non-VPN networks, when they are supposed to be restricted to the VPN networks, with...
Zero-Day Exploitation Targeting Palo Alto Networks Firewall Management Interfaces
On Friday, November 8, 2024, cybersecurity firm Palo Alto Networks PAN published a bulletin PAN-SA-2024-0015 advising firewall customers to take steps to secure their firewall management interfaces amid unverified rumors of a possible new vulnerability. Rapid7 threat intelligence teams have also...
Researchers Warn of Privilege Escalation Risks in Google's Vertex AI ML Platform
Cybersecurity researchers have disclosed two security flaws in Google's Vertex machine learning ML platform that, if successfully exploited, could allow malicious actors to escalate privileges and exfiltrate models from the cloud. "By exploiting custom job permissions, we were able to escalate ou...
Palo Alto Networks Emphasizes Hardening Guidance
Updated November 15, 2024 Palo Alto Networks PAN has updated their informational bulletin, noting they "observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall management interfaces which are exposed to the Internet." CISA...
Ivanti Endpoint Manager Path Traversal Vulnerability (CNVD-2025-28686)
Ivanti Endpoint Manager is a comprehensive endpoint management solution developed by Ivanti to unify the management of all types of devices in an enterprise network, including Windows, macOS, Linux, ChromeOS, mobile devices and IoT devices. A path traversal vulnerability exists in Ivanti Endpoint...
The vulnerability of the network management system for monitoring industrial networks in Siemens SINEC NMS, related to insufficient privilege separation, allows a intruder to execute arbitrary commands.
The vulnerability of the Siemens SINEC NMS network management system for monitoring industrial networks is related to insufficient privilege separation. Exploiting this vulnerability could allow a attacker to execute arbitrary commands...
The vulnerability of the software for monitoring and analyzing network traffic in industrial networks, SINEC Traffic Analyzer, is related to deficiencies in access control. This vulnerability allows a intruder to gain unauthorized access to protected information.
The vulnerability of the SINEC Traffic Analyzer software for monitoring and analyzing network traffic in industrial networks is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
Palo Alto Networks PAN-OS 10.1.x < 10.1.14 / 10.2.x < 10.2.4-h6 / 11.0.x < 11.0.5 Vulnerability
The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.14 or 10.2.x prior to 10.2.4-h6 or 11.0.x prior to 11.0.5. It is, therefore, affected by a vulnerability. A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an...
CISA and FBI: Chinese Hackers Compromised US Telecom Networks
The CISA and FBI have issued an advisory detailing a sophisticated cyberespionage campaign by state-sponsored Chinese hackers that…...
Vulnerabilities fixed in Palo Alto PAN OS
Palo Alto Networks has fixed vulnerabilities in PAN-OS. A malicious party can exploit the vulnerabilities to bypass security measures to route traffic to and through the system that is not initially authorized, or cause a denial-of-service. Palo Alto has released updates to address the...
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-9463link is external Palo Alto Networks Expedition OS Command Injection Vulnerability CVE-2024-9465link is external Palo Alto Networks Expedition SQL Injection...
CVE-2024-5919
A blind XML External Entities XXE injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface...
CVE-2024-5919
A blind XML External Entities XXE injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface...
CVE-2024-9472
A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when Decryption policy is enabled allows an unauthenticated attacker to crash PAN-OS by sending specific traffic through the data plane, resulti...
CVE-2024-5918
An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate to connect to an impacted GlobalProtect portal or GlobalProtect gateway as a different legitimate user. This attack is possible only if you...
CVE-2024-2552
A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall...
CVE-2024-2551
A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewall by sending a crafted packet through the data plane that causes a denial of service DoS condition. Repeated attempts to trigger this...