CVE-2017-5583: Exposure of Sensitive Information to an Unauthorized Actor

The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to read arbitrary files via unspecified vectors...

CVE-2017-5584: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Management Web Interface in Palo Alto Networks PAN-OS 5.1, 6.x before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Palo Alto PAN-OS Cross-Site Scripting in the Management Web Interface

A persistent cross-site scripting XSS vulnerability exists in the management web interface. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

Information Disclosure in the Management Web Interface

A vulnerability exists in the Management Web Interface that could result in Information Disclosure. Ref PAN-70428 / CVE-2017-5583 PAN-OS contains a post-authentication vulnerability that may allow for Information Disclosure. Successful exploitation allows an attacker to download arbitrary files...

Information Disclosure in the Management Web Interface

A vulnerability exists in the Management Web Interface that could result in Information Disclosure. Ref PAN-70428 / CVE-2017-5583 PAN-OS contains a post-authentication vulnerability that may allow for Information Disclosure. Successful exploitation allows an attacker to download arbitrary files...

Cross-Site Scripting in the Management Web Interface

A persistent cross-site scripting XSS vulnerability exists in the management web interface ref PAN-66838 / CVE-2017-5584. PAN-OS contains a post-authentication vulnerability that may allow for a persistent cross-site scripting XSS attack of the management web interface. Successful exploitation of...

Cross-Site Scripting in the Management Web Interface

A persistent cross-site scripting XSS vulnerability exists in the management web interface ref PAN-66838 / CVE-2017-5584. PAN-OS contains a post-authentication vulnerability that may allow for a persistent cross-site scripting XSS attack of the management web interface. Successful exploitation of...

PT-2017-16591

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 5.1 through 7.1.7 Palo Alto Networks PAN-OS version 6.x before 6.1.16 Palo Alto Networks PAN-OS version 7.0.x before 7.0.13 However, considering the ranges and versions provided, the most concise form is: Pal...

PT-2017-16590

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 6.1.15 and earlier Palo Alto Networks PAN-OS versions 7.0.12 and earlier Palo Alto Networks PAN-OS versions 7.1.7 and earlier Description A post-authentication issue in the Management Web Interface may allow...

CVE-2016-9150

Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2016-9150: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows remote attackers to execute arbitrary code via unspecified vectors...

PT-2016-7667

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 5.0.19 and earlier Palo Alto Networks PAN-OS versions 5.1.12 and earlier Palo Alto Networks PAN-OS versions 6.0.14 and earlier Palo Alto Networks PAN-OS versions 6.1.14 and earlier Palo Alto Networks PAN-OS...

CVE-2016-3655

The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call...

CVE-2016-3655: Improper Input Validation

The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call...

PT-2016-3198

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirLink GX 440 with ALEOS firmware version 4.3.2 Description The issue is related to insufficient access control in the ALEOS software of the Sierra Wireless AirLink GX 440 wireless gateway. Exploitation of this issue may allow...

Moxa Industrial Managed Switch Elevation of Privilege Vulnerability

Moxa EDS-405A/EDS-408A is a series of Ethernet switches. An elevation of privilege vulnerability exists in the management web interface of the Moxa EDS-405A/EDS-408A, which can be exploited by an attacker to bypass the authentication mechanism and elevate privileges...

PT-2015-5900

Name of the Vulnerable Software and Affected Versions Alcatel-Lucent OmniSwitch versions prior to 6.6.4.309.R01 Alcatel-Lucent OmniSwitch 6.6.5.x versions prior to 6.6.5.80.R02 Description The management web interface generates weak session identifiers, allowing remote attackers to hijack arbitra...

PT-2015-5901

Name of the Vulnerable Software and Affected Versions Alcatel-Lucent OmniSwitch versions 6.4.5.R02 through 8.1.1.R01 Description A cross-site request forgery CSRF issue exists in the management web interface, specifically in the sec/content/sec asa users local db add.html file. This allows remote...

[RT-SA-2015-004] Alcatel-Lucent OmniSwitch Web Interface Cross-Site Request Forgery

Advisory: Alcatel-Lucent OmniSwitch Web Interface Cross-Site Request Forgery During a penetration test, RedTeam Pentesting discovered a vulnerability in the management web interface of an Alcatel-Lucent OmniSwitch 6450. The management web interface has no protection against cross-site request...

Alcatel-Lucent OmniSwitch - Cross-Site Request Forgery

Alcatel-Lucent OmniSwitch - Cross-Site Request Forgery Advisory: Alcatel-Lucent OmniSwitch Web Interface Cross-Site Request Forgery During a penetration test, RedTeam Pentesting discovered a vulnerability in the management web interface of an Alcatel-Lucent OmniSwitch 6450. The management web...