PT-2024-8350 · Palo Alto Networks · Pan-Os

Palo Alto Networks PAN-OS software is affected by a cross-site scripting XSS issue, which allows an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator, who can perform restrict...

PT-2024-8343 · Palo Alto Networks · Pan-Os

Name of the Vulnerable Software and Affected Versions: PAN-OS affected versions not specified Description: The issue is related to a null pointer dereference vulnerability in the PAN-OS software, which enables an unauthenticated attacker to stop a core system service on the firewall by sending a...

Palo Alto Advises Securing PAN-OS Interface Amid Potential RCE Threat Concerns

Palo Alto Networks on Friday issued an informational advisory urging customers to ensure that access to the PAN-OS management interface is secured because of a potential remote code execution vulnerability. "Palo Alto Networks is aware of a claim of a remote code execution vulnerability via the...

CVE-2024-9471

A privilege escalation PE vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator. For example, an administrator with...

CVE-2024-9464

An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls...

CVE-2024-9464

An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls...

CVE-2024-9468

A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service DoS condition. Repeated attempts to trigger this condition will result in PAN-OS entering...

CVE-2024-9463

An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls...

CVE-2024-9471 PAN-OS: Privilege Escalation (PE) Vulnerability in XML API

A privilege escalation PE vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator. For example, an administrator with...

CVE-2024-9471 PAN-OS: Privilege Escalation (PE) Vulnerability in XML API

A privilege escalation PE vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator. For example, an administrator with...

CVE-2024-9471

CVE-2024-9471 affects Palo Alto Networks PAN-OS XML API. An authenticated administrator with restricted privileges can use a compromised XML API key to perform actions as a higher-privileged administrator (e.g., a read-only virtual-system admin could write changes). The issue arises from privileg...

CVE-2024-9468 PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet

A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service DoS condition. Repeated attempts to trigger this condition will result in PAN-OS entering...

CVE-2024-9468 PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet

A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service DoS condition. Repeated attempts to trigger this condition will result in PAN-OS entering...

CVE-2024-9468

CVE-2024-9468 is a memory corruption vulnerability in Palo Alto Networks PAN-OS that allows an unauthenticated attacker to crash PAN-OS via a crafted data-plane packet, causing a denial-of-service and maintenance-mode state. Affected: PAN-OS software (data plane handling). Root cause: memory corr...

CVE-2024-9464 Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure

An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls...

CVE-2024-9464

CVE-2024-9464 affects Palo Alto Networks Expedition: an authenticated OS command injection in Expedition allows an attacker with valid credentials to run arbitrary OS commands as root, risking disclosure of usernames, cleartext passwords, device configurations, and API keys. Affected are Expediti...

CVE-2024-9464 Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure

An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls...

CVE-2024-9463 Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls...

CVE-2024-9463 Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls...

PAN-OS: Privilege Escalation (PE) Vulnerability in XML API

A privilege escalation PE vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator beyond what the XML API permits. Wo...