736 matches found
OpenSSL Man-in-the-middle vulnerability
The Palo Alto Networks product security engineering team has completed analysis of our products' exposure to the vulnerabilities described in the OpenSSL Security Advisory dated June 5th, 2014. Of the 7 CVEs highlighted in the advisory, only CVE-2014-0224 is relevant to our software. The...
Management API Key Bypass
An XML API key can be bypassed if a session has been authorized. This can be used in a CSRF or XSS attack. Ref 58976 This issue requires an authenticated administrator session to be successful. This issue affects PAN-OS version 4.1.15 and earlier; 5.0.9 and earlier; 5.1.4 and earlier. Work around...
Cross-site Scripting Vulnerability
A cross-site scripting vulnerability exists in the web-based device management interface whereby data provided by the user is echoed back to the user without sanitization. Ref 59010 This issue affects the management interface of the device, requiring a malicious administrator to upload malicious...
Management API Key Bypass
An XML API key can be bypassed if a session has been authorized. This can be used in a CSRF or XSS attack. Ref 58976...
Cross-site Scripting Vulnerability
A cross-site scripting vulnerability exists in the web-based device management interface whereby data provided by the user is echoed back to the user without sanitization. Ref 59010...
Cross-site Scripting Vulnerability
A cross-site scripting vulnerability exists in the web-based device management API browser whereby data provided by the user is echoed back to the user without sanitization. Ref 50908 This issue affects the management interface of the device where the API browser is exposed. This issue affects...
Cross-site Scripting Vulnerability
A cross-site scripting vulnerability exists in the web-based device management API browser whereby data provided by the user is echoed back to the user without sanitization. Ref 50908 This issue affects the management interface of the device where the API browser is exposed. This issue affects...
App-ID Cache Poisoning
An evasion technique that takes advantage of the App-ID cache function has recently been published. In certain circumstances, a knowledgeable user can bypass security policy that restricts the use of certain applications by sending numerous specially crafted requests over the network in order to...
App-ID Cache Poisoning
An evasion technique that takes advantage of the App-ID cache function has recently been published. In certain circumstances, a knowledgeable user can bypass security policy that restricts the use of certain applications by sending numerous specially crafted requests over the network in order to...
Man-in-the-middle Vulnerability in GlobalProtect App
A vulnerability exists in NetConnect all version and GlobalPortect App 1.1.6 and earlier whereby the agent does not verify the certificate presented by the portal server, enabling a possible Man-in-the-middle attack. This vulnerability can result in an agent connecting to an attacker-controlled...
Man-in-the-middle Vulnerability in GlobalProtect App
A vulnerability exists in NetConnect all version and GlobalPortect App 1.1.6 and earlier whereby the agent does not verify the certificate presented by the portal server, enabling a possible Man-in-the-middle attack. This vulnerability can result in an agent connecting to an attacker-controlled...
Verbose Error Messages
Under certain conditions, when unexpected input is provided to the web-based management UI, overly verbose error information is delivered back to the client. This does not directly result in any specific vulnerability, however this information is helpful to an attacker. Ref 33139 This issue resul...
Command Injection Vulnerability
A vulnerability exists whereby an authenticated user can inject arbitrary shell commands using the device management command line interface. Ref 31116 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. The attacker must still be an...
Command Injection Vulnerability
A vulnerability exists whereby an authenticated user can inject arbitrary shell commands using the device management command line interface. Ref 34502 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. This issue affects PAN-OS 4.1.1 an...
Command Injection Vulnerability
A vulnerability exists whereby an authenticated user can inject arbitrary shell commands using the device management command line interface. Ref 34595 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. The attacker must still be an...
Command Injection Vulnerability
A vulnerability exists whereby an unauthenticated user can inject commands as root on the device. Ref 31091 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. This issue affects PAN-OS 4.0.4 and earlier; PAN-OS 3.1.9 and earlier. Work...
Command Injection Vulnerability
A vulnerability exists whereby an authenticated user can inject arbitrary shell commands using the device management command line interface. Ref 30122 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. This issue affects PAN-OS 4.0.3 an...
Management Server DOS Vulnerability
An issue exists whereby the management server of the device can be crashed when an authenticated users sends a specially crafted command via the command line interface. Ref 35254 This issue results in the unavailability of the management server of the device. The attacker must be an authenticated...
Credential Bypass Vulnerability
A vulnerability exists whereby an unauthenticated user can get administrator access to the device via the web management UI without supplying credentials. Ref 37034 This vulnerability can result in total compromise of the device. This issue affects PAN-OS 4.1.3 and earlier; PAN-OS 4.0.9 and...
Command Injection Vulnerability
A vulnerability exists whereby an authenticated user can execute arbitrary code as root using the device management command line interface. Ref 35249 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. This issue affects PAN-OS 4.0.8 and...
Command Injection Vulnerability
A vulnerability exists whereby an authenticated user can inject arbitrary shell commands using the device management command line interface. Ref 34502 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. This issue affects PAN-OS 4.1.1 an...
OpenSSL Plain Text Recovery Attack Vulnerability
The OpenSSL library implementation is vulnerable to a plain text recovery attack by performing timing analysis of the time required to decrypt encrypted data. A detailed report of this issue is available at http://www.isg.rhul.ac.uk/kp/dtls.pdf. Ref 36017 This vulnerability can theoretically resu...
Command Injection Vulnerability
A vulnerability exists whereby an authenticated user can inject arbitrary shell commands using the device management command line interface. Ref 33476 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. This issue affects PAN-OS 4.1.0 an...
Command Injection Vulnerability
A vulnerability exists whereby an unauthenticated user can execute arbitrary code as root on the device. Ref 36983 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. This issue affects PAN-OS 4.1.3 and earlier; PAN-OS 4.0.9 and earlier;...
LDAP Passwords Logged in Clear Text
An issue exists whereby LDAP bind passwords are logged to authd.log in clear text when using the default logging level of 'debug'. Ref 35493 This issue results in administrator passwords being logged and stored in clear text. Inappropriate access to this information can lead to unauthorized...
Command Injection Vulnerability
A vulnerability exists whereby an authenticated user can execute arbitrary code as root using the device management command line interface. Ref 34896 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. This issue affects PAN-OS 4.0.8 and...
Command Injection Vulnerability
A vulnerability exists whereby an authenticated user can inject arbitrary shell commands using the device management command line interface. Ref 33080 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. This issue affects PAN-OS 4.0.7 an...
Command Injection Vulnerability
A vulnerability exists whereby an unauthenticated user can inject commands as root on the device. Ref 30088 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. This issue affects PAN-OS 4.0.3 and earlier; PAN-OS 3.1.9 and earlier. Work...
Credential Bypass Vulnerability
A vulnerability exists whereby an unauthenticated user can get administrator access to the device via the web management UI without supplying credentials. Ref 37034 This vulnerability can result in total compromise of the device. This issue affects PAN-OS 4.1.3 and earlier; PAN-OS 4.0.9 and...
Verbose Error Messages
Under certain conditions, when unexpected input is provided to the web-based management UI, overly verbose error information is delivered back to the client. This does not directly result in any specific vulnerability, however this information is helpful to an attacker. Ref 33139 This issue resul...
LDAP Passwords Logged in Clear Text
An issue exists whereby LDAP bind passwords are logged to authd.log in clear text when using the default logging level of 'debug'. Ref 35493 This issue results in administrator passwords being logged and stored in clear text. Inappropriate access to this information can lead to unauthorized...
Command Injection Vulnerability
A vulnerability exists whereby an unauthenticated user can inject commands as root on the device. Ref 31091 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. This issue affects PAN-OS 4.0.4 and earlier; PAN-OS 3.1.9 and earlier. Work...
Command Injection Vulnerability
A vulnerability exists whereby an unauthenticated user can inject commands as root on the device. Ref 30088 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. This issue affects PAN-OS 4.0.3 and earlier; PAN-OS 3.1.9 and earlier. Work...
Command Injection Vulnerability
A vulnerability exists whereby an authenticated user can inject arbitrary shell commands using the device management command line interface. Ref 31116 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. The attacker must still be an...
Management Server DOS Vulnerability
An issue exists whereby the management server of the device can be crashed when an authenticated users sends a specially crafted command via the command line interface. Ref 35254 This issue results in the unavailability of the management server of the device. The attacker must be an authenticated...
Command Injection Vulnerability
A vulnerability exists whereby an authenticated user can inject arbitrary shell commands using the device management command line interface. Ref 34299 This vulnerability can result in arbitrary command execution, and can result in total compromise of the device. The attacker must still be an...