Information about L1 Terminal Fault findings

Palo Alto Networks is aware of recent vulnerability disclosures, known as L1 Terminal Fault, that affect modern CPU architectures. At this time, our findings show that these vulnerabilities pose no increased risk to Palo Alto Networks PAN-OS devices. CVE-2018-3615, CVE-2018-3620, and CVE-2018-364...

Information about L1 Terminal Fault findings

Palo Alto Networks is aware of recent vulnerability disclosures, known as L1 Terminal Fault, that affect modern CPU architectures. At this time, our findings show that these vulnerabilities pose no increased risk to Palo Alto Networks PAN-OS devices. CVE-2018-3615, CVE-2018-3620, and CVE-2017-364...

CVE-2018-10139

The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected...

Code injection

The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected...

Code injection

The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected...

CVE-2018-10139

The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected...

CVE-2018-10140

The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected...

CVE-2018-10139

The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected...

CVE-2018-10140

The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected...

CVE-2018-10139

CVE-2018-10139 affects Palo Alto Networks PAN-OS GlobalProtect Gateway. Documents indicate an unauthenticated attacker could inject arbitrary JavaScript/HTML via the GlobalProtect Gateway response. Affected ranges include PAN-OS 6.1.21 and earlier, 7.1.18 and earlier, and 8.0.11 and earlier; PAN-...

CVE-2018-10140

CVE-2018-10140 affects PAN-OS PAN-OS Management Web Interface. The issue is a Denial of Service where an authenticated user can cause all management sessions to shut down and be redirected to login. Affected: PAN-OS 8.1.2 and earlier. Not affected: PAN-OS 6.1, 7.1, and 8.0. The threat is triggere...

CVE-2018-10139: Improper Neutralization of Input During Web Page Generation

The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected...

CVE-2018-10140: Improper Input Validation

The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected...

Cross-Site Scripting (XSS) in GlobalProtect Gateway

A Cross-Site Scripting XSS vulnerability exists in a PAN-OS response for GlobalProtect Gateway. Ref. PAN-84836; CVE-2018-10139 Successful exploitation of this issue may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. This issue affects PAN-OS 6.1.21 and earlier, PAN-OS...

Denial of Service in PAN-OS Management Web Interface

A Denial of Service exists in PAN-OS Management Web Interface that allows an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. Ref PAN-100189, CVE-2018-10140 This vulnerability can be triggered by an authenticated user...

Cross-Site Scripting (XSS) in GlobalProtect Gateway

A Cross-Site Scripting XSS vulnerability exists in a PAN-OS response for GlobalProtect Gateway. Ref. PAN-84836; CVE-2018-10139 Successful exploitation of this issue may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. This issue affects PAN-OS 6.1.21 and earlier, PAN-OS...

Denial of Service in PAN-OS Management Web Interface

A Denial of Service exists in PAN-OS Management Web Interface that allows an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. Ref PAN-100189, CVE-2018-10140 This vulnerability can be triggered by an authenticated user...

PT-2018-1700

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 8.1.2 and earlier Description The issue is related to insufficient input validation in the PAN-OS Management Web Interface, which can be exploited by an authenticated user to shut down all management sessions...

PT-2018-1699

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 6.1.21 and earlier Palo Alto Networks PAN-OS versions 7.1.18 and earlier Palo Alto Networks PAN-OS versions 8.0.11 and earlier Description The issue is caused by insufficient protection of the web page...

PT-2018-1756

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions prior to 8.1.4 Description The issue is related to insufficient protection of the web page structure in the GlobalProtect Portal Login page, allowing an unauthenticated attacker to inject arbitrary JavaScript...