CVE-2023-6791

A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web interface...

CVE-2023-6789

A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguis...

Command injection

An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall...

Design/Logic Flaw

An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall...

Command injection

An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall...

Cross site scripting

A DOM-Based cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an administrator’s browser when they view a specifically crafted link to the PAN-OS web interface...

Privilege escalation

An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API keys from the firewall and disrupt XML API usage...

Cross site scripting

A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguis...

CVE-2023-6793

CVE-2023-6793 affects Palo Alto Networks PAN-OS: an improper privilege management flaw allows an authenticated read-only admin to revoke XML API keys and disrupt XML API usage. Vulnerable if running PAN-OS versions: 9.0.x before 9.0.17-h4, 9.1.x before 9.1.17, 10.1.x before 10.1.11, 10.2.x before...

CVE-2023-6793 PAN-OS: XML API Keys Revoked by Read-Only PAN-OS Administrator

An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API keys from the firewall and disrupt XML API usage...

CVE-2023-6793 PAN-OS: XML API Keys Revoked by Read-Only PAN-OS Administrator

An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API keys from the firewall and disrupt XML API usage...

CVE-2023-6791 PAN-OS: Plaintext Disclosure of External System Integration Credentials

A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web interface...

CVE-2023-6791

CVE-2023-6791 affects Palo Alto Networks PAN-OS; an authenticated read-only administrator can obtain plaintext credentials of external system integrations (LDAP, SCP, RADIUS, TACACS+, SNMP) from the web interface. The CVSSv3.1 base score is 4.9 (Medium); exploit requires prior authentication with...

CVE-2023-6789 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguis...

CVE-2023-6789

CVE-2023-6789 is a stored XSS vulnerability in Palo Alto Networks PAN-OS web interface. An authenticated read‑write administrator can store a JavaScript payload, which executes in the context of another authenticated administrator, disguising actions as those of the unsuspecting user. The issue i...

CVE-2023-6795

CVE-2023-6795 affects Palo Alto Networks PAN-OS across multiple branches. An OS command injection in the PAN-OS web interface can be exploited by an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall. Affected ver...

CVE-2023-6794 PAN-OS: File Upload Vulnerability in the Web Interface

An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall...

CVE-2023-6794

CVE-2023-6794 affects Palo Alto Networks PAN-OS: an arbitrary file upload vulnerability in the web interface allows an authenticated read‑write administrator to disrupt system processes and potentially execute arbitrary code with limited privileges. Affected versions include PAN-OS 8.1.x before 8...

CVE-2023-6792 PAN-OS: OS Command Injection Vulnerability in the XML API

An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall...

CVE-2023-6792 PAN-OS: OS Command Injection Vulnerability in the XML API

An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall...