Palo Alto Networks PAN-OS < 4.1.13 / 5.0.x < 5.0.6 XSS

The remote host is running a version of Palo Alto Networks PAN-OS prior to 4.1.13 / 5.0.6. It is, therefore, affected by a cross-site scripting vulnerability due to a failure to sanitize user-supplied input to the device management API browser. C Tenable Network Security, Inc. include"compat.inc"...

Cross-site Scripting Vulnerability

A cross-site scripting vulnerability exists in the web-based device management interface whereby data provided by the user is echoed back to the user without sanitization. Ref 59010 This issue affects the management interface of the device, requiring a malicious administrator to upload malicious...

Management API Key Bypass

An XML API key can be bypassed if a session has been authorized. This can be used in a CSRF or XSS attack. Ref 58976 This issue requires an authenticated administrator session to be successful. This issue affects PAN-OS version 4.1.15 and earlier; 5.0.9 and earlier; 5.1.4 and earlier. Work around...

Palo Alto Networks PAN-OS拒绝服务及多个安全措施绕过漏洞

BUGTRAQ ID: 64627 PAN-OS用于控制 Palo Alto Networks 新一代防火墙的作业系统，它提供丰富的防火墙、管理及网路的功能。 Palo Alto Networks PAN-OS 5.0.9版本在实现上存在多个安全漏洞，成功利用后可使攻击者绕过某些安全限制或造成拒绝服务。 0 Palo Alto Network PAN-OS 5.0.9 Palo Alto Network PAN-OS 厂商补丁： Palo Alto Network ----------------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Palo Alto Networks PAN-OS Firewall/Panorama Web UI Detection

Binary data paloaltowebuidetect.nbin...

Palo Alto Networks Pan-OS 5.0.8 - Multiple Vulnerabilities

Exploit for php platform in category web applications A couple of bugs exist in Palo Alto Networks PANOS These issues have been fixed in PANOS 5.0.9 . Example html source code to CSRF POST a rogue cert : 1. PA: 2. 3. 4. 5. 6. ----------------------------- 7. Content-Disposition: form-data;...

Palo Alto Networks Pan-OS 5.0.8 - Multiple Vulnerabilities

from http://thomaspollet.blogspot.be/2013/11/Palo-Alto-XSS.html : A couple of bugs exist in Palo Alto Networks PANOS These issues have been fixed in PANOS 5.0.9 . Example html source code to CSRF POST a rogue cert : 1. PA: 2. 3. 4. 5. 6. ----------------------------- 7. Content-Disposition:...

22 years-old Chartered Accountant student hacks into Celebrities E-taxation Accounts

Last week a 21-year-old chartered accountant student from Hyderabad was arrested for hacking into E-taxation Account of Industrialist Anil Ambani. During the probe Mumbai Police's crime branch has emerged that Anil Ambani's account was also fraudulently accessed from Noida. After investigation,...

CVE-2012-6595

The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 34595...

CVE-2012-6591

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 31116...

CVE-2012-6598

The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 33080...

CVE-2013-5664

Cross-site scripting XSS vulnerability in the web-based device-management API browser in Palo Alto Networks PAN-OS before 4.1.13 and 5.0.x before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via crafted data, aka Ref ID 50908...

CVE-2012-6597

Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to cause a denial of service management-server crash by using the command-line interface for a crafted command, aka Ref ID 35254...

CVE-2012-6600

The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 34502...

CVE-2012-6602

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.4 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 30122...

CVE-2012-6603

The web management UI in Palo Alto Networks PAN-OS before 3.1.12, 4.0.x before 4.0.10, and 4.1.x before 4.1.4 allows remote attackers to bypass authentication and obtain administrator privileges via unspecified vectors, aka Ref ID 37034...

CVE-2012-6604

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Ref ID 35249...

CVE-2012-6605

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Ref ID 34896...

CVE-2013-5663

The App-ID cache feature in Palo Alto Networks PAN-OS before 4.0.14, 4.1.x before 4.1.11, and 5.0.x before 5.0.2 allows remote attackers to bypass intended security policies via crafted requests that trigger invalid caching, as demonstrated by incorrect identification of HTTP traffic as SIP...

CVE-2012-6594

The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11, 4.0.x before 4.0.8, and 4.1.x before 4.1.1 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 34299...