Palo Alto Networks
Page 3 of 4 — Palo Alto Networks CVEs from a corpus of 342, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0005 | Medium | 4.1 | 2023-04-12 | A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device con… |
CVE-2023-0004 | Medium | 6.5 | 2023-04-12 | A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system wit… |
CVE-2023-0003 | Medium | 6.5 | 2023-02-08 | A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read l… |
CVE-2023-0002 | Medium | 5.5 | 2023-02-08 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands t… |
CVE-2023-0001 | Medium | 6.0 | 2023-02-08 | An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin p… |
CVE-2022-0031 | Medium | 6.7 | 2022-11-09 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system allows a local attac… |
CVE-2022-0030 | High | 8.1 | 2022-10-12 | An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target… |
CVE-2022-0029 | Medium | 5.5 | 2022-09-14 | An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system wit… |
CVE-2022-0028 | High | 8.6 | 2022-08-10 | A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. Th… |
CVE-2022-0027 | Medium | 4.3 | 2022-05-11 | An improper authorization vulnerability in Palo Alto Network Cortex XSOAR software enables authenticated users in non-Read-Only groups to generate an email rep… |
CVE-2022-0026 | Medium | 6.7 | 2022-05-11 | A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with… |
CVE-2022-0025 | Medium | 6.7 | 2022-05-11 | A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with… |
CVE-2022-0024 | High | 7.2 | 2022-05-11 | A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created… |
CVE-2022-0023 | Medium | 5.9 | 2022-04-13 | An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-th… |
CVE-2022-0022 | Medium | 4.1 | 2022-03-09 | Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not create… |
CVE-2022-0021 | Low | 3.3 | 2022-02-10 | An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the… |
CVE-2022-0020 | Medium | 6.8 | 2022-02-10 | A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a pe… |
CVE-2022-0019 | Medium | 4.7 | 2022-02-10 | An insufficiently protected credentials vulnerability exists in the Palo Alto Networks GlobalProtect app on Linux that exposes the hashed credentials of Global… |
CVE-2022-0018 | Medium | 6.1 | 2022-02-10 | An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account a… |
CVE-2022-0017 | High | 7.0 | 2022-02-10 | An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a lo… |
CVE-2022-0016 | High | 7.4 | 2022-02-10 | An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that en… |
CVE-2022-0011 | Medium | 6.5 | 2022-02-10 | PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules)… |
CVE-2022-0015 | High | 7.8 | 2022-01-12 | A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs… |
CVE-2022-0014 | Medium | 6.7 | 2022-01-12 | An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Wind… |
CVE-2022-0013 | Medium | 5.0 | 2022-01-12 | A file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary fil… |
CVE-2022-0012 | Medium | 6.1 | 2022-01-12 | An improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables a local user t… |
CVE-2021-3064 | Critical | 9.8 | 2021-11-10 | A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attack… |
CVE-2021-3063 | High | 7.5 | 2021-11-10 | An improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthent… |
CVE-2021-3062 | High | 8.1 | 2021-11-10 | An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to t… |
CVE-2021-3061 | Medium | 6.4 | 2021-11-10 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables an authenticated administrator with access to the C… |
CVE-2021-3060 | High | 8.1 | 2021-11-10 | An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based a… |
CVE-2021-3059 | High | 8.1 | 2021-11-10 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables… |
CVE-2021-3058 | High | 8.8 | 2021-11-10 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permissions to use XML API the… |
CVE-2021-3056 | High | 8.8 | 2021-11-10 | A memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless VPN enables an authenticated attacker to execute arbitrary code with ro… |
CVE-2021-3057 | High | 8.1 | 2021-10-13 | A stack-based buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect app that enables a man-in-the-middle attacker to disrupt system proc… |
CVE-2021-3055 | Medium | 6.5 | 2021-09-08 | An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administra… |
CVE-2021-3054 | High | 7.2 | 2021-09-08 | A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with… |
CVE-2021-3053 | High | 7.5 | 2021-09-08 | An improper handling of exceptional conditions vulnerability exists in the Palo Alto Networks PAN-OS dataplane that enables an unauthenticated network-based at… |
CVE-2021-3052 | High | 8.0 | 2021-09-08 | A reflected cross-site scripting (XSS) vulnerability in the Palo Alto Network PAN-OS web interface enables an authenticated network-based attacker to mislead a… |
CVE-2021-3051 | High | 8.1 | 2021-09-08 | An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based atta… |
CVE-2021-3049 | Low | 2.6 | 2021-09-08 | An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read p… |
CVE-2021-3050 | High | 8.8 | 2021-08-11 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to execute arbitrary OS commands to… |
CVE-2021-3048 | Medium | 5.9 | 2021-08-11 | Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This condition causes subs… |
CVE-2021-3047 | Medium | 4.2 | 2021-08-11 | A cryptographically weak pseudo-random number generator (PRNG) is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an au… |
CVE-2021-3046 | Medium | 6.8 | 2021-08-11 | An improper authentication vulnerability exists in Palo Alto Networks PAN-OS software that enables a SAML authenticated attacker to impersonate any other user… |
CVE-2021-3045 | Medium | 4.9 | 2021-08-11 | An OS command argument injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file… |
CVE-2021-3043 | High | 7.5 | 2021-07-15 | A reflected cross-site scripting (XSS) vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScr… |
CVE-2021-3042 | High | 7.8 | 2021-07-15 | A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Wind… |
CVE-2021-3044 | Critical | 9.8 | 2021-06-22 | An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker with network access to the Cortex XSOAR se… |
CVE-2021-3041 | High | 7.8 | 2021-06-10 | A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows u… |
CVE-2021-3040 | Medium | 6.7 | 2021-06-10 | An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This… |
CVE-2021-3039 | Low | 3.8 | 2021-06-10 | An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role… |
CVE-2021-3038 | Medium | 5.5 | 2021-04-20 | A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted i… |
CVE-2021-3037 | Low | 2.3 | 2021-04-20 | An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration… |
CVE-2021-3036 | Medium | 4.4 | 2021-04-20 | An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in clea… |
CVE-2021-3035 | Medium | 6.7 | 2021-04-20 | An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This… |
CVE-2021-3034 | Medium | 5.1 | 2021-03-10 | An information exposure through log file vulnerability exists in Cortex XSOAR software where the secrets configured for the SAML single sign-on (SSO) integrati… |
CVE-2021-3033 | Critical | 9.1 | 2021-02-10 | An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an… |
CVE-2021-3032 | Medium | 4.4 | 2021-01-13 | An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “s… |
CVE-2021-3031 | Medium | 4.3 | 2021-01-13 | Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewal… |
CVE-2020-2049 | High | 7.8 | 2020-12-09 | A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows use… |
CVE-2020-2020 | Medium | 5.5 | 2020-12-09 | An improper handling of exceptional conditions vulnerability in Cortex XDR Agent allows a local authenticated Windows user to create files in the software's in… |
CVE-2020-2050 | High | 8.2 | 2020-11-12 | An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass al… |
CVE-2020-2048 | Low | 3.3 | 2020-11-12 | An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed… |
CVE-2020-2022 | High | 7.5 | 2020-11-12 | An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's se… |
CVE-2020-2000 | High | 7.2 | 2020-11-12 | An OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allows authenticated administrators to disrupt system p… |
CVE-2020-1999 | Medium | 5.3 | 2020-11-12 | A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the netwo… |
CVE-2020-2044 | Low | 3.3 | 2020-09-09 | An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using… |
CVE-2020-2043 | Low | 3.3 | 2020-09-09 | An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-O… |
CVE-2020-2042 | High | 7.2 | 2020-09-09 | A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute… |
CVE-2020-2041 | High | 7.5 | 2020-09-09 | An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically crafted request to… |
CVE-2020-2040 | Critical | 9.8 | 2020-09-09 | A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privi… |
CVE-2020-2039 | Medium | 5.3 | 2020-09-09 | An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the… |
CVE-2020-2038 | High | 7.2 | 2020-09-09 | An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root pr… |
CVE-2020-2037 | High | 7.2 | 2020-09-09 | An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root pr… |
CVE-2020-2036 | High | 8.8 | 2020-09-09 | A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an… |
CVE-2020-2035 | Low | 3.0 | 2020-08-12 | When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL… |
CVE-2020-2034 | High | 8.1 | 2020-07-08 | An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with… |
CVE-2020-2031 | Medium | 4.9 | 2020-07-08 | An integer underflow vulnerability in the dnsproxyd component of the PAN-OS management interface allows authenticated administrators to issue a command from th… |
CVE-2020-2030 | High | 7.2 | 2020-07-08 | An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root pr… |
CVE-2020-1982 | Medium | 4.8 | 2020-07-08 | Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, which is known to be a cryptographically weak protocol. These clou… |
CVE-2020-2021 | Critical | 10.0 | 2020-06-29 | When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), impro… |
CVE-2020-2033 | Medium | 5.3 | 2020-06-10 | When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon authentication coo… |
CVE-2020-2032 | High | 7.0 | 2020-06-10 | A race condition vulnerability Palo Alto Networks GlobalProtect app on Windows allows a local limited Windows user to execute programs with SYSTEM privileges… |
CVE-2020-2029 | High | 7.2 | 2020-06-10 | An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS commands with root pri… |
CVE-2020-2028 | High | 7.2 | 2020-06-10 | An OS Command Injection vulnerability in PAN-OS management server allows authenticated administrators to execute arbitrary OS commands with root privileges whe… |
CVE-2020-2027 | High | 7.2 | 2020-06-10 | A buffer overflow vulnerability in the authd component of the PAN-OS management server allows authenticated administrators to disrupt system processes and pote… |
CVE-2020-2018 | Critical | 9.0 | 2020-05-13 | An authentication bypass vulnerability in the Panorama context switching feature allows an attacker with network access to a Panorama's management interface to… |
CVE-2020-2017 | High | 8.8 | 2020-05-13 | A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated adm… |
CVE-2020-2016 | High | 7.0 | 2020-05-13 | A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux… |
CVE-2020-2015 | High | 8.8 | 2020-05-13 | A buffer overflow vulnerability in the PAN-OS management server allows authenticated users to crash system processes or potentially execute arbitrary code with… |
CVE-2020-2014 | High | 8.8 | 2020-05-13 | An OS Command Injection vulnerability in PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands with root privilege… |
CVE-2020-2013 | High | 8.3 | 2020-05-13 | A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PA… |
CVE-2020-2012 | High | 7.5 | 2020-05-13 | Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated att… |
CVE-2020-2011 | High | 7.5 | 2020-05-13 | An improper input validation vulnerability in the configuration daemon of Palo Alto Networks PAN-OS Panorama allows for a remote unauthenticated user to send a… |
CVE-2020-2010 | High | 7.2 | 2020-05-13 | An OS command injection vulnerability in PAN-OS management interface allows an authenticated administrator to execute arbitrary OS commands with root privilege… |
CVE-2020-2009 | High | 7.2 | 2020-05-13 | An external control of filename vulnerability in the SD WAN component of Palo Alto Networks PAN-OS Panorama allows an authenticated administrator to send a req… |
CVE-2020-2008 | High | 7.2 | 2020-05-13 | An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated administrators to execute code with ro… |
CVE-2020-2007 | High | 7.2 | 2020-05-13 | An OS command injection vulnerability in the management server component of PAN-OS allows an authenticated user to potentially execute arbitrary commands with… |
CVE-2020-2006 | High | 7.2 | 2020-05-13 | A stack-based buffer overflow vulnerability in the management server component of PAN-OS that allows an authenticated user to potentially execute arbitrary cod… |