Advisories · Technology

Palo Alto Networks Expedition.

Every CVE that names Palo Alto Networks Expedition among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-0107 CVE record

CVSS 7.7 HighCritical · CVSS 7+ and EPSS

Expedition: OS Command Injection Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks Expedition
- Command injection
Not analysed yet 11 Jan 2025
CVE-2025-0106 CVE record

CVSS 6.9 Medium

Expedition: Wildcard Expansion Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks Expedition
- CWE-155
Not analysed yet 11 Jan 2025
CVE-2025-0105 CVE record

CVSS 6.9 Medium

Expedition: Arbitrary File Deletion Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks Expedition
- Path traversal
Not analysed yet 11 Jan 2025
CVE-2025-0104 CVE record

CVSS 7.0 High

Expedition: Cross-Site Scripting (XSS) Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks Expedition
- Cross-site scripting (XSS)
Not analysed yet 11 Jan 2025
CVE-2025-0103 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Expedition: SQL Injection Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks Expedition
- SQL injection
Not analysed yet 11 Jan 2025
CVE-2024-9467 CVE record

CVSS 7.0 High

Expedition: Reflected Cross-Site Scripting Vulnerability Leads to Expedition Session Disclosure
- Palo Alto Networks Expedition
- Cross-site scripting (XSS)
Not analysed yet 9 Oct 2024
CVE-2024-9466 CVE record

CVSS 8.2 HighCritical · CVSS 7+ and EPSS

Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential Disclosure
- Palo Alto Networks Expedition
- Information disclosure
Not analysed yet 9 Oct 2024
CVE-2024-9465 CVE record

CVSS 9.2 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
- Palo Alto Networks Expedition
- SQL injection
Not analysed yet 9 Oct 2024
CVE-2024-9464 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure
- Palo Alto Networks Expedition
- Command injection
Not analysed yet 9 Oct 2024
CVE-2024-9463 CVE record

CVSS 9.9 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure
- Palo Alto Networks Expedition
- Command injection
Not analysed yet 9 Oct 2024
CVE-2024-5910 CVE record

CVSS 9.3 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Expedition: Missing Authentication Leads to Admin Account Takeover
- Palo Alto Networks Expedition
- Authentication bypass
Not analysed yet 10 Jul 2024
CVE-2020-1977 CVE record

CVSS 7.5 High

Expedition Migration Tool: Insufficient Cross Site Request Forgery protection.
- Palo Alto Networks Expedition
- Cross-site request forgery (CSRF)
Not analysed yet 12 Feb 2020
CVE-2018-10143 CVE record

Palo Alto Networks Expedition: The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an…
- Palo Alto Networks Expedition
Not analysed yet 12 Dec 2018
CVE-2018-10142 CVE record

The Expedition Migration tool 1.0.106 and earlier may allow an unauthenticated attacker to enumerate files on the operating system.
- Palo Alto Networks Expedition
Not analysed yet 27 Nov 2018