Palo Alto Networks PAN-OS 6.1.x < 6.1.11 Multiple Vulnerabilities

The version of Palo Alto Networks PAN-OS running on the remote host is 6.1.x 6.1.11. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists that allows an authenticated, remote attacker to access potentially sensitive information in the system logs. - A security...

Palo Alto Networks PAN-OS 7.0.x < 7.0.5 Multiple Vulnerabilities

The version of Palo Alto Networks PAN-OS running on the remote host is 7.0.x 7.0.5. It is, therefore, affected by multiple vulnerabilities : - A buffer overflow condition exists due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a deni...

Palo Alto Networks PAN-OS Management Interface API Remote DoS (PAN-SA-2016-0008)

The Palo Alto Networks PAN-OS running on the remote host is affected by a denial of service vulnerability in the API hosted on the management interface, specifically in the panUserLogin function within panmodule.so, due to improper validation of user-supplied input to the 'username' and 'password...

Palo Alto PAN-OS PAN-SA-2016-0009

A cross-site scripting vulnerability exists in the web interface whereby data provided by the user is echoed back to the user without sanitization. Ref 90635. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Update Server API Exposure

The Palo Alto Networks update server enables downloading of PAN-OS software releases and dynamic updates through a public API. Some functions of the API were inadvertently exposed to the public...

Cross-site scripting vulnerability

A cross-site scripting vulnerability exists in the web interface whereby data provided by the user is stored without sanitization. Ref 90635 CVE-2016-2219. This issue affects the management interface of the device, where an authenticated administrator may be tricked into injecting malicious...

Cross-site scripting vulnerability

A cross-site scripting vulnerability exists in the web interface whereby data provided by the user is stored without sanitization. Ref 90635 CVE-2016-2219. This issue affects the management interface of the device, where an authenticated administrator may be tricked into injecting malicious...

PAN-OS API denial of service

Palo Alto Networks firewalls offer an API to query and modify the configuration of the device. While access to this API is protected by the use of an API key, an issue was recently identified leading to a potential unauthenticated denial of service attack. Ref 91728 The API is hosted on a dedicat...

PT-2016-5071

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 7.0.1 through 7.0.7 Description A cross-site scripting issue exists in the management interface of the device, allowing remote authenticated users to inject arbitrary web script or HTML. This occurs because...

Palo Alto Networks PAN-OS 7.1.1 Out-of-Sequence Packet Firewall Bypass

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.1. It is, therefore, affected by an unspecified flaw when handling out-of-sequence packets. An unauthenticated, remote attacker can exploit this to bypass the firewall. C Tenable Network Security, Inc. include"compat.inc";...

Palo Alto Networks PAN-OS 7.0.7 Multiple Vulnerabilities

The version of Palo Alto Networks PAN-OS running on the remote host is 7.0.7. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the passive firewall where a VM-series ESXi configuration processes and forwards traffic. No other details are available. - An unspecified...

PT-2016-2291

Name of the Vulnerable Software and Affected Versions GNU wget versions prior to 1.18 PAN-OS versions prior to 6.1.17 PAN-OS versions prior to 7.0.15 PAN-OS versions prior to 7.1.10 PAN-OS versions prior to 8.0.1 Description The issue is related to errors in security settings, allowing remote...

Palo Alto PAN-OS Unauthenticated Buffer Overflow (PAN-SA-2016-0005) - Active Check

When a PAN-OS device is configured as a GlobalProtect portal, a vulnerability exists where an improper handling of a buffer involved in the processing of SSL VPN requests can result in device crash and possible remote code execution RCE. SPDX-FileCopyrightText: 2016 Greenbone AG Some text...

Palo Alto PAN-OS HTTP Header Evasion Vulnerability (PAN-SA-2016-0006)

An evasion was identified whereby a user could specially craft an HTTP header to evade URL filtering on Palo Alto Networks firewalls. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Palo Alto Networks PAN-OS HTTP Header Handling URL Filter Bypass (PAN-SA-2016-0006)

The Palo Alto Networks PAN-OS running on the remote host is version 5.0.x, 6.0.x, 6.1.x, 7.0.x, or 7.1.x prior to 7.1.1. It is, therefore, affected by a security bypass vulnerability in the URL filtering mechanism, which is triggered when handling a specially crafted HTTP header. An attacker can...

HTTP Header Evasion

An evasion was identified whereby a user could specially craft an HTTP header to evade URL filtering on Palo Alto Networks firewalls. Ref 93838 The HTTP header evasion technique can be used by a malicious insider to bypass URL filtering policy. It is not a product vulnerability that affects the...

CVE-2016-3656

The GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote attackers to cause a denial of service service crash via a crafted request...

CVE-2016-3656

The GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote attackers to cause a denial of service service crash via a crafted request...

CVE-2016-3657

Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to cause a denial of service device crash or possibly execute arbitrary code via an SSL VPN request...

CVE-2016-3655

The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call...