Paloaltonetworks
Page 3 of 4 — Paloaltonetworks CVEs from a corpus of 383, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3051 | High | 8.1 | 2021-09-08 | An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR SAML authentication that enables an unauthenticated network-based atta… |
CVE-2021-3049 | Low | 2.6 | 2021-09-08 | An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read p… |
CVE-2021-3050 | High | 8.8 | 2021-08-11 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to execute arbitrary OS commands to… |
CVE-2021-3048 | Medium | 5.9 | 2021-08-11 | Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This condition causes subs… |
CVE-2021-3047 | Medium | 4.2 | 2021-08-11 | A cryptographically weak pseudo-random number generator (PRNG) is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an au… |
CVE-2021-3046 | Medium | 6.8 | 2021-08-11 | An improper authentication vulnerability exists in Palo Alto Networks PAN-OS software that enables a SAML authenticated attacker to impersonate any other user… |
CVE-2021-3045 | Medium | 4.9 | 2021-08-11 | An OS command argument injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file… |
CVE-2021-3043 | High | 7.5 | 2021-07-15 | A reflected cross-site scripting (XSS) vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScr… |
CVE-2021-3042 | High | 7.8 | 2021-07-15 | A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Wind… |
CVE-2021-3044 | Critical | 9.8 | 2021-06-22 | An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker with network access to the Cortex XSOAR se… |
CVE-2021-3041 | High | 7.8 | 2021-06-10 | A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows u… |
CVE-2021-3040 | Medium | 6.7 | 2021-06-10 | An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This… |
CVE-2021-3039 | Low | 3.8 | 2021-06-10 | An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role… |
CVE-2021-3038 | Medium | 5.5 | 2021-04-20 | A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted i… |
CVE-2021-3037 | Low | 2.3 | 2021-04-20 | An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration… |
CVE-2021-3036 | Medium | 4.4 | 2021-04-20 | An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in clea… |
CVE-2021-3035 | Medium | 6.7 | 2021-04-20 | An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This… |
CVE-2021-3034 | Medium | 5.1 | 2021-03-10 | An information exposure through log file vulnerability exists in Cortex XSOAR software where the secrets configured for the SAML single sign-on (SSO) integrati… |
CVE-2021-3033 | Critical | 9.1 | 2021-02-10 | An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an… |
CVE-2021-3032 | Medium | 4.4 | 2021-01-13 | An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “s… |
CVE-2021-3031 | Medium | 4.3 | 2021-01-13 | Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewal… |
CVE-2020-2049 | High | 7.8 | 2020-12-09 | A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows use… |
CVE-2020-2020 | Medium | 5.5 | 2020-12-09 | An improper handling of exceptional conditions vulnerability in Cortex XDR Agent allows a local authenticated Windows user to create files in the software's in… |
CVE-2020-2050 | High | 8.2 | 2020-11-12 | An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass al… |
CVE-2020-2048 | Low | 3.3 | 2020-11-12 | An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed… |
CVE-2020-2022 | High | 7.5 | 2020-11-12 | An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's se… |
CVE-2020-2000 | High | 7.2 | 2020-11-12 | An OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allows authenticated administrators to disrupt system p… |
CVE-2020-1999 | Medium | 5.3 | 2020-11-12 | A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the netwo… |
CVE-2020-2044 | Low | 3.3 | 2020-09-09 | An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using… |
CVE-2020-2043 | Low | 3.3 | 2020-09-09 | An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-O… |
CVE-2020-2042 | High | 7.2 | 2020-09-09 | A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute… |
CVE-2020-2041 | High | 7.5 | 2020-09-09 | An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically crafted request to… |
CVE-2020-2040 | Critical | 9.8 | 2020-09-09 | A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privi… |
CVE-2020-2039 | Medium | 5.3 | 2020-09-09 | An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the… |
CVE-2020-2038 | High | 7.2 | 2020-09-09 | An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root pr… |
CVE-2020-2037 | High | 7.2 | 2020-09-09 | An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root pr… |
CVE-2020-2036 | High | 8.8 | 2020-09-09 | A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an… |
CVE-2020-2035 | Low | 3.0 | 2020-08-12 | When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL… |
CVE-2020-2034 | High | 8.1 | 2020-07-08 | An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with… |
CVE-2020-2031 | Medium | 4.9 | 2020-07-08 | An integer underflow vulnerability in the dnsproxyd component of the PAN-OS management interface allows authenticated administrators to issue a command from th… |
CVE-2020-2030 | High | 7.2 | 2020-07-08 | An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root pr… |
CVE-2020-1982 | Medium | 4.8 | 2020-07-08 | Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, which is known to be a cryptographically weak protocol. These clou… |
CVE-2020-2021 | Critical | 10.0 | 2020-06-29 | When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), impro… |
CVE-2020-2033 | Medium | 5.3 | 2020-06-10 | When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon authentication coo… |
CVE-2020-2032 | High | 7.0 | 2020-06-10 | A race condition vulnerability Palo Alto Networks GlobalProtect app on Windows allows a local limited Windows user to execute programs with SYSTEM privileges… |
CVE-2020-2029 | High | 7.2 | 2020-06-10 | An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS commands with root pri… |
CVE-2020-2028 | High | 7.2 | 2020-06-10 | An OS Command Injection vulnerability in PAN-OS management server allows authenticated administrators to execute arbitrary OS commands with root privileges whe… |
CVE-2020-2027 | High | 7.2 | 2020-06-10 | A buffer overflow vulnerability in the authd component of the PAN-OS management server allows authenticated administrators to disrupt system processes and pote… |
CVE-2020-2018 | Critical | 9.0 | 2020-05-13 | An authentication bypass vulnerability in the Panorama context switching feature allows an attacker with network access to a Panorama's management interface to… |
CVE-2020-2017 | High | 8.8 | 2020-05-13 | A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated adm… |
CVE-2020-2016 | High | 7.0 | 2020-05-13 | A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux… |
CVE-2020-2015 | High | 8.8 | 2020-05-13 | A buffer overflow vulnerability in the PAN-OS management server allows authenticated users to crash system processes or potentially execute arbitrary code with… |
CVE-2020-2014 | High | 8.8 | 2020-05-13 | An OS Command Injection vulnerability in PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands with root privilege… |
CVE-2020-2013 | High | 8.3 | 2020-05-13 | A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PA… |
CVE-2020-2012 | High | 7.5 | 2020-05-13 | Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated att… |
CVE-2020-2011 | High | 7.5 | 2020-05-13 | An improper input validation vulnerability in the configuration daemon of Palo Alto Networks PAN-OS Panorama allows for a remote unauthenticated user to send a… |
CVE-2020-2010 | High | 7.2 | 2020-05-13 | An OS command injection vulnerability in PAN-OS management interface allows an authenticated administrator to execute arbitrary OS commands with root privilege… |
CVE-2020-2009 | High | 7.2 | 2020-05-13 | An external control of filename vulnerability in the SD WAN component of Palo Alto Networks PAN-OS Panorama allows an authenticated administrator to send a req… |
CVE-2020-2008 | High | 7.2 | 2020-05-13 | An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated administrators to execute code with ro… |
CVE-2020-2007 | High | 7.2 | 2020-05-13 | An OS command injection vulnerability in the management server component of PAN-OS allows an authenticated user to potentially execute arbitrary commands with… |
CVE-2020-2006 | High | 7.2 | 2020-05-13 | A stack-based buffer overflow vulnerability in the management server component of PAN-OS that allows an authenticated user to potentially execute arbitrary cod… |
CVE-2020-2005 | High | 7.1 | 2020-05-13 | A cross-site scripting (XSS) vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise… |
CVE-2020-2004 | Medium | 6.8 | 2020-05-13 | Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on Globa… |
CVE-2020-2003 | Medium | 6.5 | 2020-05-13 | An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator to delete arbitrary system files affect… |
CVE-2020-2002 | High | 8.1 | 2020-05-13 | An authentication bypass by spoofing vulnerability exists in the authentication daemon and User-ID components of Palo Alto Networks PAN-OS by failing to verify… |
CVE-2020-2001 | High | 8.1 | 2020-05-13 | An external control of path and data vulnerability in the Palo Alto Networks PAN-OS Panorama XSLT processing logic that allows an unauthenticated user with net… |
CVE-2020-1998 | Medium | 5.4 | 2020-05-13 | An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the acc… |
CVE-2020-1997 | Medium | 5.3 | 2020-05-13 | An open redirection vulnerability in the GlobalProtect component of Palo Alto Networks PAN-OS allows an attacker to specify an arbitrary redirection target awa… |
CVE-2020-1996 | Medium | 5.3 | 2020-05-13 | A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the ma… |
CVE-2020-1995 | Medium | 4.9 | 2020-05-13 | A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to send a request that causes the rasmgr daemon to… |
CVE-2020-1994 | Medium | 4.1 | 2020-05-13 | A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integr… |
CVE-2020-1993 | Low | 3.7 | 2020-05-13 | The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an at… |
CVE-2020-1992 | High | 8.1 | 2020-04-08 | A format string vulnerability in the Varrcvr daemon of PAN-OS on PA-7000 Series devices with a Log Forwarding Card (LFC) allows remote attackers to crash the d… |
CVE-2020-1991 | High | 7.8 | 2020-04-08 | An insecure temporary file vulnerability in Palo Alto Networks Traps allows a local authenticated Windows user to escalate privileges or overwrite system files… |
CVE-2020-1990 | High | 7.2 | 2020-04-08 | A stack-based buffer overflow vulnerability in the management server component of PAN-OS allows an authenticated user to upload a corrupted PAN-OS configuratio… |
CVE-2020-1989 | High | 7.0 | 2020-04-08 | An incorrect privilege assignment vulnerability when writing application-specific files in the Palo Alto Networks Global Protect Agent for Linux on ARM platfor… |
CVE-2020-1988 | Medium | 4.2 | 2020-04-08 | An unquoted search path vulnerability in the Windows release of Global Protect Agent allows an authenticated local user with file creation privileges on the ro… |
CVE-2020-1987 | Low | 3.9 | 2020-04-08 | An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie… |
CVE-2020-1986 | Medium | 5.5 | 2020-04-08 | Improper input validation vulnerability in Secdo allows an authenticated local user with 'create folders or append data' access to the root of the OS disk (C:\… |
CVE-2020-1985 | High | 7.8 | 2020-04-08 | Incorrect Default Permissions on C:\Programdata\Secdo\Logs folder in Secdo allows local authenticated users to overwrite system files and gain escalated privil… |
CVE-2020-1984 | High | 7.8 | 2020-04-08 | Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with 'create folders or append data' access to the root… |
CVE-2020-1978 | Medium | 5.8 | 2020-04-08 | TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) inadvertently collect… |
CVE-2020-1981 | High | 7.0 | 2020-03-11 | A predictable temporary filename vulnerability in PAN-OS allows local privilege escalation. This issue allows a local attacker who bypassed the restricted shel… |
CVE-2020-1980 | High | 7.8 | 2020-03-11 | A shell command injection vulnerability in the PAN-OS CLI allows a local authenticated user to escape the restricted shell and escalate privileges. This issue… |
CVE-2020-1979 | High | 8.1 | 2020-03-11 | A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and acc… |
CVE-2020-1977 | High | 7.5 | 2020-02-12 | Insufficient Cross-Site Request Forgery (XSRF) protection on Expedition Migration Tool allows remote unauthenticated attackers to hijack the authentication of… |
CVE-2020-1976 | Medium | 4.7 | 2020-02-12 | A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS ker… |
CVE-2020-1975 | Medium | 6.8 | 2020-02-12 | Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that… |
CVE-2019-17440 | Critical | 10.0 | 2019-12-20 | Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an… |
CVE-2019-17437 | High | 7.8 | 2019-12-05 | An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges an… |
CVE-2019-17436 | High | 7.1 | 2019-10-16 | A Local Privilege Escalation vulnerability exists in GlobalProtect Agent for Linux and Mac OS X version 5.0.4 and earlier and version 4.1.12 and earlier, that… |
CVE-2019-17435 | Medium | 5.5 | 2019-10-16 | A Local Privilege Escalation vulnerability exists in the GlobalProtect Agent for Windows 5.0.3 and earlier, and GlobalProtect Agent for Windows 4.1.12 and earl… |
CVE-2019-1583 | High | 8.0 | 2019-08-23 | Escalation of privilege vulnerability in the Palo Alto Networks Twistlock console 19.07.358 and earlier allows a Twistlock user with Operator capabilities to e… |
CVE-2019-1582 | High | 7.2 | 2019-08-23 | Memory corruption in PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow an administrative user to cause arbitrary memory corruption by rekeying… |
CVE-2019-1581 | Critical | 9.8 | 2019-08-23 | A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SS… |
CVE-2019-1580 | Critical | 9.8 | 2019-08-23 | Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow a remote, unauthen… |
CVE-2019-1579 | High | 8.1 | 2019-07-19 | Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gatew… |
CVE-2019-1576 | High | 8.8 | 2019-07-16 | Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentially run with the esca… |
CVE-2019-1575 | High | 8.8 | 2019-07-16 | Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an auth… |
CVE-2019-1578 | Medium | 6.1 | 2019-07-01 | Cross-site scripting vulnerability in Palo Alto Networks MineMeld version 0.9.60 and earlier may allow a remote attacker able to convince an authenticated Mine… |