EUVD-2020-22065

An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the...

CVE-2020-2040

CVE-2020-2040 is a PAN-OS buffer overflow in the Captive Portal or MFA interface that can be exploited by an unauthenticated remote attacker to disrupt system processes and potentially execute code with root privileges. Affected PAN-OS versions: all 8.0; 8.1 prior to 8.1.15; 9.0 prior to 9.0.9; 9...

CVE-2020-2039

CVE-2020-2039 affects PAN-OS management web interface across multiple releases (8.1 < 8.1.16; 9.0 < 9.0.10; 9.1 < 9.1.4; 10.0

CVE-2020-2039 PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload

An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the...

CVE-2020-2038

CVE-2020-2038 is an OS command injection in the PAN-OS management interface that authenticated administrators can abuse to execute root commands. Affected versions include PAN-OS 9.0.x before 9.0.10, 9.1.x before 9.1.4, and 10.0.x before 10.0.1. Public exploitation tooling exists: a Metasploit mo...

CVE-2020-2037 PAN-OS: OS command injection vulnerability in the management web interface

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1...

CVE-2020-2038 PAN-OS: OS command injection vulnerability in the management web interface

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlie...

CVE-2020-2037

CVE-2020-2037 is an OS command injection in PAN-OS management Web Interface. The vulnerability affects PAN-OS versions before: 8.1.16, 9.0.x before 9.0.10, and 9.1.x before 9.1.3. It requires authenticated administrative access to the management interface and can allow execution of arbitrary OS c...

CVE-2020-2036 PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface

A reflected cross-site scripting XSS vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could...

CVE-2020-2036

CVE-2020-2036 is a reflected XSS vulnerability in the PAN-OS management web interface. Existence requires an administrator with an active authenticated session to click a crafted link, which could cause arbitrary JavaScript to run in the admin’s browser and potentially perform administrative acti...

PAN-OS: Passwords may be logged in clear text when using after-change-detail custom syslog field for config logs

An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-OS software when the after-change-detail custom syslog field is enabled for configuration logs and the sensitive field appears multiple tim...

PAN-OS: Passwords may be logged in clear text while storing operational command (op command) history

An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using the CLI in Palo Alto Networks PAN-OS software. The opcmdhistory.log file was introduced to track operational command op-command usage but...

PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface

A reflected cross-site scripting XSS vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could...

PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled

A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue impacts: All versions of...

PAN-OS: OS command injection vulnerability in the management web interface

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlie...

PAN-OS: Buffer overflow in the management web interface

A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue impacts only PAN-OS 10.0 versions earlier than PAN-OS 10.0.1. Work around: This issue...

PAN-OS: OS command injection vulnerability in the management web interface

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1...

PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload

An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the...

PAN-OS: Management web interface denial-of-service (DoS)

An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically crafted request to the device that causes the appweb service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS...

PT-2020-3957

Name of the Vulnerable Software and Affected Versions: PAN-OS versions 8.0 PAN-OS 8.1 versions earlier than 8.1.15 PAN-OS 9.0 versions earlier than 9.0.9 PAN-OS 9.1 versions earlier than 9.1.3 Description: A buffer overflow vulnerability in PAN-OS is related to the lack of size checking for input...