CVE-2018-9335

CVE-2018-9335 is a Cross-Site Scripting (XSS) vulnerability in the PAN-OS session browser. Affected PAN-OS versions include 6.1.20 and earlier, 7.1.16 and earlier, 8.0.9 and earlier, and 8.1.1 and earlier. Exploitation requires authentication and could allow an attacker to inject arbitrary JavaSc...

CVE-2018-9242

CVE-2018-9242 affects Palo Alto Networks PAN-OS: the management web interface on PAN-OS 6.1.x up to 6.1.20, 7.1.x up to 7.1.16, and 8.0.x up to 8.0.9 is vulnerable. The issue arises from improper validation of certain request parameters, which can allow an attacker to delete files in the system. ...

CVE-2018-9337

CVE-2018-9337 is an XSS vulnerability in the PAN-OS Web interface administration page. Affected PAN-OS: 6.1.20 and earlier; 7.1.17 and earlier; 8.0.10 and earlier; 8.1.1 and earlier. The issue allows an attacker to inject arbitrary JavaScript or HTML via the web interface. Exploitation requires p...

CVE-2018-9334

CVE-2018-9334 affects Palo Alto Networks PAN-OS management web interface. Multiple sources confirm a local privilege/escalation-style information disclosure allowing an authenticated attacker to access local user password hashes by manipulating HTML markup. Affected releases include PAN-OS 6.1.20...

Information Disclosure in the PAN-OS Management Web Interface

A local privilege escalation vulnerability exists in the PAN-OS management web interface that allows the administrator to access the password hashes of local users by manipulating the HTML markup. Ref. PAN-91564; CVE-2018-9334 Successful exploitation of this issue requires the attacker to be...

Information Disclosure in the PAN-OS Management Web Interface

A local privilege escalation vulnerability exists in the PAN-OS management web interface that allows the administrator to access the password hashes of local users by manipulating the HTML markup. Ref. PAN-91564; CVE-2018-9334 Successful exploitation of this issue requires the attacker to be...

Cross-Site Scripting (XSS) in PAN-OS Management Web Interface

A Cross-Site Scripting XSS vulnerability exists in the PAN-OS session browser. Ref. PAN-93244; CVE-2018-9335 Successful exploitation of this issue may allow an attacker to inject arbitrary JavaScript or HTML. An attacker would need to successfully authenticate prior to exploiting this issue. This...

Cross-Site Scripting (XSS) in PAN-OS Management Web Interface

A Cross-Site Scripting XSS vulnerability exists in a PAN-OS web interface administration page. Ref. PAN-93242; CVE-2018-9337 Successful exploitation of this issue may allow an attacker to inject arbitrary JavaScript or HTML An attacker would need to successfully authenticate prior to exploiting...

Cross-Site Scripting (XSS) in PAN-OS Management Web Interface

A Cross-Site Scripting XSS vulnerability exists in a PAN-OS web interface administration page. Ref. PAN-93242; CVE-2018-9337 Successful exploitation of this issue may allow an attacker to inject arbitrary JavaScript or HTML An attacker would need to successfully authenticate prior to exploiting...

Cross-Site Scripting (XSS) in PAN-OS Management Web Interface

A Cross-Site Scripting XSS vulnerability exists in the PAN-OS session browser. Ref. PAN-93244; CVE-2018-9335 Successful exploitation of this issue may allow an attacker to inject arbitrary JavaScript or HTML. An attacker would need to successfully authenticate prior to exploiting this issue. This...

Local Privilege Escalation in Management Web Interface

A vulnerability exists in the Management web interface that could allow local privilege escalation. The Management web interface does not properly validate specific request parameters, which can potentially allow deletion of files in the system. Ref. PAN-90954; CVE-2018-9242 Successful exploitati...

Local Privilege Escalation in Management Web Interface

A vulnerability exists in the Management web interface that could allow local privilege escalation. The Management web interface does not properly validate specific request parameters, which can potentially allow deletion of files in the system. Ref. PAN-90954; CVE-2018-9242 Successful exploitati...

Cross Site Scripting in PAN-OS

A Cross-Site Scripting XSS vulnerability exists in the PAN-OS URL filtering “continue page” Ref PAN-OS 90835, CVE-2018-7636. PAN-OS software does not properly validate specific request parameters. Successful exploitation of this issue may allow an attacker to inject arbitrary JavaScript or HTML i...

Cross Site Scripting in PAN-OS

A Cross-Site Scripting XSS vulnerability exists in the PAN-OS URL filtering “continue page” Ref PAN-OS 90835, CVE-2018-7636. PAN-OS software does not properly validate specific request parameters. Successful exploitation of this issue may allow an attacker to inject arbitrary JavaScript or HTML i...

PT-2018-1834 · Palo Alto Networks +9 · Pan-Os +12

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 3.9 and later PAN-OS versions prior to 6.1.22 PAN-OS versions prior to 7.1.20 PAN-OS versions prior to 8.0.13 PAN-OS versions prior to 8.1.5 Arista EOS affected versions not specified vEOS affected versions not specified...

Palo Alto Networks - readSessionVarsFromFile() Session Corruption Exploit

This Metasploit module exploits a chain of vulnerabilities in Palo Alto Networks products running PAN-OS versions prior to 6.1.19, 7.0.19, 7.1.14, and 8.0.6. This chain starts by using an authentication bypass flaw to to exploit an XML injection issue, which is then abused to create an arbitrary...

Palo Alto Networks - 'readSessionVarsFromFile()' Session Corruption (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Palo Alto Networks readSessionVarsFromFile Session Corruption', 'Description' = %q This module exploits a chain of vulnerabilities in Palo Alto...

Palo Alto Networks readSessionVarsFromFile() Session Corruption

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Palo Alto Networks readSessionVarsFromFile Session Corruption', 'Description' = %q This module exploits a chain of vulnerabilities in Palo Alto...

Palo Alto Networks PAN-OS 7.1.x < 7.1.15 / 8.0.x < 8.0.7 Multiple Vulnerabilities (ROBOT)

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 7.1.15 or 8.0.x prior to 8.0.7. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid106143; scriptversion"1.8";...

CVE-2017-15941

Cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.7, when the GlobalProtect gateway or portal is configured, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...