Filtered by vendor Paloaltonetworks Subscriptions
Filtered by product Pan-os Subscriptions
Total 189 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-9474 1 Paloaltonetworks 1 Pan-os 2024-12-20 7.2 High
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
CVE-2024-0012 1 Paloaltonetworks 1 Pan-os 2024-12-20 9.8 Critical
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
CVE-2024-0007 1 Paloaltonetworks 4 Pan-os, Panorama M-200, Panorama M-500 and 1 more 2024-12-17 6.8 Medium
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface on Panorama appliances. This enables the impersonation of another authenticated administrator.
CVE-2024-0008 1 Paloaltonetworks 1 Pan-os 2024-12-09 6.6 Medium
Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.
CVE-2024-0009 1 Paloaltonetworks 1 Pan-os 2024-12-09 6.3 Medium
An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credentials to establish a VPN connection from an unauthorized IP address.
CVE-2024-0010 1 Paloaltonetworks 1 Pan-os 2024-12-09 4.3 Medium
A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the context of a user’s browser) if a user clicks on a malicious link, allowing phishing attacks that could lead to credential theft.
CVE-2024-0011 1 Paloaltonetworks 1 Pan-os 2024-12-09 4.3 Medium
A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the context of an authenticated Captive Portal user’s browser) if a user clicks on a malicious link, allowing phishing attacks that could lead to credential theft.
CVE-2023-6793 1 Paloaltonetworks 1 Pan-os 2024-12-02 2.7 Low
An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API keys from the firewall and disrupt XML API usage.
CVE-2024-3400 1 Paloaltonetworks 1 Pan-os 2024-11-29 10 Critical
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
CVE-2023-6795 1 Paloaltonetworks 1 Pan-os 2024-11-21 5.5 Medium
An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.
CVE-2023-6794 1 Paloaltonetworks 1 Pan-os 2024-11-21 5.5 Medium
An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.
CVE-2023-6792 1 Paloaltonetworks 1 Pan-os 2024-11-21 5.5 Medium
An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.
CVE-2023-6791 1 Paloaltonetworks 1 Pan-os 2024-11-21 4.9 Medium
A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web interface.
CVE-2023-6790 1 Paloaltonetworks 1 Pan-os 2024-11-21 8.8 High
A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an administrator’s browser when they view a specifically crafted link to the PAN-OS web interface.
CVE-2023-6789 1 Paloaltonetworks 1 Pan-os 2024-11-21 4.3 Medium
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguises all associated actions as performed by that unsuspecting authenticated administrator.
CVE-2023-38046 1 Paloaltonetworks 1 Pan-os 2024-11-21 5.5 Medium
A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.
CVE-2023-0010 1 Paloaltonetworks 1 Pan-os 2024-11-21 5.4 Medium
A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.
CVE-2023-0008 1 Paloaltonetworks 1 Pan-os 2024-11-21 4.4 Medium
A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.
CVE-2023-0007 1 Paloaltonetworks 4 Pan-os, Panorama M-200, Panorama M-500 and 1 more 2024-11-21 6.5 Medium
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrator’s browser when viewed.
CVE-2023-0005 1 Paloaltonetworks 1 Pan-os 2024-11-21 4.1 Medium
A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device configuration and encrypted API keys.