CVE-2020-2011

CVE-2020-2011 affects Palo Alto Networks PAN-OS Panorama: an improper input validation in the configuration daemon allows a remote unauthenticated user to send a crafted registration request that crashes the configuration service, causing DoS to all PAN-OS Panorama services and forcing a restart ...

CVE-2020-2003

The CVE-2020-2003 issue affects PAN-OS when an authenticated administrator can exploit an external control of filename vulnerability in the command processing to delete arbitrary system files, compromising integrity and causing DoS of PAN-OS services. Affected are PAN-OS 7.1.x and 8.0.x; 8.1.x be...

CVE-2020-2006 PAN-OS: Buffer overflow in management server payload parser

A stack-based buffer overflow vulnerability in the management server component of PAN-OS that allows an authenticated user to potentially execute arbitrary code with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14...

CVE-2020-2015 PAN-OS: Buffer overflow in the management server

A buffer overflow vulnerability in the PAN-OS management server allows authenticated users to crash system processes or potentially execute arbitrary code with root privileges. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 version...

CVE-2020-1998 PAN-OS: Improper SAML SSO authorization of shared local users

An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the account when the username is shared for the purposes of SSO authentication. This can result in authentication bypass and unintended resource...

CVE-2020-2012 PAN-OS: Panorama: XML external entity reference ('XXE') vulnerability leads the to information leak

Improper restriction of XML external entity reference 'XXE' vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system. This issue affects: All versions of...

CVE-2020-2001 PAN-OS: Panorama External control of file vulnerability leads to privilege escalation

An external control of path and data vulnerability in the Palo Alto Networks PAN-OS Panorama XSLT processing logic that allows an unauthenticated user with network access to PAN-OS management interface to write attacker supplied file on the system and elevate privileges. This issue affects: All...

CVE-2020-2007 PAN-OS: OS command injection in management server

An OS command injection vulnerability in the management server component of PAN-OS allows an authenticated user to potentially execute arbitrary commands with root privileges. This issue affects: All PAN-OS 7.1 versions; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than...

CVE-2020-2006

CVE-2020-2006 is a stack-based buffer overflow in PAN-OS management server. An authenticated user could potentially execute arbitrary code with root privileges. Affected: PAN-OS 7.1.x and 8.0.x; PAN-OS 8.1.x prior to 8.1.14. The issue is documented across multiple sources, including Palo Alto Net...

CVE-2020-2005 PAN-OS: GlobalProtect Clientless VPN session hijacking

A cross-site scripting XSS vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active session. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0...

CVE-2020-2001

CVE-2020-2001 affects Palo Alto Networks PAN-OS Panorama XSLT processing logic, where an external control of path and data allows an unauthenticated user with network access to PAN-OS management to write attacker-supplied files and escalate privileges. Affected versions include PAN-OS Panorama: a...

CVE-2020-2008

CVE-2020-2008 affects Palo Alto Networks PAN-OS across versions: PAN-OS 7.1 and 8.0, and 8.1 prior to 8.1.14. The vulnerability is an OS command injection and external control of filename in the management interface, allowing authenticated administrators to run code with root privileges or delete...

CVE-2020-2007

CVE-2020-2007 is an OS command injection vulnerability in PAN-OS management server. An authenticated user can potentially execute arbitrary commands with root privileges. Affected: PAN-OS 7.1 (all 7.1.x), PAN-OS 8.1.x before 8.1.14, and PAN-OS 9.0.x before 9.0.7. No additional exploit details or ...

CVE-2020-2005

CVE-2020-2005 affects Palo Alto Networks PAN-OS GlobalProtect Clientless VPN, with an XSS vulnerability that can compromise a user’s active session when visiting malicious sites. Affected: PAN-OS 7.1.x (<7.1.26), 8.0.x (<8.1.13), 8.1.x (<8.1.13), and 9.0.x (

CVE-2020-2016

CVE-2020-2016 is a local privilege-escalation issue in PAN-OS caused by a race condition from insecure temporary-file creation. Affected: PAN-OS 7.1.x before 7.1.26; 8.0.x before 8.1.13; 8.1.x before 8.1.13; 9.0.x before 9.0.6; all PAN-OS 8.0. The underlying vulnerability enables escalation from ...

CVE-2020-2014 PAN-OS: OS injection vulnerability in PAN-OS management server

An OS Command Injection vulnerability in PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7...

CVE-2020-2016 PAN-OS: Temporary file race condition vulnerability in PAN-OS leads to local privilege escalation

A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account. This allows an attacker who has escaped the restricted shell as a low privilege administrator, possibly by exploiting anothe...

CVE-2020-2010

CVE-2020-2010 describes an OS command injection in PAN-OS management interface that allows an authenticated administrator to execute commands with root privileges. Affected: PAN-OS 7.1 and 8.0 all; PAN-OS 8.1 before 8.1.14; PAN-OS 9.0 before 9.0.7. Connected sources indicate remediation toward fi...

CVE-2020-2017 PAN-OS: DOM-Based cross site scripting vulnerability in management web interface

A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated administrator to click on a crafted link to PAN-OS and Panorama Web Interfaces could execute arbitrary JavaScript code in the administrator's...

CVE-2020-2014

CVE-2020-2014 : PAN-OS contains an OS command injection vulnerability in the management server. Authenticated users can inject and execute arbitrary shell commands with root privileges. Affected: PAN-OS 7.1 and 8.0; PAN-OS 8.1 before 8.1.14; PAN-OS 9.0 before 9.0.7. References indicate a fix/patc...