# Palo Alto Networks PAN-OS. Every CVE that names Palo Alto Networks PAN-OS among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [PAN-OS: GlobalProtect registration open redirect](https://agentprime.io/advisories/CVE-2020-1997.md) `CVE-2020-1997` · CVE record: Palo Alto Networks PAN-OS · CVSS 5.3 Medium · Not analysed yet · Published 13 May 2020 · Tags: Open redirect - [PAN-OS: Panorama management server log injection](https://agentprime.io/advisories/CVE-2020-1996.md) `CVE-2020-1996` · CVE record: Palo Alto Networks PAN-OS · CVSS 5.3 Medium · Not analysed yet · Published 13 May 2020 · Tags: Broken access control - [PAN-OS: Management server rasmgr denial of service](https://agentprime.io/advisories/CVE-2020-1995.md) `CVE-2020-1995` · CVE record: Palo Alto Networks PAN-OS · CVSS 4.9 Medium · Not analysed yet · Published 13 May 2020 · Tags: Memory corruption - [PAN-OS: Predictable temporary file vulnerability](https://agentprime.io/advisories/CVE-2020-1994.md) `CVE-2020-1994` · CVE record: Palo Alto Networks PAN-OS · CVSS 4.1 Medium · Not analysed yet · Published 13 May 2020 · Tags: CWE-377 - [PAN-OS: GlobalProtect Portal PHP session fixation vulnerability](https://agentprime.io/advisories/CVE-2020-1993.md) `CVE-2020-1993` · CVE record: Palo Alto Networks PAN-OS · CVSS 3.7 Low · Not analysed yet · Published 13 May 2020 · Tags: Authentication bypass - [PAN-OS on PA-7000 Series: Varrcvr daemon network-based denial of service or privilege escalation](https://agentprime.io/advisories/CVE-2020-1992.md) `CVE-2020-1992` · CVE record: Palo Alto Networks PAN-OS · CVSS 8.1 High · Not analysed yet · Published 8 Apr 2020 · Tags: Memory corruption - [PAN-OS: Buffer overflow in the management server](https://agentprime.io/advisories/CVE-2020-1990.md) `CVE-2020-1990` · CVE record: Palo Alto Networks PAN-OS · CVSS 7.2 High · Not analysed yet · Published 8 Apr 2020 · Tags: Memory corruption - [PAN-OS: A format string vulnerability in PAN-OS log daemon (logd) on Panorama allows local privilege escalation](https://agentprime.io/advisories/CVE-2020-1979.md) `CVE-2020-1979` · CVE record: Palo Alto Networks PAN-OS · CVSS 8.1 High · Not analysed yet · Published 11 Mar 2020 · Tags: Memory corruption - [PAN-OS: Shell injection vulnerability in PAN-OS CLI allows execution of shell commands](https://agentprime.io/advisories/CVE-2020-1980.md) `CVE-2020-1980` · CVE record: Palo Alto Networks PAN-OS · CVSS 7.8 High · Not analysed yet · Published 11 Mar 2020 · Tags: Command injection - [PAN-OS: Predictable temporary filename vulnerability allows local privilege escalation](https://agentprime.io/advisories/CVE-2020-1981.md) `CVE-2020-1981` · CVE record: Palo Alto Networks PAN-OS · CVSS 7.0 High · Not analysed yet · Published 11 Mar 2020 · Tags: CWE-377 - [Missing XML Validation in PAN-OS Web Interface](https://agentprime.io/advisories/CVE-2020-1975.md) `CVE-2020-1975` · CVE record: Palo Alto Networks PAN-OS · CVSS 6.8 Medium · Not analysed yet · Published 12 Feb 2020 · Tags: CWE-112 - [PAN-OS on PA-7000 Series: Improper restriction of communication to Log Forwarding Card (LFC) allows root access](https://agentprime.io/advisories/CVE-2019-17440.md) `CVE-2019-17440` · CVE record: Palo Alto Networks PAN-OS · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Dec 2019 · Tags: CWE-923 - [PAN-OS: Custom-role users may escalate privileges](https://agentprime.io/advisories/CVE-2019-17437.md) `CVE-2019-17437` · CVE record: Palo Alto Networks PAN-OS · CVSS 7.8 High · Not analysed yet · Published 5 Dec 2019 · Tags: CWE-280 - [Memory corruption in PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow an administrative user to cause arbitrary memory corruption by rekeying the current client interactive session.](https://agentprime.io/advisories/CVE-2019-1582.md) `CVE-2019-1582` · CVE record: Palo Alto Networks PAN-OS · No CVSS score · Not analysed yet · Published 23 Aug 2019 - [PAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interface](https://agentprime.io/advisories/CVE-2019-1581.md) `CVE-2019-1581` · CVE record: Palo Alto Networks PAN-OS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Aug 2019 · Tags: Command injection - [Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow a remote, unauthenticated user to craft a message to Secur…](https://agentprime.io/advisories/CVE-2019-1580.md) `CVE-2019-1580` · CVE record: Palo Alto Networks PAN-OS · No CVSS score · Not analysed yet · Published 23 Aug 2019 - [Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an authenticated user with read-only privileges…](https://agentprime.io/advisories/CVE-2019-1575.md) `CVE-2019-1575` · CVE record: Palo Alto Palo Alto Networks PAN-OS · No CVSS score · Not analysed yet · Published 16 Jul 2019 - [Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentially run with the escalated user’s permissions.](https://agentprime.io/advisories/CVE-2019-1576.md) `CVE-2019-1576` · CVE record: Palo Alto Palo Alto Networks PAN-OS · No CVSS score · Not analysed yet · Published 16 Jul 2019 - [PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files.](https://agentprime.io/advisories/CVE-2019-1572.md) `CVE-2019-1572` · CVE record: Palo Alto Networks PAN-OS · No CVSS score · Not analysed yet · Published 26 Mar 2019 - [The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML.](https://agentprime.io/advisories/CVE-2019-1566.md) `CVE-2019-1566` · CVE record: Palo Alto Networks Palo Alto Networks PAN-OS · No CVSS score · Not analysed yet · Published 30 Jan 2019 - [The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next Generation Firewall with…](https://agentprime.io/advisories/CVE-2019-1565.md) `CVE-2019-1565` · CVE record: Palo Alto Networks Palo Alto Networks PAN-OS · No CVSS score · Not analysed yet · Published 30 Jan 2019 - [Palo Alto Networks PAN-OS: The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may…](https://agentprime.io/advisories/CVE-2018-10140.md) `CVE-2018-10140` · CVE record: Palo Alto Networks PAN-OS · No CVSS score · Not analysed yet · Published 16 Aug 2018 - [Palo Alto Networks PAN-OS: The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and…](https://agentprime.io/advisories/CVE-2018-10139.md) `CVE-2018-10139` · CVE record: Palo Alto Networks PAN-OS · No CVSS score · Not analysed yet · Published 16 Aug 2018 Newest: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .