CVE-2023-6792

CVE-2023-6792 describes an OS command injection in the XML API of Palo Alto Networks PAN-OS. An authenticated API user can exploit the XML API to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall. Affected: PAN-OS (various versions prior to th...

CVE-2023-6792 PAN-OS: OS Command Injection Vulnerability in the XML API

An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall...

CVE-2023-6792 PAN-OS: OS Command Injection Vulnerability in the XML API

An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall...

CVE-2023-6790 PAN-OS: DOM-Based Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A DOM-Based cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an administrator’s browser when they view a specifically crafted link to the PAN-OS web interface...

CVE-2023-6790

CVE-2023-6790 is a DOM-based XSS in Palo Alto Networks PAN-OS web interface. It can allow a remote attacker to run JavaScript in an administrator’s browser when a user opens a specially crafted link. Affected PAN-OS versions are older releases; remediation guidance from Palo Alto and related advi...

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguis...

PAN-OS: XML API Keys Revoked by Read-Only PAN-OS Administrator

An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API keys from the firewall and disrupt XML API usage. Work around: This issue requires the attacker to have authenticated access to the PAN-OS...

CVE-2023-42495

Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...

CVE-2023-42495

Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...

Command injection

Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...

CVE-2023-42495 Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...

CVE-2023-42495

CVE-2023-42495 affects Dasan Networks – W-Web, versions 1.22–1.27. The issue is an OS command injection (CWE-78) caused by improper neutralization of special elements in command execution. Impact is high: remote code/process execution with network access, as reflected in the CVSS v3.1 base score ...

Palo Alto Networks PAN-OS Security Vulnerability

Palo Alto Networks PAN-OS is a next-generation firewall software from Palo Alto Networks, USA. A security vulnerability exists in Palo Alto Networks PAN-OS that stems from the presence of an arbitrary file upload vulnerability. The following products and versions are affected: Palo Alto Networks...

Palo Alto Networks PAN-OS Security Vulnerability

Palo Alto Networks PAN-OS is a next-generation firewall software from Palo Alto Networks, USA. A security vulnerability exists in Palo Alto Networks PAN-OS that stems from the presence of an operating system command injection vulnerability. Affected products and versions: Palo Alto Networks PAN-O...

Siemens SINEC INS Denial of Service Vulnerability (CNVD-2023-97252)

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in one tool. This simplifies the installation and management of all network services associated with industrial networks. A denial of service vulnerability exists in Siemens SINEC INS due t...

Palo Alto Networks PAN-OS 安全漏洞

Palo Alto Networks PAN-OS is a next-generation firewall software from Palo Alto Networks, USA. Palo Alto Networks PAN-OS suffers from a command injection vulnerability that stems from a failure to properly filter construct command special characters, commands, etc. in the XML API. An attacker cou...

Siemens SINEC INS Denial of Service Vulnerability (CNVD-2023-97253)

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in one tool. This simplifies the installation and management of all network services associated with industrial networks. A denial of service vulnerability exists in Siemens SINEC INS, whic...

Palo Alto Networks PAN-OS Security Vulnerability

Palo Alto Networks PAN-OS is a next-generation firewall software from Palo Alto Networks, USA. A security vulnerability exists in Palo Alto Networks PAN-OS that stems from the presence of a mismanagement of privileges vulnerability. An attacker could exploit the vulnerability to revoke XML API ke...

Siemens SINEC INS Certificate Validation Improperity Vulnerability

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in one tool. This simplifies the installation and management of all network services associated with industrial networks. Siemens SINEC INS suffers from a Certificate Validation Improperity...

PT-2023-28373 · Dasan Networks · W-Web

Name of the Vulnerable Software and Affected Versions: Dasan Networks - W-Web versions 1.22 through 1.27 Description: The issue is related to improper neutralization of special elements used in an OS command, also known as OS command injection. This is classified as CWE-78. Recommendations: For...