CVE-2018-9335

The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML...

CVE-2018-9337

The PAN-OS web interface administration page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML...

CVE-2018-9242

CVE-2018-9242 affects Palo Alto Networks PAN-OS: the management web interface on PAN-OS 6.1.x up to 6.1.20, 7.1.x up to 7.1.16, and 8.0.x up to 8.0.9 is vulnerable. The issue arises from improper validation of certain request parameters, which can allow an attacker to delete files in the system. ...

CVE-2018-9334

CVE-2018-9334 affects Palo Alto Networks PAN-OS management web interface. Multiple sources confirm a local privilege/escalation-style information disclosure allowing an authenticated attacker to access local user password hashes by manipulating HTML markup. Affected releases include PAN-OS 6.1.20...

CVE-2018-9335

CVE-2018-9335 is a Cross-Site Scripting (XSS) vulnerability in the PAN-OS session browser. Affected PAN-OS versions include 6.1.20 and earlier, 7.1.16 and earlier, 8.0.9 and earlier, and 8.1.1 and earlier. Exploitation requires authentication and could allow an attacker to inject arbitrary JavaSc...

CVE-2018-7636

PAN-OS 8.0.10 and earlier are affected by CVE-2018-7636 — a Cross-Site Scripting flaw in the URL filtering “continue page” that allows injection of arbitrary JavaScript/HTML via crafted URLs. The issue affects PAN-OS 8.0.x (and not 8.1.x/7.1.x/6.1.x as stated in advisories) and is addressed by ve...

CVE-2018-7636

The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScript or HTML via specially crafted URLs...

CVE-2018-7636: Improper Neutralization of Input During Web Page Generation

The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScript or HTML via specially crafted URLs...

CVE-2018-9335: Improper Neutralization of Input During Web Page Generation

The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML...

CVE-2018-9337: Improper Neutralization of Input During Web Page Generation

The PAN-OS web interface administration page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML...

CVE-2018-9334: Improper Privilege Management

The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.8 and earlier, and PAN-OS 8.1.0 may allow an attacker to access the GlobalProtect password hashes of local users via manipulation of the HTML markup...

CVE-2018-9242: Improper Input Validation

The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete files in the system via specific request parameters...

Information Disclosure in the PAN-OS Management Web Interface

A local privilege escalation vulnerability exists in the PAN-OS management web interface that allows the administrator to access the password hashes of local users by manipulating the HTML markup. Ref. PAN-91564; CVE-2018-9334 Successful exploitation of this issue requires the attacker to be...

Cross-Site Scripting (XSS) in PAN-OS Management Web Interface

A Cross-Site Scripting XSS vulnerability exists in the PAN-OS session browser. Ref. PAN-93244; CVE-2018-9335 Successful exploitation of this issue may allow an attacker to inject arbitrary JavaScript or HTML. An attacker would need to successfully authenticate prior to exploiting this issue. This...

PT-2018-18989

Name of the Vulnerable Software and Affected Versions PAN-OS versions 6.1.20 and earlier PAN-OS versions 7.1.16 and earlier PAN-OS versions 8.0.8 and earlier PAN-OS version 8.1.0 Description The issue allows an attacker to access the GlobalProtect password hashes of local users via manipulation o...

PT-2018-18992

Name of the Vulnerable Software and Affected Versions PAN-OS versions 6.1.20 and earlier PAN-OS versions 7.1.17 and earlier PAN-OS versions 8.0.10 and earlier PAN-OS versions 8.1.1 and earlier Description A Cross-Site Scripting XSS issue exists in the PAN-OS web interface administration page,...

PT-2018-18990

Name of the Vulnerable Software and Affected Versions PAN-OS versions 6.1.20 and earlier PAN-OS versions 7.1.16 and earlier PAN-OS versions 8.0.9 and earlier PAN-OS versions 8.1.1 and earlier Description A Cross-Site Scripting XSS issue exists in the PAN-OS session browser, allowing an attacker t...

PT-2018-18925

Name of the Vulnerable Software and Affected Versions PAN-OS versions 6.1.20 and earlier PAN-OS versions 7.1.16 and earlier PAN-OS versions 8.0.9 and earlier Description A vulnerability in the Management web interface may allow an attacker to delete files in the system via specific request...

Local Privilege Escalation in Management Web Interface

A vulnerability exists in the Management web interface that could allow local privilege escalation. The Management web interface does not properly validate specific request parameters, which can potentially allow deletion of files in the system. Ref. PAN-90954; CVE-2018-9242 Successful exploitati...

Cross-Site Scripting (XSS) in PAN-OS Management Web Interface

A Cross-Site Scripting XSS vulnerability exists in a PAN-OS web interface administration page. Ref. PAN-93242; CVE-2018-9337 Successful exploitation of this issue may allow an attacker to inject arbitrary JavaScript or HTML An attacker would need to successfully authenticate prior to exploiting...