Palo Alto Networks
Page 4 of 4 — Palo Alto Networks CVEs from a corpus of 342, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-2005 | High | 7.1 | 2020-05-13 | A cross-site scripting (XSS) vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise… |
CVE-2020-2004 | Medium | 6.8 | 2020-05-13 | Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on Globa… |
CVE-2020-2003 | Medium | 6.5 | 2020-05-13 | An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator to delete arbitrary system files affect… |
CVE-2020-2002 | High | 8.1 | 2020-05-13 | An authentication bypass by spoofing vulnerability exists in the authentication daemon and User-ID components of Palo Alto Networks PAN-OS by failing to verify… |
CVE-2020-2001 | High | 8.1 | 2020-05-13 | An external control of path and data vulnerability in the Palo Alto Networks PAN-OS Panorama XSLT processing logic that allows an unauthenticated user with net… |
CVE-2020-1998 | Medium | 5.4 | 2020-05-13 | An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the acc… |
CVE-2020-1997 | Medium | 5.3 | 2020-05-13 | An open redirection vulnerability in the GlobalProtect component of Palo Alto Networks PAN-OS allows an attacker to specify an arbitrary redirection target awa… |
CVE-2020-1996 | Medium | 5.3 | 2020-05-13 | A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the ma… |
CVE-2020-1995 | Medium | 4.9 | 2020-05-13 | A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to send a request that causes the rasmgr daemon to… |
CVE-2020-1994 | Medium | 4.1 | 2020-05-13 | A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integr… |
CVE-2020-1993 | Low | 3.7 | 2020-05-13 | The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an at… |
CVE-2020-1992 | High | 8.1 | 2020-04-08 | A format string vulnerability in the Varrcvr daemon of PAN-OS on PA-7000 Series devices with a Log Forwarding Card (LFC) allows remote attackers to crash the d… |
CVE-2020-1991 | High | 7.8 | 2020-04-08 | An insecure temporary file vulnerability in Palo Alto Networks Traps allows a local authenticated Windows user to escalate privileges or overwrite system files… |
CVE-2020-1990 | High | 7.2 | 2020-04-08 | A stack-based buffer overflow vulnerability in the management server component of PAN-OS allows an authenticated user to upload a corrupted PAN-OS configuratio… |
CVE-2020-1989 | High | 7.0 | 2020-04-08 | An incorrect privilege assignment vulnerability when writing application-specific files in the Palo Alto Networks Global Protect Agent for Linux on ARM platfor… |
CVE-2020-1988 | Medium | 4.2 | 2020-04-08 | An unquoted search path vulnerability in the Windows release of Global Protect Agent allows an authenticated local user with file creation privileges on the ro… |
CVE-2020-1987 | Low | 3.9 | 2020-04-08 | An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie… |
CVE-2020-1978 | Medium | 5.8 | 2020-04-08 | TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) inadvertently collect… |
CVE-2020-1981 | High | 7.0 | 2020-03-11 | A predictable temporary filename vulnerability in PAN-OS allows local privilege escalation. This issue allows a local attacker who bypassed the restricted shel… |
CVE-2020-1980 | High | 7.8 | 2020-03-11 | A shell command injection vulnerability in the PAN-OS CLI allows a local authenticated user to escape the restricted shell and escalate privileges. This issue… |
CVE-2020-1979 | High | 8.1 | 2020-03-11 | A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and acc… |
CVE-2020-1977 | High | 7.5 | 2020-02-12 | Insufficient Cross-Site Request Forgery (XSRF) protection on Expedition Migration Tool allows remote unauthenticated attackers to hijack the authentication of… |
CVE-2020-1976 | Medium | 4.7 | 2020-02-12 | A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS ker… |
CVE-2020-1975 | Medium | 6.8 | 2020-02-12 | Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that… |
CVE-2019-17440 | Critical | 10.0 | 2019-12-20 | Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an… |
CVE-2019-17437 | High | 7.8 | 2019-12-05 | An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges an… |
CVE-2019-17436 | High | 7.1 | 2019-10-16 | A Local Privilege Escalation vulnerability exists in GlobalProtect Agent for Linux and Mac OS X version 5.0.4 and earlier and version 4.1.12 and earlier, that… |
CVE-2019-17435 | Medium | 5.5 | 2019-10-16 | A Local Privilege Escalation vulnerability exists in the GlobalProtect Agent for Windows 5.0.3 and earlier, and GlobalProtect Agent for Windows 4.1.12 and earl… |
CVE-2019-1581 | Critical | 9.8 | 2019-08-23 | A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SS… |
CVE-2019-1578 | Medium | 6.1 | 2019-07-01 | Cross-site scripting vulnerability in Palo Alto Networks MineMeld version 0.9.60 and earlier may allow a remote attacker able to convince an authenticated Mine… |
CVE-2019-1577 | Medium | 6.3 | 2019-07-01 | Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScript or HTML. |
CVE-2019-1568 | Medium | 6.1 | 2019-05-09 | Cross-site scripting (XSS) vulnerability in Palo Alto Networks Demisto 4.5 build 40249 may allow an unauthenticated attacker to run arbitrary JavaScript or HTM… |
CVE-2019-1574 | Medium | 5.4 | 2019-04-12 | Cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition Migration tool 1.1.12 and earlier may allow an authenticated attacker to run arbitrar… |
CVE-2019-1573 | Low | 2.5 | 2019-04-09 | GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end… |
CVE-2019-1572 | High | 7.5 | 2019-03-26 | PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files. |
CVE-2019-1566 | Medium | 6.1 | 2019-01-30 | The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacke… |
CVE-2019-1565 | Medium | 5.4 | 2019-01-30 | The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authent… |
CVE-2018-10143 | Critical | 9.8 | 2018-12-12 | The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system level commands on t… |
CVE-2018-10142 | High | 7.5 | 2018-11-27 | The Expedition Migration tool 1.0.106 and earlier may allow an unauthenticated attacker to enumerate files on the operating system. |
CVE-2018-10141 | Medium | 6.1 | 2018-10-12 | GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML. |
CVE-2018-10140 | Medium | 4.3 | 2018-08-16 | The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, result… |
CVE-2018-10139 | Medium | 6.1 | 2018-08-16 | The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow a… |