PT-2020-15219

Name of the Vulnerable Software and Affected Versions PAN-OS versions prior to 9.1.2 Description A NULL pointer dereference issue allows an authenticated administrator to send a request that causes the rasmgr daemon to crash, resulting in denial of service to all PAN-OS services by restarting the...

PT-2020-15229

Name of the Vulnerable Software and Affected Versions PAN-OS versions 7.1 PAN-OS versions 8.1 through 8.1.13 PAN-OS versions 9.0 through 9.0.6 Description An OS command injection vulnerability in the management server component of PAN-OS allows an authenticated user to potentially execute arbitra...

PT-2020-15220

Name of the Vulnerable Software and Affected Versions PAN-OS versions 7.1 PAN-OS versions 8.0 PAN-OS versions 8.1 through 8.1.13 PAN-OS versions 9.0 through 9.0.8 Description A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticate...

PT-2020-3480

Name of the Vulnerable Software and Affected Versions PAN-OS versions 7.1 through 8.1.13 PAN-OS versions 9.0 through 9.0.6 Description The issue is an OS command injection vulnerability in the PAN-OS management interface. This allows an authenticated administrator to execute arbitrary OS commands...

PT-2020-3484

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 7.1 earlier than 7.1.26 Palo Alto Networks PAN-OS versions 8.0 earlier than 8.0.14 Description An open redirection vulnerability in the GlobalProtect component allows an attacker to specify an arbitrary...

PT-2020-15232

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS Panorama versions 7.1 Palo Alto Networks PAN-OS Panorama versions 8.0 Palo Alto Networks PAN-OS Panorama versions 8.1 through 8.1.13 Palo Alto Networks PAN-OS Panorama versions 9.0 through 9.0.6 Palo Alto Networks...

PT-2020-3481

Name of the Vulnerable Software and Affected Versions PAN-OS for Panorama versions 7.1 through 8.0 PAN-OS for Panorama 8.1 versions prior to 8.1.13 PAN-OS for Panorama 9.0 versions prior to 9.0.7 Description The issue is related to an improper restriction of XML external entity reference 'XXE'...

PT-2020-15241

Name of the Vulnerable Software and Affected Versions PAN-OS versions prior to 7.1.26 PAN-OS versions prior to 8.1.13 PAN-OS versions prior to 9.0.7 PAN-OS versions prior to 9.1.1 PAN-OS 8.0 all versions Description A buffer overflow vulnerability in the PAN-OS management server allows...

PT-2020-3482

Name of the Vulnerable Software and Affected Versions PAN-OS versions 7.1 through 8.0 PAN-OS versions 8.1 through 8.1.12 PAN-OS versions 9.0 through 9.0.6 Description A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary syst...

PT-2020-15218

Name of the Vulnerable Software and Affected Versions PAN-OS versions 7.1 through 8.0 PAN-OS versions 8.1 through 8.1.13 PAN-OS versions 9.0 through 9.0.7 Description The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows sessi...

PT-2020-15230

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 7.1 through 8.0 Palo Alto Networks PAN-OS versions 8.1 through 8.1.13 Description An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated...

PT-2020-15228

Name of the Vulnerable Software and Affected Versions PAN-OS versions 7.1 through 8.1.13 PAN-OS version 8.0 Description A stack-based buffer overflow vulnerability in the management server component of PAN-OS allows an authenticated user to potentially execute arbitrary code with root privileges...

PT-2020-15233

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS Panorama versions prior to 7.1.26 Palo Alto Networks PAN-OS Panorama versions prior to 8.1.13 Palo Alto Networks PAN-OS Panorama versions prior to 9.0.6 Palo Alto Networks PAN-OS Panorama versions prior to 9.1.1 Palo...

CVE-2020-1996: Missing Authorization

A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the management server ms.log file. This vulnerability can be leveraged to obfuscate an ongoing attack or fabricate log entries in the ms.log fil...

CVE-2020-2014: Improper Neutralization of Special Elements used in an OS Command

An OS Command Injection vulnerability in PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7...

CVE-2020-2017: Improper Neutralization of Input During Web Page Generation

A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated administrator to click on a crafted link to PAN-OS and Panorama Web Interfaces could execute arbitrary JavaScript code in the administrator's...

CVE-2020-2015: Buffer Copy without Checking Size of Input

A buffer overflow vulnerability in the PAN-OS management server allows authenticated users to crash system processes or potentially execute arbitrary code with root privileges. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 version...

CVE-2020-1995: NULL Pointer Dereference

A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to send a request that causes the rasmgr daemon to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it...

CVE-2020-1994: Insecure Temporary File

A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integrity of the system. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions...

CVE-2020-1993: Session Fixation

The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. This issue affects: All PAN-OS 7.1 and 8.0 versions; PAN-OS 8.1 versions earlier than 8.1.1...