195 matches found
Palo Alto Networks PAN-OS Code Execution
The vulnerability of the Palo Alto Networks PAN-OS GlobalProtect Clientless VPN operating system stems from buffer overflows in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with root privileges remotely...
Memory corruption
A memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless VPN enables an authenticated attacker to execute arbitrary code with root user privileges during SAML authentication. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions...
CVE-2021-3056
A memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless VPN enables an authenticated attacker to execute arbitrary code with root user privileges during SAML authentication. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions...
PT-2021-4802
Name of the Vulnerable Software and Affected Versions PAN-OS versions earlier than 8.1.20 PAN-OS versions earlier than 9.0.14 PAN-OS versions earlier than 9.1.9 PAN-OS versions earlier than 10.0.1 Description A memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless...
CVE-2021-3056: Buffer Copy without Checking Size of Input
A memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless VPN enables an authenticated attacker to execute arbitrary code with root user privileges during SAML authentication. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions...
CVE-2020-2050
An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to...
Authentication flaw
An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to...
5G, Security, IoT, Asavie and Akamai
Malicious actors never seem to rest and have always worked remotely. That simple realization hit home during recent global events. Specifically, Akamai saw an increase in malware traffic of over 400% between March 9, 2020 and May 11, 2020 from corporate devices, most of which were being used...
Crlf injection
A vulnerability in the Clientless SSL VPN WebVPN of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to inject arbitrary HTTP headers in the responses of the affected system. The vulnerability is due to...
CVE-2020-3561: Improper Neutralization of CRLF Sequences
A vulnerability in the Clientless SSL VPN WebVPN of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to inject arbitrary HTTP headers in the responses of the affected system. The vulnerability is due to...
U.S. Dept Of Defense: Read-only path traversal (CVE-2020-3452) at https://█████
Summary: I discovered a vulnerability Read-only path traversal CVE-2020-3452 at https://███████ Description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote...
U.S. Dept Of Defense: ███ is vulnerable to CVE-2020-3452 Read-Only Path Traversal Vulnerability
Summary: ████████ is vulnerable to Read-Only Path Traversal Vulnerability as described at https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86 Description: Get request parameters at the /+CSCOT+/translation-table and the /+CSCOT+/oem-customization...
Palo Alto Networks PAN-OS 7.1.x < 7.1.26 / 8.0.x < 8.1.13 / 8.1.x < 8.1.13 / 9.0.x < 9.0.7 Vulnerability
The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 7.1.26 or 8.0.x prior to 8.1.13 or 8.1.x prior to 8.1.13 or 9.0.x prior to 9.0.7. It is, therefore, affected by a vulnerability. - A cross-site scripting XSS vulnerability exists when visiting malicious websites...
CVE-2020-15069
Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x...
CVE-2020-15069
Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x...
CVE-2020-15069: Buffer Copy without Checking Size of Input
Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x...
Palo Alto Networks PAN-OS Cross-Site Scripting Vulnerability (CNVD-2020-32243)
Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. A cross-site scripting vulnerability exists in Palo Alto Networks PAN-OS, which can be exploited by an attacker to hijack a user's active session when the user accesses a malicious websit...
CVE-2020-2005
A cross-site scripting XSS vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active session. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0...
CVE-2020-2005
CVE-2020-2005 affects Palo Alto Networks PAN-OS GlobalProtect Clientless VPN, with an XSS vulnerability that can compromise a user’s active session when visiting malicious sites. Affected: PAN-OS 7.1.x (<7.1.26), 8.0.x (<8.1.13), 8.1.x (<8.1.13), and 9.0.x (
CVE-2020-2005: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active session. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0...