Paloaltonetworks
Page 2 of 4 — Paloaltonetworks CVEs from a corpus of 383, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5917 | Medium | 4.9 | 2024-11-14 | A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a… |
CVE-2024-2552 | Medium | 6.0 | 2024-11-14 | A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management… |
CVE-2024-2551 | High | 7.5 | 2024-11-14 | A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewal… |
CVE-2024-2550 | High | 7.5 | 2024-11-14 | A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the Glo… |
CVE-2024-9473 | High | 7.8 | 2024-10-09 | A privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated non-administrative Windows user to e… |
CVE-2024-9471 | Medium | 4.7 | 2024-10-09 | A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted pr… |
CVE-2024-9469 | Medium | 5.5 | 2024-10-09 | A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to… |
CVE-2024-9468 | High | 7.5 | 2024-10-09 | A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the… |
CVE-2024-9467 | Medium | 6.1 | 2024-10-09 | A reflected XSS vulnerability in Palo Alto Networks Expedition enables execution of malicious JavaScript in the context of an authenticated Expedition user's b… |
CVE-2024-9466 | Medium | 6.5 | 2024-10-09 | A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, pass… |
CVE-2024-9465 | Critical | 9.1 | 2024-10-09 | An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password has… |
CVE-2024-9464 | Medium | 6.5 | 2024-10-09 | An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, res… |
CVE-2024-9463 | High | 7.5 | 2024-10-09 | An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, r… |
CVE-2024-8691 | High | 7.1 | 2024-09-11 | A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another G… |
CVE-2024-8690 | Medium | 4.4 | 2024-09-11 | A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows administrator privileges to disa… |
CVE-2024-8688 | Medium | 4.4 | 2024-09-11 | An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables authenticated administrators… |
CVE-2024-8687 | High | 7.1 | 2024-09-11 | An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalPro… |
CVE-2024-8686 | High | 7.2 | 2024-09-11 | A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary… |
CVE-2024-5916 | Medium | 4.4 | 2024-08-14 | An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords… |
CVE-2024-5915 | High | 7.8 | 2024-08-14 | A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated… |
CVE-2024-5914 | Critical | 9.8 | 2024-08-14 | A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commands within the con… |
CVE-2024-5913 | Medium | 6.1 | 2024-07-10 | An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the physical file system t… |
CVE-2024-5911 | Medium | 4.9 | 2024-07-10 | An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interfa… |
CVE-2024-5910 | Critical | 9.8 | 2024-07-10 | Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network acc… |
CVE-2024-5909 | Medium | 5.5 | 2024-06-12 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a low privileged local Windows user to disable the a… |
CVE-2024-5908 | High | 7.5 | 2024-06-12 | A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in applicat… |
CVE-2024-5907 | High | 7.0 | 2024-06-12 | A privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute programs with elevated… |
CVE-2024-5906 | Medium | 4.8 | 2024-06-12 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for… |
CVE-2024-5905 | Medium | 4.4 | 2024-06-12 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local low privileged Windows user to disrupt some… |
CVE-2024-3661 | High | 7.6 | 2024-05-06 | DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traff… |
CVE-2024-3400 | Critical | 10.0 | 2024-04-12 | A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS… |
CVE-2024-3388 | Medium | 4.1 | 2024-04-10 | A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send netwo… |
CVE-2024-3387 | Medium | 5.3 | 2024-04-10 | A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to ca… |
CVE-2024-3386 | Medium | 5.3 | 2024-04-10 | An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This… |
CVE-2024-3385 | High | 7.5 | 2024-04-10 | A packet processing mechanism in Palo Alto Networks PAN-OS software enables a remote attacker to reboot hardware-based firewalls. Repeated attacks eventually c… |
CVE-2024-3384 | High | 7.5 | 2024-04-10 | A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (N… |
CVE-2024-3383 | High | 7.4 | 2024-04-10 | A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID group… |
CVE-2024-3382 | High | 7.5 | 2024-04-10 | A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually pre… |
CVE-2024-2433 | Medium | 4.3 | 2024-03-13 | An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web… |
CVE-2024-2432 | Medium | 4.5 | 2024-03-13 | A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated… |
CVE-2024-2431 | Medium | 5.5 | 2024-03-13 | An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disa… |
CVE-2024-0011 | Medium | 4.3 | 2024-02-14 | A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScr… |
CVE-2024-0010 | Medium | 4.3 | 2024-02-14 | A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execution of malicious J… |
CVE-2024-0009 | Medium | 6.3 | 2024-02-14 | An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credenti… |
CVE-2024-0008 | Medium | 6.6 | 2024-02-14 | Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized acces… |
CVE-2024-0007 | Medium | 6.8 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScri… |
CVE-2023-6795 | Medium | 5.5 | 2023-12-13 | An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially… |
CVE-2023-6794 | Medium | 5.5 | 2023-12-13 | An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface… |
CVE-2023-6793 | Low | 2.7 | 2023-12-13 | An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API… |
CVE-2023-6792 | Medium | 5.5 | 2023-12-13 | An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and po… |
CVE-2023-6791 | Medium | 4.9 | 2023-12-13 | A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credential… |
CVE-2023-6790 | High | 8.8 | 2023-12-13 | A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the con… |
CVE-2023-6789 | Medium | 4.3 | 2023-12-13 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScri… |
CVE-2023-3282 | Medium | 6.4 | 2023-11-08 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system enables a local atta… |
CVE-2023-3280 | Medium | 5.5 | 2023-09-13 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to disable the agent. |
CVE-2023-38046 | Medium | 5.5 | 2023-07-12 | A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created co… |
CVE-2023-0010 | Medium | 5.4 | 2023-06-14 | A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be e… |
CVE-2023-0009 | High | 7.8 | 2023-06-14 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute programs with elevated p… |
CVE-2023-0008 | Medium | 4.4 | 2023-05-10 | A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to exp… |
CVE-2023-0007 | Medium | 6.5 | 2023-05-10 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to st… |
CVE-2023-0006 | Medium | 6.3 | 2023-04-12 | A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files from the endpoint with… |
CVE-2023-0005 | Medium | 4.1 | 2023-04-12 | A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device con… |
CVE-2023-0004 | Medium | 6.5 | 2023-04-12 | A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system wit… |
CVE-2023-0003 | Medium | 6.5 | 2023-02-08 | A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read l… |
CVE-2023-0002 | Medium | 5.5 | 2023-02-08 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands t… |
CVE-2023-0001 | Medium | 6.0 | 2023-02-08 | An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin p… |
CVE-2022-0031 | Medium | 6.7 | 2022-11-09 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system allows a local attac… |
CVE-2022-0030 | High | 8.1 | 2022-10-12 | An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target… |
CVE-2022-0029 | Medium | 5.5 | 2022-09-14 | An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system wit… |
CVE-2022-0028 | High | 8.6 | 2022-08-10 | A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. Th… |
CVE-2022-0027 | Medium | 4.3 | 2022-05-11 | An improper authorization vulnerability in Palo Alto Network Cortex XSOAR software enables authenticated users in non-Read-Only groups to generate an email rep… |
CVE-2022-0026 | Medium | 6.7 | 2022-05-11 | A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with… |
CVE-2022-0025 | Medium | 6.7 | 2022-05-11 | A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with… |
CVE-2022-0024 | High | 7.2 | 2022-05-11 | A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created… |
CVE-2022-0023 | Medium | 5.9 | 2022-04-13 | An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-th… |
CVE-2022-0022 | Medium | 4.1 | 2022-03-09 | Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not create… |
CVE-2022-0021 | Low | 3.3 | 2022-02-10 | An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the… |
CVE-2022-0020 | Medium | 6.8 | 2022-02-10 | A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a pe… |
CVE-2022-0019 | Medium | 4.7 | 2022-02-10 | An insufficiently protected credentials vulnerability exists in the Palo Alto Networks GlobalProtect app on Linux that exposes the hashed credentials of Global… |
CVE-2022-0018 | Medium | 6.1 | 2022-02-10 | An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account a… |
CVE-2022-0017 | High | 7.0 | 2022-02-10 | An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a lo… |
CVE-2022-0016 | High | 7.4 | 2022-02-10 | An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that en… |
CVE-2022-0011 | Medium | 6.5 | 2022-02-10 | PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules)… |
CVE-2022-0015 | High | 7.8 | 2022-01-12 | A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs… |
CVE-2022-0014 | Medium | 6.7 | 2022-01-12 | An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Wind… |
CVE-2022-0013 | Medium | 5.0 | 2022-01-12 | A file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary fil… |
CVE-2022-0012 | Medium | 6.1 | 2022-01-12 | An improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables a local user t… |
CVE-2021-3064 | Critical | 9.8 | 2021-11-10 | A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attack… |
CVE-2021-3063 | High | 7.5 | 2021-11-10 | An improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthent… |
CVE-2021-3062 | High | 8.1 | 2021-11-10 | An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to t… |
CVE-2021-3061 | Medium | 6.4 | 2021-11-10 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables an authenticated administrator with access to the C… |
CVE-2021-3060 | High | 8.1 | 2021-11-10 | An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based a… |
CVE-2021-3059 | High | 8.1 | 2021-11-10 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables… |
CVE-2021-3058 | High | 8.8 | 2021-11-10 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permissions to use XML API the… |
CVE-2021-3056 | High | 8.8 | 2021-11-10 | A memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless VPN enables an authenticated attacker to execute arbitrary code with ro… |
CVE-2021-3057 | High | 8.1 | 2021-10-13 | A stack-based buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect app that enables a man-in-the-middle attacker to disrupt system proc… |
CVE-2021-3055 | Medium | 6.5 | 2021-09-08 | An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administra… |
CVE-2021-3054 | High | 7.2 | 2021-09-08 | A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with… |
CVE-2021-3053 | High | 7.5 | 2021-09-08 | An improper handling of exceptional conditions vulnerability exists in the Palo Alto Networks PAN-OS dataplane that enables an unauthenticated network-based at… |
CVE-2021-3052 | High | 8.0 | 2021-09-08 | A reflected cross-site scripting (XSS) vulnerability in the Palo Alto Network PAN-OS web interface enables an authenticated network-based attacker to mislead a… |