Filtered by vendor Paloaltonetworks Subscriptions
Total 276 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-6792 1 Paloaltonetworks 1 Pan-os 2024-11-21 5.5 Medium
An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.
CVE-2023-6791 1 Paloaltonetworks 1 Pan-os 2024-11-21 4.9 Medium
A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web interface.
CVE-2023-6790 1 Paloaltonetworks 1 Pan-os 2024-11-21 8.8 High
A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an administrator’s browser when they view a specifically crafted link to the PAN-OS web interface.
CVE-2023-6789 1 Paloaltonetworks 1 Pan-os 2024-11-21 4.3 Medium
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguises all associated actions as performed by that unsuspecting authenticated administrator.
CVE-2023-3282 2 Linux, Paloaltonetworks 2 Linux Kernel, Cortex Xsoar 2024-11-21 6.4 Medium
A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system enables a local attacker to execute programs with elevated privileges if the attacker has shell access to the engine.
CVE-2023-3280 2 Microsoft, Paloaltonetworks 2 Windows, Cortex Xdr Agent 2024-11-21 5.5 Medium
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to disable the agent.
CVE-2023-38046 1 Paloaltonetworks 1 Pan-os 2024-11-21 5.5 Medium
A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.
CVE-2023-0010 1 Paloaltonetworks 1 Pan-os 2024-11-21 5.4 Medium
A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.
CVE-2023-0009 1 Paloaltonetworks 1 Globalprotect 2024-11-21 7.8 High
A local privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute programs with elevated privileges.
CVE-2023-0008 1 Paloaltonetworks 1 Pan-os 2024-11-21 4.4 Medium
A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.
CVE-2023-0007 1 Paloaltonetworks 4 Pan-os, Panorama M-200, Panorama M-500 and 1 more 2024-11-21 6.5 Medium
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrator’s browser when viewed.
CVE-2023-0006 1 Paloaltonetworks 1 Globalprotect 2024-11-21 6.3 Medium
A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files from the endpoint with elevated privileges through a race condition.
CVE-2023-0005 1 Paloaltonetworks 1 Pan-os 2024-11-21 4.1 Medium
A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device configuration and encrypted API keys.
CVE-2023-0004 2 Fedoraproject, Paloaltonetworks 2 Fedora, Pan-os 2024-11-21 6.5 Medium
A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated privileges. These files can include logs and system components that impact the integrity and availability of PAN-OS software.
CVE-2023-0002 2 Microsoft, Paloaltonetworks 2 Windows, Cortex Xdr Agent 2024-11-21 5.5 Medium
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent.
CVE-2023-0001 2 Microsoft, Paloaltonetworks 2 Windows, Cortex Xdr Agent 2024-11-21 6 Medium
An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agent.
CVE-2022-0031 2 Linux, Paloaltonetworks 2 Linux Kernel, Cortex Xsoar 2024-11-21 6.7 Medium
A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system allows a local attacker with shell access to the engine to execute programs with elevated privileges.
CVE-2022-0030 1 Paloaltonetworks 1 Pan-os 2024-11-21 8.1 High
An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target firewall or Panorama appliance to impersonate an existing PAN-OS administrator and perform privileged actions.
CVE-2022-0029 2 Microsoft, Paloaltonetworks 2 Windows, Cortex Xdr Agent 2024-11-21 5.5 Medium
An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system with elevated privileges when generating a tech support file.
CVE-2022-0028 1 Paloaltonetworks 1 Pan-os 2024-11-21 8.6 High
A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall against an attacker-specified target. To be misused by an external attacker, the firewall configuration must have a URL filtering profile with one or more blocked categories assigned to a source zone that has an external facing interface. This configuration is not typical for URL filtering and, if set, is likely unintended by the administrator. If exploited, this issue would not impact the confidentiality, integrity, or availability of our products. However, the resulting denial-of-service (DoS) attack may help obfuscate the identity of the attacker and implicate the firewall as the source of the attack. We have taken prompt action to address this issue in our PAN-OS software. All software updates for this issue are expected to be released no later than the week of August 15, 2022. This issue does not impact Panorama M-Series or Panorama virtual appliances. This issue has been resolved for all Cloud NGFW and Prisma Access customers and no additional action is required from them.