CVE-2025-0110

CVE-2025-0110 refers to a command-injection vulnerability in Palo Alto Networks PAN-OS OpenConfig Plugin, exploitable by an authenticated administrator who can issue gNMI requests to the management web interface. The commands run as the __openconfig user (Device Administrator) on the firewall, by...

CVE-2025-0111

PAN-OS contains an authenticated file read vulnerability in the management web interface that allows a network-authenticated attacker to read files on the PAN-OS filesystem readable by the nobody user. The issue is triggered by access to the management interface; Palo Alto Networks recommends res...

CVE-2025-0111 PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by...

CVE-2025-0109 PAN-OS: Unauthenticated File Deletion Vulnerability on the Management Web Interface

An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but doe...

CVE-2025-0109

CVE-2025-0109 describes an unauthenticated file-deletion vulnerability in the PAN-OS management web interface. An unauthenticated attacker with network access can delete certain files as the “nobody” user, including limited logs and configuration files, but not system files. The issue is confined...

CVE-2025-0108 PAN-OS: Authentication Bypass in the Management Web Interface

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PH...

CVE-2025-0108

CVE-2025-0108 affects Palo Alto Networks PAN-OS and targets the management web interface, where an unauthenticated attacker can bypass authentication and invoke certain PHP scripts. Public exploit/PoC tooling exists (GitHub repos) and activity has been observed, including reports of active exploi...

PAN-OS OpenConfig Plugin: Command Injection Vulnerability in OpenConfig Plugin

A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the ability to make gNMI requests to the PAN-OS management web interface to bypass system restrictions and run arbitrary commands. The commands are run as the “root” us...

PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface

An authenticated file read vulnerability in the management web interface of the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. The attacker must...

CVE-2025-0108

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PH...

PT-2025-6774

Name of the Vulnerable Software and Affected Versions PAN-OS affected versions not specified Description An unauthenticated file deletion issue in the management web interface of PAN-OS allows an attacker with network access to delete certain files, including limited logs and configuration files,...

CVE-2025-0108: Missing Authentication for Critical Function

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PH...

CVE-2025-0111: External Control of File Name or Path

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by...

CVE-2025-0111

An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by...

Palo Alto Networks PAN-OS 10.1.x < 10.1.14-h9 / 10.2.x < 10.2.7-h24 / 11.1.x < 11.1.6-h1 / 11.2.x < 11.2.4-h4 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.14-h9 or 10.2.x prior to 10.2.7-h24 or 11.1.x prior to 11.1.6-h1 or 11.2.x prior to 11.2.4-h4. It is, therefore, affected by a vulnerability. An authentication bypass in the in the management web interface...

Palo Alto Networks PAN-OS 10.1.x < 10.1.14-h9 / 10.2.x < 10.2.7-h24 / 11.1.x < 11.1.6-h1 / 11.2.x < 11.2.4-h4 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.14-h9 or 10.2.x prior to 10.2.7-h24 or 11.1.x prior to 11.1.6-h1 or 11.2.x prior to 11.2.4-h4. It is, therefore, affected by a vulnerability. An authenticated file read vulnerability in the management web...

CVE-2025-0109: External Control of File Name or Path

An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but doe...

Palo Alto Networks PAN-OS 10.1.x < 10.1.14-h9 / 10.2.x < 10.2.7-h24 / 11.1.x < 11.1.6-h1 / 11.2.x < 11.2.4-h4 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.14-h9 or 10.2.x prior to 10.2.7-h24 or 11.1.x prior to 11.1.6-h1 or 11.2.x prior to 11.2.4-h4. It is, therefore, affected by a vulnerability. An unauthenticated file deletion vulnerability in the Palo Alto...

CVE-2024-12833

Paessler PRTG Network Monitor SNMP Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Paessler PRTG Network Monitor. Some user interaction on the part of an administrator is required ...

[SECURITY] [DLA 4048-1] cacti security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4048-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès February 10, 2025 https://wiki.debian.org/LTS -...