Buffer overflow

Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to cause a denial of service device crash or possibly execute arbitrary code via an SSL VPN request...

Design/Logic Flaw

The device management command line interface CLI in Palo Alto Networks PAN-OS before 5.0.18, 5.1.x before 5.1.11, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote authenticated administrators to execute arbitrary OS commands via an SSH command parameter...

Design/Logic Flaw

The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call...

Cross site request forgery (csrf)

The GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote attackers to cause a denial of service service crash via a crafted request...

CVE-2016-3656

The GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote attackers to cause a denial of service service crash via a crafted request...

CVE-2016-3655

The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call...

CVE-2016-3656

CVE-2016-3656 affects Palo Alto Networks PAN-OS GlobalProtect Portal. A remote attacker can cause a denial-of-service (service crash) via a crafted request. Affected PAN-OS versions include 5.0.x prior to 5.0.18, 6.0.x prior to 6.0.13, 6.1.x prior to 6.1.10, and 7.0.x prior to 7.0.5H2. The issue ...

CVE-2016-3655

The CVE corresponds to an unauthenticated remote command-injection vulnerability in the PAN-OS management Web API. Affected PAN-OS releases: 5.0.x before 5.0.18; 6.0.x before 6.0.13; 6.1.x before 6.1.10; and 7.0.x before 7.0.5. The issue allows an attacker with network access to the device manage...

CVE-2016-3654

The CVE concerns PAN-OS device management CLI parsing of an SSH command parameter, allowing authenticated administrators to run arbitrary OS commands with root privileges. Affected PAN-OS versions: 5.0.x before 5.0.18; 5.1.x before 5.1.11; 6.0.x before 6.0.13; 6.1.x before 6.1.10; 7.0.x before 7....

CVE-2016-3654

The device management command line interface CLI in Palo Alto Networks PAN-OS before 5.0.18, 5.1.x before 5.1.11, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote authenticated administrators to execute arbitrary OS commands via an SSH command parameter...

CVE-2016-3657

CVE-2016-3657 describes an unauthenticated buffer overflow in the GlobalProtect SSL VPN web portal of Palo Alto Networks PAN-OS. Public details indicate that improper handling of a buffer during SSL VPN request processing can crash the device and may allow remote code execution. Affected PAN-OS v...

CVE-2016-3655: Improper Input Validation

The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call...

CVE-2016-3654: Improper Input Validation

The device management command line interface CLI in Palo Alto Networks PAN-OS before 5.0.18, 5.1.x before 5.1.11, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote authenticated administrators to execute arbitrary OS commands via an SSH command parameter...

CVE-2016-3656: Improper Restriction of Operations within the Bounds of a Memory Buffer

The GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote attackers to cause a denial of service service crash via a crafted request...

CVE-2016-3657: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to cause a denial of service device crash or possibly execute arbitrary code via an SSL VPN request...

Palo Alto Networks PAN-OS GlobalProtect Web Portal RCE (PAN-SA-2016-0005)

The Palo Alto Networks PAN-OS running on the remote host is affected by a remote code execution vulnerability in the GlobalProtect web portal due to improper validation of user-supplied input when handling SSL VPN requests. An unauthenticated, remote attacker can exploit this, via a crafted...

Palo Alto PAN-OS PAN-SA-2016-0004

When a PAN-OS device is configured as a GlobalProtect web portal, a specially crafted request to the portal could result in a crash of the service. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

Palo Alto Networks PAN-OS Multiple Vulnerabilities (PAN-SA-2016-0003, PAN-SA-2016-0005)

The Palo Alto Networks PAN-OS running on the remote host is version 5.0.x prior to 5.0.18, 6.0.x prior to 6.0.13, 6.1.x prior to 6.1.10, or 7.0.x prior to 7.0.5. It is, therefore, affected by the following vulnerabilities: - An overflow condition exists in the GlobalProtect web portal due to...

Palo Alto Networks PAN-OS Multiple Vulnerabilities (PAN-SA-2016-0002, PAN-SA-2016-0004)

The Palo Alto Networks PAN-OS running on the remote host is version 5.0.x prior to 5.0.18, 5.1.x prior to 5.1.11, 6.0.x prior to 6.0.13, 6.1.x prior to 6.1.10, or 7.0.x prior to 7.0.5-h2. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists in the GlobalProte...

Palo Alto PAN-OS PAN-SA-2016-0005

When a PAN-OS device is configured as a GlobalProtect portal, a vulnerability exists where an improper handling of a buffer involved in the processing of SSL VPN requests can result in device crash and possible remote code execution. SPDX-FileCopyrightText: 2016 Greenbone AG Some text description...