CVE-2020-2013

CVE-2020-2013 concerns a cleartext transmission vulnerability in Palo Alto Networks PAN-OS Panorama where an authenticated administrator’s PAN-OS session cookie is exposed when performing a context switch to a managed firewall. Technical details in connected documents show affected versions: PAN-...

CVE-2020-2011

CVE-2020-2011 affects Palo Alto Networks PAN-OS Panorama: an improper input validation in the configuration daemon allows a remote unauthenticated user to send a crafted registration request that crashes the configuration service, causing DoS to all PAN-OS Panorama services and forcing a restart ...

CVE-2020-2001

CVE-2020-2001 affects Palo Alto Networks PAN-OS Panorama XSLT processing logic, where an external control of path and data allows an unauthenticated user with network access to PAN-OS management to write attacker-supplied files and escalate privileges. Affected versions include PAN-OS Panorama: a...

CVE-2020-2009

CVE-2020-2009 concerns Palo Alto Networks PAN-OS Panorama SD WAN: an authenticated administrator can trigger external control of a filename vulnerability that creates/writes arbitrary files on all managed firewalls, potentially enabling arbitrary code execution with root privileges. Affected are ...

CVE-2020-2017

CVE-2020-2017 describes a DOM-based cross-site scripting vulnerability in PAN-OS/Panorama management web interfaces. A remote attacker can trick an authenticated administrator into clicking a crafted link, potentially executing arbitrary JavaScript in the admin’s browser and performing administra...

CVE-2020-1997

The CVE-2020-1997 issue is an open redirection in Palo Alto Networks PAN-OS GlobalProtect. Affected products are PAN-OS 7.1.x before 7.1.26 and 8.0.x before 8.0.14. The vulnerability allows an attacker to specify an arbitrary redirection target away from the trusted GlobalProtect gateway; when a ...

CVE-2020-2015

CVE-2020-2015 describes a buffer overflow in the PAN-OS management server. Authenticated users can crash processes or potentially execute arbitrary code with root privileges. Affected are PAN-OS 7.1.x before 7.1.26; PAN-OS 8.0.x (all); PAN-OS 8.1.x before 8.1.13; PAN-OS 9.0.x before 9.0.7; PAN-OS...

CVE-2020-2008 PAN-OS: OS command injection or arbitrary file deletion vulnerability

An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated administrators to execute code with root privileges or delete arbitrary system files and impact the system's integrity or cause a denial of service condition. This issue affect...

CVE-2020-2008

CVE-2020-2008 affects Palo Alto Networks PAN-OS across versions: PAN-OS 7.1 and 8.0, and 8.1 prior to 8.1.14. The vulnerability is an OS command injection and external control of filename in the management interface, allowing authenticated administrators to run code with root privileges or delete...

CVE-2020-2003 PAN-OS: Authenticated administrator can delete arbitrary system file

An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator to delete arbitrary system files affecting the integrity of the system or causing denial of service to all PAN-OS services. This issue affects: All versions of PAN-OS 7.1 and 8....

CVE-2020-2002

The CVE-2020-2002 entry affects Palo Alto Networks PAN-OS with an authentication bypass by spoofing the Kerberos KDC, enabling a MITM attacker to log in as an administrator by not verifying KDC integrity. Public sources in the connected documents specify affected PAN-OS versions: 7.1.x prior to 7...

CVE-2020-1993 PAN-OS: GlobalProtect Portal PHP session fixation vulnerability

The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. This issue affects: All PAN-OS 7.1 and 8.0 versions; PAN-OS 8.1 versions earlier than 8.1.1...

CVE-2020-1995 PAN-OS: Management server rasmgr denial of service

A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to send a request that causes the rasmgr daemon to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it...

CVE-2020-1996 PAN-OS: Panorama management server log injection

A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the management server ms.log file. This vulnerability can be leveraged to obfuscate an ongoing attack or fabricate log entries in the ms.log fil...

CVE-2020-1993

CVE-2020-1993 affects PAN-OS GlobalProtect Portal. The vulnerability stems from not issuing a new session identifier after a successful login, enabling session fixation if an attacker controls a user’s session ID. Affected versions include PAN-OS 7.1 and 8.0, PAN-OS 8.1 prior to 8.1.14, and PAN-O...

CVE-2020-1996

CVE-2020-1996 affects PAN-OS Panorama management server: a missing authorization vulnerability allows remote unauthenticated injection of messages into the ms.log file. Affected versions: PAN-OS 7.1 and 8.0; PAN-OS 8.1 before 8.1.14; PAN-OS 9.0 before 9.0.9. Impacts/log manipulation, potentially ...

CVE-2020-1994

The connected advisories confirm CVE-2020-1994 in PAN-OS: a predictable temporary file vulnerability exploitable by a local authenticated user with shell access, allowing corruption of arbitrary system files and compromising integrity. Affected: PAN-OS 7.1 and 8.0; PAN-OS 8.1 prior to 8.1.13; PAN...

CVE-2020-1994 PAN-OS: Predictable temporary file vulnerability

A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integrity of the system. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions...

CVE-2020-1995

CVE-2020-1995 affects Palo Alto Networks PAN-OS 9.1.x before 9.1.2. Description: a NULL pointer dereference in the rasmgr daemon allows an authenticated administrator to trigger a crash by sending a crafted request, leading to DoS of PAN-OS services as the device reboots into maintenance mode. Im...

PAN-OS: OS command injection or arbitrary file deletion vulnerability

An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated administrators to execute code with root privileges or delete arbitrary system files and impact the system's integrity or cause a denial of service condition. This issue affect...