1965 matches found
Cross site scripting
A reflected cross-site scripting XSS vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could...
Denial of service
An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the...
Command injection
An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using the CLI in Palo Alto Networks PAN-OS software. The opcmdhistory.log file was introduced to track operational command op-command usage but...
Buffer overflow
A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue impacts only PAN-OS 10.0 versions earlier than PAN-OS 10.0.1...
Cross site request forgery (csrf)
An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically crafted request to the device that causes the appweb service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS...
Buffer overflow
A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue impacts: All versions of...
Command injection
An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1...
Command injection
An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlie...
CVE-2020-2044
CVE-2020-2044 is an information-exposure issue in PAN-OS where an administrator password or other sensitive data can be logged in cleartext in opcmdhistory.log. Affected PAN-OS versions: 8.1.x before 8.1.16; 9.0.x before 9.0.10; 9.1.x before 9.1.3. The log file design change moves command history...
CVE-2020-2044 PAN-OS: Passwords may be logged in clear text while storing operational command (op command) history
An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using the CLI in Palo Alto Networks PAN-OS software. The opcmdhistory.log file was introduced to track operational command op-command usage but...
CVE-2020-2043 PAN-OS: Passwords may be logged in clear text when using after-change-detail custom syslog field for config logs
An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-OS software when the after-change-detail custom syslog field is enabled for configuration logs and the sensitive field appears multiple tim...
CVE-2020-2043
CVE-2020-2043: PAN-OS information exposure in configuration logs when the after-change-detail custom syslog field is enabled. The first occurrence of the sensitive field is masked, but subsequent instances are exposed in clear text. Affected: PAN-OS 8.1.x before 8.1.16; 9.0.x before 9.0.10; 9.1.x...
CVE-2020-2041 PAN-OS: Management web interface denial-of-service (DoS)
An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically crafted request to the device that causes the appweb service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS...
CVE-2020-2041
CVE-2020-2041 describes a denial-of-service condition in Palo Alto Networks PAN-OS caused by an insecure configuration of the appweb daemon . The vulnerability allows a remote, unauthenticated actor to send a crafted request that crashes the appweb service, leading to a restart of PAN-OS services...
CVE-2020-2042
PAN-OS CVE-2020-2042 is a buffer overflow in the PAN-OS management web interface that affects PAN-OS 10.0.x prior to 10.0.1. Exploitation requires authenticated administrator access and could disrupt system processes or execute arbitrary code with root privileges. Affected versions are PAN-OS 10....
CVE-2020-2042 PAN-OS: Buffer overflow in the management web interface
A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue impacts only PAN-OS 10.0 versions earlier than PAN-OS 10.0.1...
CVE-2020-2039 PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload
An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the...
CVE-2020-2040 PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled
A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue impacts: All versions of...
CVE-2020-2040
CVE-2020-2040 is a PAN-OS buffer overflow in the Captive Portal or MFA interface that can be exploited by an unauthenticated remote attacker to disrupt system processes and potentially execute code with root privileges. Affected PAN-OS versions: all 8.0; 8.1 prior to 8.1.15; 9.0 prior to 9.0.9; 9...